You could do a lot of this with CI if you scheduled a job to fetch the most recent packages once a month and record a manifest with the current versions, then, if no security issues are reported before the end of the cooldown period, run integration tests against the new manifest. If no tests fail, automatically merge this update into the project.

For projects with hundreds or thousands of active dependencies, the feed of security issues would be a real fire hose. You’d want to use an LLM to filter the security lists for relevance before bringing them to the attention of a developer.

It would be more efficient to centralize this capability as a service so that 5000 companies aren’t all paying for an LLM to analyze the same security reports. Perhaps it would be enough for someone to run a service like cooldown.pypi.org that served only the most vetted packages to everyone.

Doesn't this mean you're leaving yourself open to known vulnerabilities during that "cool down" time?

> we should all

Except if everyone does it chance of malicious things being spotted in source also drops by virtue of less eyeballs

Still helps though in cases where maintainer spot it etc

I hate this. Delaying real bugfixes to achieve some nebulous poorly defined security benefit is just bad engineering.