To me, dependency management is a part of software maintenance and it's not always just 'running in place'. Updates bring security patches (sometimes not publicly explained or disclosed), performance improvements, and new features that could enhance the value generated by the said software.