How to clean up outdated software packages without breaking releases

One review I worked on found a long list of outdated packages across several services. The first ticket basically said update everything, which sounded responsible but gave the engineering team no way to plan the work. We changed it into smaller buckets. Direct runtime packages came first, dev-only tools went into a separate lane, and framework major upgrades became their own projects with test o…