Some verification would be better than no verification. You still need to verify and test package upgrades and pin versions; but it would make the semver contra

Some verification would be better than no verification. You still need to verify and test package upgrades and pin versions; but it would make the semver contract at least specified to some degree.