Author here. It’s not by any means a few dependencies. There are over 2 million lines of vendored packages, you can imagine how much effort it’s needed to upgrade them, be sure each team uses the corrext version, has no security exposures, etc...