Curious if anyone here has actually switched to auditing their dependency updates manually.

Not sure what you mean by "manually". I have tooling.

1. Hard pinning. Never run npm audit fix, or npm i without analysis
2. Automated blast radius analysis (madge is your friend) for packages with reported vulns, then LLM-aided path discovery for vuln-to-product
3. Switched from git diff review for version bumps to doing npm install inside containers and diffing the entire image layer, because everyone is compromised now.
4. Stopped running nodejs outside of containers completely. I don't have npm installed anywhere except in isolated, throwaway envs.