Distribution package managers can’t keep up with the fine-grained hash-based dependency management that newer language package managers have (e.g. cargo)