If you lock your dependencies, it should fail if the hash doesn't match.