> We don’t allow automatic upgrading of packages/dependencies due to the risk of malicious code That's a good idea, how do you do that? > you always need loca

> We don’t allow automatic upgrading of packages/dependencies due to the risk of malicious code That's a good idea, how do you do that? > you always need local archived copies of any dependencies you use. Are you committing your dependencies? Or using a package manager with caching?