That justifies using something like rollup or webpack to bundle all your dependencies into one huge file to make a "static build" of sorts. Then you can at least do a cursory check for anything obviously bad in the changes, if tree-shaking works well enough.

It leaves vulnerabilities open until next release, but deals with direct attacks.