Well this is frustrating. There is an issue with one of my projects apparently (actually saw it before I saw this on HN) and it is because of one of my indirect dependencies.

I presume in this scenario I need to either wait for a patch from the direct dependency or fork and submit a PR myself.

It's a great idea. I like it quite a bit. I just feel like the floodgates just got opened.

Would be great to see PHP and Python in there.