A reminder: When that major security bug shows up in one of your dependencies, and you need to ship a fix right now, that's not the time to discover you're 3 years and 6 API-breaking changes behind the version that has the fix.
Upgrade your dependencies when you don't *have* to. That way, when it is critical, it will be fast and low-risk.
This is *especially* true about that risky upgrade you've been avoiding. Take the hit now when you can schedule it. Don't let others schedule it for you.