I guess there's CI services that pull latest versions of dependencies (in the accepted version range), build, run tests and submit a pull request if everything

I guess there's CI services that pull latest versions of dependencies (in the accepted version range), build, run tests and submit a pull request if everything seems ok. Edit: actually no I don't know, there would be nothing to submit if no lockfile is used.