To bransonf's point, it's generally in your best interest to stay as current as possible on your dependencies. If a critical severity vulnerability is discovere

To bransonf's point, it's generally in your best interest to stay as current as possible on your dependencies. If a critical severity vulnerability is discovered in a dependency, you suddenly have 72 hours (or whatever your SLA is) to patch or upgrade. If that involves jumping several major versions (each with breaking changes), you're going to have a bad time. If you stay current, hopefully the delta is smaller and the task is less herculean.