@ariadne Sounds like a dependabot/renovator kind of thing.
The problem I then have with those is how they typically lack something like pkgdiff being hooked up so you're risking accepting malware (or missing recipes changes to be done).
(renovator even tries to give a diff, but between two github tags, not the actual tarballs that are being used)