I appreciate the concept, but there are additional costs that would be great to consider. How frequently do you need to parch the package to address CVEs? How m

I appreciate the concept, but there are additional costs that would be great to consider. How frequently do you need to parch the package to address CVEs? How many downstream dependencies does this package have? How often do they make breaking changes?