To me, the issue is the construction of the argument, and the context. Cmake has flaws but unless the fish devs have explicitly complained about them, I would

To me, the issue is the construction of the argument, and the context. Cmake has flaws but unless the fish devs have explicitly complained about them, I would say it doesn't make sense to bring it up (note: maybe they did, which would invalidate what I've said and make me look a bit silly). However, we know security will affect them (since they're a shell interface) so that does make sense to mention. But, between cargo and cmake, I agree I will always pick cargo.