Where else should be we publish or notify about advisories?

[frasertweedale]

Summary

We have the site, (soon) an atom feed, and osv.dev with whatever downstream notification capabilities it has.

But we received a question about whether we publish in discourse, newletters, etc.

Let's discuss at the next SRT meeting and make a plan. It may involve community engagement to decide what will have the biggest impact.

[hasufell]

I think Haskell weekly newsletter is appropriate, at least for high impact vulnerabilities.

Discourse may be a bit off, because it's quite specific and doesn't really warrant a discussion (most of the time).

[ysangkok]

I have added OSV support to Renovate now, you can see hackage listed in the configuration. However, the OSV functionality in Renovate is off by default. If turned on, people get notified about advisories relevant to them.

[blackheaven]

@ysangkok That's great, thanks for your hard work!

[frasertweedale]

@ysangkok thank you very much! I will mention this progress in the SRT Q4 report.