Would be nice if the new security flag can be supported in the message to show the severity of the update from #48127.

I love the idea of the plugin, however I would like to suggest to postpone the merge until a revamped VEL with some proper API and up-to-date data is available. That would allow the plugin to by default limit notifications to security relevant updates and not send a mail for every patch release by every extension. I'm worried that with too frequent mails site owners are just getting annoyed and disable the feature completely.

I love the idea of the plugin, however I would like to suggest to postpone the merge until a revamped VEL with some proper API and up-to-date data is available. That would allow the plugin to by default limit notifications to security relevant updates and not send a mail for every patch release by every extension. I'm worried that with too frequent mails site owners are just getting annoyed and disable the feature completely.

I understand your concern about becoming email blind but I am sure it will be very useful as is. It certainly woujld have been on a couplke of sites I loggged into recently.

It could be enhanced at a later date when the VEL is available with an option for the site owner to decide if they want all update notification or just security notifications.

I'm just worried that, if we ship it as it is, people will have it already disabled before we add the VEl support

before we add the VEl support

What is the plan for VEL support?

See above:

until a revamped VEL with some proper API and up-to-date data is available.

I'm just worried that, if we ship it as it is, people will have it already disabled before we add the VEl support

well you have until october to add that part. Meanwhile if this is merged as is then it can be tested

TBH without additional configuration options this would be something I would definitly disable completely.

TBH without additional configuration options this would be something I would definitly disable completely.

and you're not really the target user for this.

I thought I new everything that was installed on my sites and the sites I have built (but dont directly manage) so I wasn't concerned about the recent security updates for various extensions as I didn't use them. But to my suprise there was one site using one of those extensions that I had just forgot about. This email notification system would have caught that and saved quite some work.

Nothing new, I’ve been hearing this argument for three years now whenever I mention how it might be useful to me too.
Config
-> Option to deliberately mute individual extensions
-> filter by priority (e.g. security)
-> setting to choose whether I want to be notified on a recurring or one-off basis.

Anything else is just annoying spam cluttering up my inbox.
But since, as always, I’m not the target audience, I’ll keep my thoughts to myself from now on.

Nothing new, I’ve been hearing this argument for three years now whenever I mention how it might be useful to me too.
Config
-> Option to deliberately mute individual extensions
-> filter by priority (e.g. security)
-> setting to choose whether I want to be notified on a recurring or one-off basis.

Anything else is just annoying spam cluttering up my inbox.
But since, as always, I’m not the target audience, I’ll keep my thoughts to myself, switch it off and think of something else for myself.

Would be nice if the new security flag can be supported in the message to show the severity of the update from #48127.

@laoneo could you create an PR against this one with this feature implemented? People can perhaps select which level they want reports for?

Thanks.