Comment by grassfedgeek

"First run" doesn't exist for JavaScript libs used only in web apps. So for that entire class of packages this change makes them safe.