reminder to lock versions of your dependencies and make sure your package manager remembers their hash.