[jadar]

It almost doesn't matter, because you can get pwned by a transitive dependency. If someone doesn't have the same scruples as you have, you're still at risk.

[inbx0]

minimumReleaseAge and lockfiles also pin down transitive dependencies.