In my experience this only happen if the project does not have a lock file and does not specify a node version (two good practice that must be followed).

I'm talking about upgrading dependencies. Something that's rarely easy in a JS/TS project with lots of dependencies.