Comment by irgolic

After seeing the xz backdoor I thought we needed better visibility into our dependency trees.