> What's the downside except having a "update dependency" commit from time to time. This isn't a downside, it's a chance to vet and code review your dependenci

> What's the downside except having a "update dependency" commit from time to time. This isn't a downside, it's a chance to vet and code review your dependencies which you should be doing anyways (but nobody does).