Right - a copy is a cache, and you have to manage that; when to update it, when vulnerabilities are discovered in the deps you have copied, it's up to you to change the version in your cache.