Plugin dependencies follow the plugin's own security policy; Hermes's 14-day quarantine applies to Hermes deps only (reverses #118841 item 3, unblocks #120076 #114530) - #120231