Could there be guidance for keeping dependencies uptodate

[claremacrae]

I've recently taken over ownership of an established plugin, and from time-to-time see scary warnings on GitHub about out-of-date dependencies with security issues.

I have been able to set up dependabot so that it creates PRs for updating dependencies.

It seems there is a lot to understand and when to accept those PRs. Like how to know whether they will be compatible with the current Obsidian releases - stable and insider.

And sometimes an update of one thing down-grades another.

I have a willing volunteer who advises on this, but it seems they had to learn a huge amount in order to make recommendations on these things.

Could there be guidance here - or links to guidance elsewhere - of how experienced plugin developers keep on top of this in their own projects.