Certainly. But that’s two vulnerabilities and usually by different groups. So that’s a pretty sophisticated group to pwn a package and the submit all the depen

Certainly. But that’s two vulnerabilities and usually by different groups. So that’s a pretty sophisticated group to pwn a package and the submit all the dependabot version bumps. Not impossible, but less likely. And I don’t blindly accept version bumps as I read the associated CVE and see if I need it. And I think it’s pretty rare for major packages to get compromised. When pandas or numpy get breached, I think I’ll hear about it way before I accept a depdabot PR to change my version.