6 ms·

I suppose it mitigates the potential risk of libraries being poisoned?

• baliex 3mo ago
  Well kind of, or you just end up copying the poisoned version directly into your repo rather than having it as a dependency. Same outcome. I suppose if you're running some security analysis on code in your own repo, the fact that you've copied the code in means that it'll run on your third party dependencies too, since they no longer appear to be third party.
• Ferret7446 3mo ago
  It's mostly to track licensing, at least initially. The supply chain angle is a happy coincidence.