go.sum and package-lock.json aren't infrastructure. They're a liability you haven't priced. Gorilla got archived quietly. Dependabot opens PRs nobody reviews. When did you last actually look at your dependency graph? shippingbytes.com/2026/05/28/y...
