In reply to Mike Travels.

This is a great question.

Last month flaws in code from a single source library, used by many plugins to handle licensing, had the dev side rushing to release plugin updates. The flaws would have been caught had the library code been properly linted. Devs also need to lint library code the include via composer, many just ignore the vendor directory with an assumption that “it’s all good in there”.