> The fact that bitpay didn't lock down their version numbers of dependencies, and are thus at the whim of whatever changes upstream of them are gleefully picke

> The fact that bitpay didn't lock down their version numbers of dependencies, and are thus at the whim of whatever changes upstream of them are gleefully picked up, is crazy, especially for a crypto wallet. What it they lock down a version with compromised code in it well before it is discovered? Locking down does not help if checkins are not scrutinized for malicious code.