You’re free to update as you like. It’s entirely possible to audit your local packages. Letting maintainers update your projects is a convenient feature. If it

You’re free to update as you like. It’s entirely possible to audit your local packages. Letting maintainers update your projects is a convenient feature. If it is a liability in your use case you can work around it. Yes it will take more effort, but your use case justifies it.