Until these alerts get better at understanding context of use of a dependency, they're going to remain mostly noise. Regardless, users will obsess over them. As

Until these alerts get better at understanding context of use of a dependency, they're going to remain mostly noise. Regardless, users will obsess over them. As a maintainer, the number of issues that get opened for dependency alerts is just annoying. No, I don't care about the "low" level vulnerability on a RegExp DDoS possibility of a dependency in my development-time tool that would require a dev to DDoS themselves.