A production pipeline downloads a dependency from an unpinned URL. What is the principal supply-chain concern?

1. The source repository becomes read-only automatically.
2. All builds must use identical wall-clock execution times.
3. OCI cannot store versioned artifacts.
4. The fetched contents can change without a reviewed source change.