Based on "update at a more leisurely pace" I'm guessing it's literally just looking for specific methods from libraries covered by security advisories, which is

Based on "update at a more leisurely pace" I'm guessing it's literally just looking for specific methods from libraries covered by security advisories, which is much less interesting than what you are imagining.