So cryptonite and deps are just sitting on Hackage with vulnerabilities?
Is there a way for Hackage to mark them as bad so cabal won’t plan for them unless the user explicitly overrides it? I know it says it’s deprecated but that doesn’t feel like enough.
Feels like a pretty important feature! Given the maintainer refuses to do any maintenance but also refuses to allow people to contribute in order to fix vulnerabilities.