When your rock solid dependency releases a new major version, when you’re ready you update it, and fix all the things you need to in a single PR, you take that to prod when you’re ready, and roll it back if it’s unhappy, or your favourite variation of out-and-back.

What I’m advocating against, is picking a version, and then sitting on it for so long that it inevitably goes out of support, and then find yourself having a really bad, un-fun time-probably at some awful time of day- and discovering the work you need to do to get out of the current system is so much more than you initially realised, because you’re so far behind.

Breaking changes happen anyway at some point, you may as well stay abreast of them.