Is Ctrl+F5 still necessary to force the latest JavaScript to load for a website?

Our lead web developer is saying:

"The JavaScript code is now versioned in our new code and should automatically refresh when a new version is out. Yet we are still finding that it doesn’t always work. Feel free to raise this with Google and Microsoft".

So I'm asking. Is this still "a thing" in 2023? What are some options that he might not be aware of?

I am not qualified to answer this, so that is why I am asking smarter minds than my own.

I searched through the answers here on Stackoverflow and sent them to him. His reply is in the quote above.

The way URL-based versioning of any sort of extra content for pages, content fetched by simple GET requests issued implicitly by the browser, is something like this:

1. The build system (whatever that may be) uses some technique for associating a particular number with a complete build, and makes that number available for the construction of the main pages. In the past I've used timestamp (handy for development) and source repository head revision number or release id or whatever.

2. The assembly of the main pages (where scripts etc. are imported) are made to use <script> tags with URLs requesting that same version id via a dummy parameter in the URL:

<script src="/my/app/goodies.js?_=81992"></script>

The dummy parameter makes that URL look like a whole new URL to the browser, one that the cache does not recognize. That will mean that the "is this in the cache?" test will fail, and the browser will fetch the latest deployed file.

Note that the special build or timestamp id value does not do anything other than defeat browser caching.

Same goes for CSS, images, etc.

A weaker way of doing this is computing a nonce value on the client. If you can make a fairly large random number and use it as the dummy parameter, that will usually work, but personally I don't want those kinds of bugs.

One more thing: if you have a system that does not involve sessions that can time out (like a non-secured content website), that kind of cache avoidance won't work, because the browser will continue assuming the main page is cached, and it won't have updated script URLs. In that case, you can either go with an "Etag" for each resource, or set your "Expires" headers, or use "Last-Modified" and "If-Modified-"Since" to do time-based checks for cache expiration.