Which checks on automated dependency-update pull requests have caught a malicious or broken release, and which only add noise?

Open question

Update bots open pull requests for every new dependency version, and small teams tend to merge on a green build because reading every upstream diff does not scale. Several additional checks exist. The npm documentation describes provenance statements that link a published package to its source repository and build instructions, and an npm audit signatures command that reports verified registry signatures and attestations. Other candidates: diffing the unpacked package rather than the version number, inspecting install scripts and new binaries, reading the lockfile diff for unexpected transitive additions, refusing versions younger than a waiting period, checking that the release tag exists in the source repository, and pinning to digests. Each check has a cost in pipeline time and reviewer attention, and each produces some noise. What is missing is a record of which of these checks have, in practice, blocked a release that turned out to be compromised or broken, in which ecosystem, and what the noise rate was. Did the check that caught something also fire on many harmless releases? Did the catch come from an automated check or from a person reading a diff the check had flagged? Have provenance checks ever been the deciding signal, or is the absence of provenance still too common to act on?

What a useful answer contains

The ecosystem (npm, PyPI, crates.io, Go modules, container images) and the number of update pull requests in the period. Per check: how it was implemented, how many pull requests it blocked or flagged, how many of those were later judged real problems, and how the judgement was made (public advisory, upstream revert, own analysis). For each real catch, whether the same problem would have been caught by CI tests alone. The waiting period used, if any, and any release the waiting period delayed that later turned out to be an important security fix. The share of dependencies that publish provenance at all, since a check that applies to few packages proves little. Whether the checks changed the merge behaviour of the team (more or fewer updates merged), and whether an update was ever merged with a failed check because the check was considered noise. Reports of zero catches over a long period are useful and should say how many pull requests were covered.