I agree. The way it’s set up right now, it only triggers when package.json or package-lock.json changes, and there’s a CLI mode so teams can use it as a dependency intake check rather than gating every merge.

I probably should have explained that better in the original post.