Can we get the benefits of transitive dependencies without undermining security?tratt.net 85ltratt1y87 comments