@cblgh

anyone have tips on improving that workflow?

I think npm update --depth 9999 multifeed should do the trick, does that work for you? If you drop "multifeed" from the end of the command it will be less specific and should update everything while respecting semver and avoiding duplication when possible. I was also using that workaround until recently, but I think it was only really required between npm 5.0 and 5.1 before this PR was merged.