This is incorrect on multiple levels: * Comparing the two in this regard is a category error: Debian offers a curated index, and PyPI doesn't. Debian has a tru

This is incorrect on multiple levels: * Comparing the two in this regard is a category error: Debian offers a curated index, and PyPI doesn't. Debian has a trusted set of packagers and package reviewers; PyPI is open to the public. They're fundamentally different models with different goals. * PyPI does offer a security feed for packages[1], and there's an official tool[2] that will tell you when an installed version of a package is known to be vulnerable. But this doesn't give PyPI the ability to patch things for you; per above, that's something it fundamentally isn't meant to do. [1]: https://docs.pypi.org/api/json/#known-vulnerabilities https://docs.pypi.org/api/json/#known-vulnerabilities [2]: https://pypi.org/project/pip-audit/ https://pypi.org/project/pip-audit/