Dependencies do not stay still
Every package brings code, maintainers, release habits, transitive dependencies, and vulnerability history. Ignoring updates just saves the risk for a worse week.
The useful signal is usually already there.
Security gets real when the trust boundaries light up. Poke it and see what has to hold.
Make updates routine
Small, regular updates are easier to review than yearly dependency archaeology. Automation can open the door, but tests and ownership still close the loop.
A policy keeps dependency work from becoming random guilt.
Review what changed
Read release notes for risky packages, watch lockfile churn, and rely on tests that exercise the behavior you actually use.
Flip the switches and watch the story turn into a tiny operating model.
Freshness lowers surprise
Dependency maintenance is not glamorous. Neither is brushing your teeth. Both are worse when skipped for months.