it does, but to use hashes you'd have to pin exact versions of every dependency, which is generally undesirable for a library