It will be interesting to see how it handles transitive dependencies through a supply chain you don’t control. Same issue as “this 3rd party npm package depends on an insecure version of X” but at a function level.