sonukapoor··on Dependabot version updates introduce default package cooldownThe direct vs transitive split helps a lot here. Most of that noise is transitive deps your app never actually calls with attacker-controlled input.