Sure. They don't include "node_modules" directory in their .gitignore file.

So any third party code changes end up in git commits and are easily visible and reviweable.

So running npm update/upgrade includes the code that changed in the dependencies in the commit.