Before installing Pump packages:
verify package provenance against Pump’s official repositories/documentation.
There may be similarly named or higher-version unofficial packages.
Do not select a package merely because its version number is higher.
For every Pump dependency record:
package name
exact version
official source
repository
reason selected
Pin exact versions.
Commit the lockfile.
Document in:
PUMP_INTEGRATION.md