James Oakley: Keeping track of upstream security issues

Drupal no longer releases a new version of Core when an upstream dependency fixes a security vulnerability. It is the responsibility of site maintainers to keep track of security advisories for all such dependent libraries. That is no small task, and a way to automate this is needed. This post looks into how this can be done.