Comment by jayd16

If you could understand the quality of updates you're pulling in, that solves the issue entirely. The point is that you can't.

There's no reason to pretend we live in a world where everyone is manually combing through the source of every dependency update.