It turns out this is a transitive dependency (a dependency of `security`). We don't handle this yet in `yk`, which we probably should. Let's keep this PR open for now and I'll implement a fix.