# Dependencies resolution issue: unstable-version reported when using revision **URL:** \ **Category:** Package Manager\ **Created:** [July 12, 2022, 8:50am UTC](https://forums.swift.org/t/dependencies-resolution-issue-unstable-version-reported-when-using-revision/58880 "2022-07-12T08:50:38Z")\ **Posts on this page:** 1\ **Showing post:** 4
**Author:** ![SDGGiesbrecht](https://sea2.discourse-cdn.com/swift/user_avatar/forums.swift.org/sdggiesbrecht/32/4768_2.png) [@SDGGiesbrecht](https://forums.swift.org/u/SDGGiesbrecht)\ **Post date:** [July 18, 2022, 9:25pm UTC](https://forums.swift.org/t/dependencies-resolution-issue-unstable-version-reported-when-using-revision/58880/4 "2022-07-18T21:25:40Z")
> [@JeromeD](#): > > If one of our dependencies gets hacked, and the tag is modified to a commit that integrates unexpected code, the only protection we have is the hash that is stored in the Package.resolved file, as you mentionned. SwiftPM records security fingerprints permanently in your home folder (see `~/.swiftpm/security`, although on some platforms it is a symlink to elsewhere). If SwiftPM ever attempts to fetch the same version again but receives different content, it will throw an error (which looks like [this](https://forums.swift.org/t/spm-needs-a-way-to-ignore-or-reset-its-recorded-commit-for-a-package/58945)). If this per‐user memory is not broad enough, you can persist the security folder across CI runs, sync it across workstations, etc. --- _[View the full topic](https://forums.swift.org/t/dependencies-resolution-issue-unstable-version-reported-when-using-revision/58880)._