Earlier quoted context omitted.
How is _your_ supply chain a concern of this open source developer?
_My_ supply chain is not a big deal, lol. But this is HTTPX. A network library that has a considerable number of users. When I say _considerable_, I'm essentially saying _nearly every_ big tech. The one I can tell for sure is OpenAI (not a fan of them though). Remember xz attack?
Clearly, the maintainer doesn't want to do this job anymore, and it's not a requirement when releasing your code to also do stuff unrelated to programming.