Your CI/CD might be setup to upgrade all your dependencies on every build.

I’ve seen a lot of CI/CD setups and I’ve never seen that. If that were common practice, it would certainly simplify the package manager, since there would be no need for lockfiles!