https://vulert.com/blog/software-dependencies-upgrades-risks-and-rewards/