> where "upgrading" a library can break things that there's no way to know until production.

unless you have automated testing