I correctly assumed (and this has been validated through actual plugin upgrades) that the latest hash in npm points to the most recently published version, and not the highest version.
That is, given your plugin nodebb-plugin-example
If v1.0.0 is compatible with v0.5.4
If v1.1.0 is compatible only with v0.6.0
The latter is published first
A user typing npm install nodebb-plugin-example will receive v1.0.0 of the plugin, irrespective of what NodeBB version he/she is running, even though v1.1.0 is technically newer
Now, special note: The NodeBB Package Manager doesn't do this. When the ACP calls nbbpm to request a suggested package, we query npm for the plugin data, and sort the versions before checking compatibility, so this issue is moot.
So you want your static Gatsby site to be dynamic. Heh, you are not the only one to have given this some thought...
But... where's the "win" here?
Security: Well, the moment you go dynamic you open the door much wider to crackers. Maybe some small win that your static content is "safe" and only comments system exposed.
Narrow minded to only analyze a single vector though so lets take speed and performance. Well, a static article might load faster since now main potential bottleneck is backend db and script glue.
On to stability: Maybe a bit more stable to only make comments dynamic?
Maintenance: I question whether this pans out on the cost/benefit front because the moment you go dynamic you add a LOT to your stack. Admin that stuff takes time so you may as well leverage it for other stuff.
So ye' needs to be rollin' up yer' sleeves and experiment to find where your sweet spot lies. I think I would be inclined to go with dynamic blog such as ghost (definitely not WP). Ditto on the wiki front.
NodeBB is awesome sauce for sure but seems overkill for a blog comment system. Disqus sucks privacy & copyright wise but there are other 3rd party offerings w/less egregious terms, e.g. Muut and a couple others I don't recall off top of my head. Personally, I just do w/o comments. No interest/need in becoming an Internet Personality. I just toss some stuff "out there" for whatever it may be worth to whomever. Yeah, maybe missing some back and forth, contribs, etc. but when it comes to bloggin' I would rather spend my time writing than maintaining and sweating the next zero day exploit. Yeah, I am a freak.
Be all that as it may....
Perhaps these are the droids yer' looking for:
Reflections on the Digital Sabbath