Yes, that's why I left wiggle room for a few choice packages you track yourself.

What isn't really tenable for a small team is to drag in scores to hundreds of different third-party packages and rely on them all when you have no staff allocated to really evaluate and monitor so much upstream stuff.