again, nothing blocks you to have a better supply chain to your software: Download all dependencies and freeze them, fork the dependencies and groom your fork

again, nothing blocks you to have a better supply chain to your software: Download all dependencies and freeze them, fork the dependencies and groom your fork or have dependantbot or depfu managing your dependencies for you and keep a delay between merging the PRs, have manual review, etc.. You shouldn't be pulling stuff from internet and pushing to production without take a look into that anyway...