If you only have a limited number of dependencies and whose maintainers have a good culture of documenting their changes, then there’s the middle ground of checking the release notes/changelogs and only updating for relevant security fixes, and for other updates at your own discretion.