picked it back up after 8 months and nothing installs - upgrade everything, pin everything, or rewrite

Get it running first, on the old versions, in a container. You need a green baseline before you change anything, or you'll be debugging your upgrade and your rot simultaneously and you won't be able to tell which broke what.

Pin the old runtime in a Dockerfile, get the app up, commit that, then upgrade one major at a time with a working state to fall back to. It feels slower and it isn't. The four hours you just spent are exactly what happens when you skip the baseline.

Concrete framing on the runtime part: Node majors have a published lifecycle, and the even-numbered ones get roughly three years in total, with active support only for the first year or so. If your project is sitting on an odd version or one that's dropped off the list, you're not choosing between upgrading and not upgrading, you're choosing between upgrading now and upgrading later with more drift on top.

Target the current LTS. Jumping two Node majors is usually far less painful than jumping one major of a web framework, so do the runtime first.

The rewrite question deserves a real answer rather than the reflex 'never rewrite'. Ask what fraction of the code is your logic versus glue. If a side project is 80% framework wiring and 20% the thing that makes it yours, scaffolding fresh and porting the 20% genuinely can be faster than an upgrade path through three majors. I've done it, it took a weekend, and the old repo stayed as reference.

If it's a real product with users and data, absolutely not. Upgrade incrementally. The difference is whether anyone is depending on it right now.

Pulled package versions are often still resolvable from your local cache or a mirror. Check that before assuming you're forced into an upgrade.

Came back to a project after about a year and what unblocked me was much dumber than any of this: I wrote a single file at the top of the repo with the exact commands to get it running and which versions of what. Took twenty minutes while it was fresh, right after I fixed it. When I came back three months later I lost zero time.

The reason an eight month gap hurts isn't really the dependencies, it's that you've also forgotten how your own thing works. The dependency rot just makes that visible.