Supply-chain security

Your dependencies run with your application's privileges, so they are part of your attack surface. An unpinned requirement resolves to whatever the index serves today — including a compromised or typosquatted release; a pinned-but-unpatched one keeps a known advisory alive in your build.

The defence is a loop: pin for reproducibility, then patch on a cadence. This repo runs exactly that — lockfiles plus the VN-DEP dependabot track that remediates real advisories on a schedule.