A lot of people use tools like Dependabot which automates updates to the lockfile.