On: Security alerts on GitHub

[scott_karana]

It's still a many to many problem in both cases.

Option 1: Adding feature to npm/composer/gem/pip ad infinitum

Option 2: add per-language parser support to the alerting tool instead.

Option 2 doesn't necessitate a new (information-duplicating, still potentially error prone) standard, and can likely leverage available, tested libraries ;-)

[matt_kantor → scott_karana]

On the other hand, option #1 requires neither effort nor consent from GitHub to onboard new languages/dependency managers.