Can you fully lockdown your dependencies and look at the diffs whenever you attempt an update?