You could still have security bumps happening (like dependabot).