A weakness anywhere in this chain reaches your users even if your own code is perfect. Defending it means knowing what you depend on, pinning it, verifying it and updating it on purpose.