as we make more CI environments locked, we should figure out how exactly we want lock file updates to work. Quoting #23567 (comment) @rgommers :

The main point of a semi-frequent update is to detect failures for new versions of dependencies. CI is the worst place for those failures to show up, since they then bother every contributor (hence pinning is good). That said, ideally we would get a quick signal about it, so we can file an upstream bug report or fix something. That doesn't mean that we actually need to update the lock file, that doesn't really do much.

Maybe the nicest thing would be some separate repo that did update everything, ran CI and checked it passed, and only if it didn't then would open an issue about the failure.