It should be enough to know your direct dependencies. The problems that can be caught by knowing transitive dependencies but can't be caught by knowing direct

It should be enough to know your direct dependencies. The problems that can be caught by knowing transitive dependencies but can't be caught by knowing direct dependencies, are rare. Perhaps open projects could make a pledge of some sort that guarantees important properties as long as all dependencies also commit to the same pledge.