The main reason is security. When a security vulnerability is patched in a new version of one of the libraries you use, you should upgrade, and if you haven't u

The main reason is security. When a security vulnerability is patched in a new version of one of the libraries you use, you should upgrade, and if you haven't upgraded it in two years it is gonna be a pain in the ass. On one of our projects we've got what I think is the best take on this I've seen. Once a week, CI updates all our dependencies and makes fresh PR. That PR then goes through CI and can be merged by an engineer if it looks good.