good luck auditing all transitive dependencies