Comment on Can we get the benefits of transitive dependencies without undermining security?parent