This exists, it's called crev: https://github.com/crev-dev/crev https://github.com/crev-dev/crev It is really good, allowing for distributed reviews, not neces

This exists, it's called crev: https://github.com/crev-dev/crev https://github.com/crev-dev/crev It is really good, allowing for distributed reviews, not necessarily from the people authoring your dependencies. The OP suggests that if you -> A -> B, the package manager should only install versions of B vetted by A (or close); I think this doesn't scale well in practice (all the more so if the only way A can vet a new version of B is by doing a new release). Having the possibility to rely on other people to vet releases (possibly in your company) opens a lot of doors, such as the ability to not trust the author of A at all.