I think this is an idea that's in the air: I pitched something similar where I work. A file which tells you information about CVEs patched, bugs fixed, features

I think this is an idea that's in the air: I pitched something similar where I work. A file which tells you information about CVEs patched, bugs fixed, features added. A list of teams affirming it passed their testing. Estimates of installation time. Opinions of necessity, urgency and difficulty. This can, theoretically, be encoded in semver. But why go through that? I can easily publish information at a known endpoint, or bundle it with the package. Lossily compressing information because of the limits of software distribution circa 1988 is silly.