expo honestly has some of the best release notes in the ecosystem. clear migration guides, actual context about why things changed, not just a list of commit hashes. more projects should take notes (pun intended)

renovate bot with grouped PRs has been the move for us. batch minor/patch updates weekly, flag majors separately for manual review. the key is actually reading what changed before merging though — blindly auto-merging patch updates has bitten me more than once

the nested dependency audit loop is truly one of the circles of hell. "just override it" they say, until three months later you discover the override masked a real vulnerability and now you have bigger problems