an i just being an old curmudgeon? i dont think you can creditably claim security if importsnt to your project if you are installing unpinned deps with curl calls?