There's a dirty secret that's fallen out of favor in the Node community, but that helps dramatically with this problem: it is usually a good idea to vendor dependencies for front-end projects (basically any project you're making that isn't being published to NPM).
The trick with this is you have to avoid dependencies that compile C code or native binaries as part of their installation process, since those binaries might not be portable. I try when possible to avoid anything that's using node-gyp.
But if you are vendoring dependencies and they're compatible with the system you're compiling on, then you will never need to worry about libraries breaking or changing underneath your nose.
You will still need to worry about security vulnerabilities, but that's just the case with all software. At the very least, 10 years from now your project will still compile.
The trick with this is you have to avoid dependencies that compile C code or native binaries as part of their installation process, since those binaries might not be portable. I try when possible to avoid anything that's using node-gyp.
But if you are vendoring dependencies and they're compatible with the system you're compiling on, then you will never need to worry about libraries breaking or changing underneath your nose.
You will still need to worry about security vulnerabilities, but that's just the case with all software. At the very least, 10 years from now your project will still compile.