I think monitoring the repository for an open source project you depend on is critical. Even if you&#x27;re not trying to be cutting edge, we have several years of security incidents that tell us that you can&#x27;t turn a blind eye.