A Harmless-Looking Pull Request Pulls In a Critical CVE. LimaCharlie Blocks the Merge