These will only get bumped on a new publish, and keeping the file around leads to spurious security alerts.
Damien Elmes