If developers cared about security or their users they would managed their dependencies directly. Most developers don’t cared because they don’t wish to be inco

If developers cared about security or their users they would managed their dependencies directly. Most developers don’t cared because they don’t wish to be inconvenienced. That isn’t primarily an ecosystem problem. It is a bad developer problem justified by common practice.