Comment by grayhatter

> some of the code. No one is evaluating all of the code of libraries they use. You can certainly check some!

I do.

I don't review the whole repo, but every single time I update dep versions, I always look at the full diff between the two. It doesn't take that long