I look at gits diffs to see what's changed between versions, but that's for fun and not diligence. > With the level of scrutiny required to detect a maliciousl

I look at gits diffs to see what's changed between versions, but that's for fun and not diligence. > With the level of scrutiny required to detect a maliciously-obfuscated security exploit Nope. Not paid to do that and I have not been given any such responsibility. That said, I think the attack vector on this is very low. Packages are rarely updated to the latest version. We don't use a lot of packages. We mostly use packages from trusted sources. We use packages that are open source.