[why-oh-why]

> Your CI system isn't going to re-run your tests when your dependencies or sub-dependencies get updates.

Yes and no. Your CI system runs when you want it to. If you want to check the latest dependencies,

- with a lockfile you have to delete it, create a new one and commit it;

- without a lock you just press the “rerun tests” on your CI

[AgentME]

Are you going to press the rerun tests button on every project every day in perpetuity? No one does that. If you're going to automate something to deal with this (that either reruns on dependency updates or just every day), then you can make that automation ignore or update your lockfile, and then the big problems in my post stay solved. If you run into a problem with a new version of a build/test dependency, then your project stays working for developers in the meantime until it's solved.