How does one stay abreast with vulnerabilities on a world...

[Ferociouspineapple]

what's an effective way to stay abreast with vulnerabilities on a world file and dependencies basis without having to 'emerge -uD world' everyday?

While a cron job for glsa-check is a prospect, no GLSA seems to have been filed as so far for 914010 libwebp-1.3.1_p20230908 and the vulnerability for libwebp before that...at least from what I'm seeing [nothing from glsa-check after emerge --sync nor am I able to find it in the GLSA rss feed: https://security.gentoo.org/glsa/feed.rss].

[sam_]

We'd like to do GLSAs more and we're trying to, but the priority is generally getting a fixed version into tree which takes enough effort as it is.

I just suggest regular glsa-check and updating at least once a week.