the explanation should be modified to explain that this flag will add direct dependencies of the packages to the whitelist too