The problem with not updating dependencies for a long time is that it can force you to make sudden version jumps if something like a CVE is discovered.

At my company we had a real scramble to upgrade log4j when the CVE for that came out. A lot of software was many versions behind. Luckily for us, no breaking changes had been made, and it was simply a matter of bumping the version to the latest one.

That was a lucky break, because if that had been a library like Jersey or Spring it would have been an entirely different ballgame.

If you don't keep your builds up to date, you open yourself up to risks like that, which are unknown and to some extent unknowable.