> They don't even document how to mark something as a security issue Only committers can add those labels - it's probably best to flag it in the PR subject lin

> They don't even document how to mark something as a security issue Only committers can add those labels - it's probably best to flag it in the PR subject line and hope a committer notices it and turns it into a label. Edit: more... When it comes to "trivial" changes I think there's an ironic "zone of triviality" where, if other reviewers are anything like me, reviews of more serious bumps will get prioritized. A minor bump is so likely to get superseded very soon that I'll prioritize something that is more likely to cause breakages and require attention. Some package areas (e.g. python packages) do periodic mass bumps of packages to catch the stragglers. There are of course issues though drawing attention to "trivial" changes that are subtly important like, as you say, security issues.