We need to be able to get notifications and updates if any of our Nextflow pipelines have security vulnerabilities or alerts based on the pipeline's codebase and its dependencies. Similar to how systems like Node.js / npm, Python / pip, etc., have dependency security alerts with systems like Dependabot on GitHub, we need some kind of functionality that allows for scanning and alerts if any deps or code needs security updates. This is especially important because Nextflow itself frequently pulls down dynamic lists of external Groovy and Java libraries at runtime, Nextflow pipelines often include usage of external "Nextflow Plugins", and the pipeline code itself frequently includes dynamic loading of external libraries that may or may not be included in the Groovy standard library. The end result being that a very large amount of foreign code is being loaded onto the compute system at run-time of a Nextflow pipeline, without any clear way to gain insight into what code is going to be included and if that code has any critical security concerns associated.
