When I run a application for security reasons, I need to either built it myself, or have it build by official channels. I just hand edit the signal package.jso

When I run a application for security reasons, I need to either built it myself, or have it build by official channels. I just hand edit the signal package.json each time I need an update, but I just don't understand why they won't update their dependency.