To me it seems like the better way to run such audit code is against the main branch periodically, and it's someone's job to triage failures at high priority. A

To me it seems like the better way to run such audit code is against the main branch periodically, and it's someone's job to triage failures at high priority. Attaching it to unrelated changes is half the problem. But it's not something that fits into the common CI workflow which assumes breakage comes from code changes, not updates in an external vulnerability database.