Comment by kobzol

I don't really see an attack surface for a dev dependency.