This makes it even worse, tbh. Just fork the code and tag an release yourself. How are regulated entities just pulling code from third party repos without a san

This makes it even worse, tbh. Just fork the code and tag an release yourself. How are regulated entities just pulling code from third party repos without a sanity check. At some size this has to happen, right?!?