Not updating dependencies: you're a subject to vulnerabilities
Updating vulnerabilities: you're a subject to supply chain attacks

AAAAAAA