thoughts on worm safety w.r.t. `exclude-newer`, and the right way to handle unpinned git repo deps?