This is not my experience, but we update our dependencies multiple times per month. Of course if you let them go for six months or a year you'll be in the situation you are talking about.