For a project with many open-source libraries as a part of it, I began to search for information source concerning all upgrades and security issues. The kind of sources I gathered are either announcement list or issue/bug tracker in the form of RSS feeds or Mailing List, as either could be retrieved and parsed in a way or another, and then gathered in one place.
The problem is, for a third of those libraries, none of this is available. So I was wondering, aside from RSS/Atom feeds or Mailing List is there any other parsable sources I should be tracking?
We've recently started to make an audit manually, trying to list the known vulnerabilities of the open source libraries we use. For that it was decided to use security advisory sites such as Secunia, Vupen, and NVD, as the information is generally formatted in a relevant way. However we want to automate the process in the future.
Would parsing such sites be easier and/or bring more relevant information when compared to other sources? I know for a fact that Secunia doesn't take so kindly that a script sniff on their sites, and wondered if it would be the case for other security advisories, or if such hurdle could be encountered with other kind of sources.