[rowanG077]

I would never expect them to do that without vendoring the package. Which mitigates that risk.