They can be manipulated, see https://bsky.app/profile/dsherret.bsky.social/post/3me2bmgc32k2k

including in transitive dependencies, all the way to the top.