I had very similar experience with npm. Especially when you need to merge all the security updates for the sdk and all their dependencies. I also prefer interacting with the api, if it is straightforward.