Automating software dependencies – fire alarms vs firehoses

Traditionally there have been two approaches to keeping dependencies up to date – either wait around for a “fire alarm” (we urgently need to update *today*), or the more recent “firehose” approach of continuous real-time updates. Both approaches have downsides and can be disruptive to software teams. Is there a sustainable middle ground that better suits modern software development?