I've already written it in another comment: a different way of solving the problem would be to build a tool that allows developers to mark releases as safe. (pu

I've already written it in another comment: a different way of solving the problem would be to build a tool that allows developers to mark releases as safe. (public lgtm) Every package would have a safety score and you could decide yourself if that's good enough for you.