After seeing the xz backdoor I thought we needed better visibility into our dependency trees.