Though I concur that your caveats are valid, I do think dependencies should be upgraded to newest-LTS sooner rather than later. Once the dependency falls out of

Though I concur that your caveats are valid, I do think dependencies should be upgraded to newest-LTS sooner rather than later. Once the dependency falls out of upstream maintenance, it's a time bomb; and we've found (inhouse stuff for public website consumption) that if you don't do the upgrade to newest-LTS sooner, you never quite get around to it until it blows up in your face. And that's not so good. We keep finding over and over that the wonderfully-engineered project is thrown away after about three years, but that nothing lingers longer than a temporary hack. So we're getting better at futureproofing our temporary hacks ...