That's why there's an emphasis on stability. If things works fine, don't change. If you're applying security patches, don't break the API.

In NPM world, there's so much churn that it would be comical if not for the security aspects.