When I stared in professional software there was almost an extreme paranoia of adding new libraries. Now we have 20 year olds adding whatever they want via NPM.
I'm still wary from the time I tried to make a proof of concept with vue and a graph viewer, made an npm project with 5 dependencies and 2 development dependencies, and discovered I have just pulled 1400 indirect dependencies.
Any kind of dependency management on a project like this will fail. It simply can not be done.
The answer is devops:
You build your system in a way that it's nearly effortless to test and deploy, then you can upgrade your dependency tree continually with minimal effort.
This! In hindsight, I miss the days when adding just a single third party library took months of engineering and legal reviews and executive approvals. It forced us to be careful and only request external libraries when absolutely needed (and then think twice again).
Imagine going to your security team and saying that you'll walk out to the street, stop random people and the first one who claims they know how to program, you'll allow them to commit a bunch of code, with zero review, into your production codebase.
Nobody would allow that!
But we allow what is in reality the exact same thing by pulling in hundreds (if not thousands) of external dependencies without any clue what they do or if the code is any good. All if running in your production systems handling customer data.