> If they had built their own framework, the team that produced it could just as easily published a security patch that was ignored. I believe you're just maki

> If they had built their own framework, the team that produced it could just as easily published a security patch that was ignored. I believe you're just making the inverse assumption from Cox. He seems to assume a monorepo-esque setup where everyone depends on HEAD, and you seem to assume a microrepo-esque setup where everyone declares their own dependency revisions.