This is mostly about supply chain attacks, where transitive dependencies are at play. Those are mostly just already built jar files, that can still contain anno

This is mostly about supply chain attacks, where transitive dependencies are at play. Those are mostly just already built jar files, that can still contain annotation processors, but not build scripts.