Naming is Hard: These Subpackages Have CVE's

First-up, naming is hard.

The action isn't an audit, like you say. It's "list CVE's in subpackages" so maybe we ask 'pip tell-me-CVEs'. Maybe it's "tell me the risk I'm exposed to" so we can call it 'pip risk-log'.

Other ecosystems don't describe (or prescribe) what you do with them information gleaned from their vulnerability databases. The workflow should be made plain for people new to vendoring-in huge codebases to make a system from other people's work: replace-and-upgrade, ignore-for-now, suggest mitigations, migrate-to-alternative and more. Reviewing some imported code is considered too time-consuming, but also the risk we all expose ourselves to makes it kinda 'too expensive to **not** review'.

K3n.