Dependabot is great for this. We have everything pinned, but dependabot takes care of a bunch of manual steps to upgrade a dependency: it updates package.json,

Dependabot is great for this. We have everything pinned, but dependabot takes care of a bunch of manual steps to upgrade a dependency: it updates package.json, package-lock.json, pulls release notes for all the changes since your pinned version, and makes a PR and triggers your CI build. We’ve found many broken builds thanks to this, and could then create an issue in our tracker to tackle that tech debt later. If the build doesn’t break, we review the new version’s release notes, and sometimes even look at the code changes of the open source package. Overall it’s helped us keep more up to date, has made upgrading versions of Node less painful, and even helped us adopt some improvements sooner than we otherwise would have.