The problem is the technical debt you acquire this way. Eventually you're going to need to upgrade X for a security fix, but the new version of X isn't compati

The problem is the technical debt you acquire this way. Eventually you're going to need to upgrade X for a security fix, but the new version of X isn't compatible with the version of Y you are using, and upgrading that would break Z, and Z would break your app here and here. Now you're spending a couple weeks trying to do the upgrade to get a security fix that was 0 day two weeks ago, when you should have been writing things that actually advanced your app instead. I keep my dependencies up to date, and consider it technical debt when they are not, and would never want to go back.