Dependencies are a huge supply chain security risk; the more of them you have, and the more often you update, the bigger the attack surface.