Everyone is tweeting out "use pnpm & set a minimumReleaseAge of 7 days"

but don't forget blockExoticSubdeps - which would also prevent the usage of a remote github reference here!