Sometimes that's done after security reviewing a dependency, to make sure an alarm is raised if anything at all changes.