I ran `composer update` on a side project a few weeks back and watched a few dozen packages move. I manually reviewed maybe three of them. The rest I waved through, because that is what we all do. The lock file said the hashes matched what Packagist served, the tests passed, and I had other work to ship. by Eric Mann