Unlocking security updates for transitive dependencies with NPM
github.blog