Looking into the https://forgefed.org spec this evening and there’s nothing about packages or dependencies yet. Imagine if repositories and forges could announce to the maintainers of packages that they just started using their package, and then be able to subscribe to maintainers announcements of new releases, security advisories and calls for help. They don’t even do that in centralised forges very well at the moment!