We pretty much should automate this to avoid getting stal'd. Automated PRs updating (maybe even Dependabot) so that it updates our internal dependencies, but of course, runs our CI-against and preview branches to prevent us from merging bumps that could be breaking changes.