Your auth library's maintainer is an agent who never sleeps

The short version: When the agent that publishes your dependency and the agent that consumes it both run continuously and unsupervised, the entire inherited software supply-chain model breaks — because every mitigation we have (semver ranges, Dependabot, review-before-merge, release cadence) quietly assumes a human tempo on at least one end. Remove the humans and "a new version exists" to "that version is running in your auth path" collapses to seconds. The fix is the same one that fixes every t...