diff --git a/Updating-JS-dependencies.md b/Updating-JS-dependencies.md
new file mode 100644
index 0000000..0771226
--- /dev/null
+++ b/Updating-JS-dependencies.md
@@ -0,0 +1,11 @@
+Sometimes security problems (or other reasons) make it necessary to update Javascript dependencies. In general it's a good idea to follow this process:
+
+- `yarn why <pkg>`                (tells us what is pulling `pkg` in)
+- `yarn info <pkg>`               (figure out which versions are available)
+- consult  `package.json`, try updating the version
+- run `yarn install && yarn test`
+- verify in `git diff` if all occurrences in `yarn.lock` were updated
+
+Sometimes an old leaf package is pulled in through a bit which hasn't updated its pinned dependencies in a while, so an old version is still pulled in.
+
+Using  [`nvm`](https://github.com/nvm-sh/nvm) to get the right version of node can help too.
\ No newline at end of file