Yeah I think @cuviper is right in that we’ll only want to have a whitelist for rustc dependencies right now, which currently have the most impact. New dependencies in libstd, for example, can cause quite a lot of ripples and new dependencies in rustc even can sometimes cause problems.