> I believe the reason Deno is not more widely used in production environments is the lack of a standardized vulnerability database If this were a real blocker

> I believe the reason Deno is not more widely used in production environments is the lack of a standardized vulnerability database If this were a real blocker, then C/C++ wouldn't be used in production either, since both just lean on the language-agnostic CVE/GHSA/etc databases for any relevant vulnerabilities there... and C also heavily encourages just vendoring in entire files from the internet with no way to track down versions. Anyway, doesn't "deno.lock" exist, and anyone who cares can opt-in to that, and use the versions in there to check vulnerability databases?