We pin every package in the repo, then hand a large share of our work to a model we know only by reputation. What it would take to know it properly.