It wouldn’t matter if those dependencies where stable, but JS has a culture of abandon libraries or to make backward-breaking changes every week, so upgrading a project after just a few months is a major pain

That's what I learned when I had to do front-end development using Angular: never upgrade packages.

And you never know if package Y required by package X will break the security of your app.