It is common practice for most frameworks to continue evolving until they become extremely complex. Ideally I'd like to make use of certain frameworks but opt-out of this devolvement into complexity.

I could lock the versions, but I would still like to enjoy the benefits of using maintained dependencies: bug fixes, security patches, etc.

Locking is also harder to do when there are external dependencies like Node.js version, Ubuntu version.

How do you solve this issue?