@paul@tapbots.social I always figured it was Dependabot et al + compliance requirements. They have a ton of dependencies and security requires them to update at least one dependency every week so that vuln scanning is green.