The world of package managers is a wonderful one. If one package isn't available in your Linux distributions package manager chances are that it's available in any of the language specific package managers.
But as soon as you install a package through any venue, including of course manual install, other than the distribution package manager you also take on the responsibility of keeping up to date with security advisor's and making sure that the software is up to date; something which is automatically taken care of in for example Debian with unattended upgrades installed.
So my question is this: for the below listed programming language specific package managers, is it possible to set up automatic updates. Or even better automatic updates but only if the update is a security fix.
- PIP - Python
- Gem - Ruby
- Cabal - Haskell
- Pear - PHP
- NPM - NodeJS
- Get - Go
Of course one will have to weigh the soundness of automatically upgrading to possibly broken packages versus running unsecured software because the operator glanced over a relevant SA in his daily deluge of emails. But that's a topic for another server fault question.
There's always the trivial solution of creating a cron job. But that would pull down every update, not just security updates.
This question is about automatic security upgrades like the functionality of Debians unattended-upgrades package. I'm asking how to best keep external packages not maintained by our Linux distribution safe on our business critical servers, how is that not on topic?