[guappa]

Blame it on go dependency lists and similar.

What do you even review when it's one of those? There's thousands of lines changed and they all point to commits on other repositories.

You're essentially hoping it's fine.

[lrvick]

Shipping code to production without evidence anyone credible has reviewed it at a minimum is negligence.

[guappa]

You're claiming here that you do a review of all of your dependencies?

[lrvick]

For security critical projects, of course. I even reproducibly bootstrap my own compilers and interpreters.