The following reply was made to PR pkg/35091; it has been noted by GNATS.

From: dholland@eecs.harvard.edu (David Holland)
To: gnats-bugs@NetBSD.org
Cc: 
Subject: Re: pkg/35091: make update erases packages before vulnerability check
Date: Mon, 4 Dec 2006 18:35:35 -0500 (EST)

  >  On Wed, Nov 22, 2006 at 04:30:00AM +0000, dholland@eecs.harvard.edu wrote:
  >  > If I understand correctly it should be sufficient to add
  >  > 
  >  > ${_PKG_SILENT}${_PKG_DEBUG}${RECURSIVE_MAKE} ${MAKEFLAGS} check-vulnerable
  >  
  >  I think it is even simpler to just add a dependency of update on
  >  check-vulnerable. I have no means to test that though. Don't forget to
  >  do that in both cases.
 
 Doing it that way you need to be careful, because there's a 
 ".if !target(update)" in there and declaring the dependency before it
 will make it do the wrong thing. It also isn't clear that there aren't
 other instances of this elsewhere.
 
 Anyway, I've now tested the change I suggested and it at least does
 work.
 
 -- 
    - David A. Holland / dholland@eecs.harvard.edu