dependabot (part of github) or similar CI tools: they can make a PR bumping a version, can sometimes show you changelogs, and it'll run your tests right there. pretty configurable, and you can interact with it right in the PR (like, you can say "@ dependabot rebase" and it'll rebase the PR on the main branch)
Brainstorming:
npm-check -u
should open an interactive dialog)npm outdated
to see what you should upgrade, and yarn has a similar thingVerbata: dev env, bumping versions, security upgrades, dev maintenance, package.json,