Dear Maintainer,

   * What led up to the situation? Normal trixie installation with GNOME desktop environment
   * What exactly did you do (or not do) that was effective (or
     ineffective)? No action necessary, automatic updates are enabled by default in Software.
   * What was the outcome of this action? User might not be notified to install security updates via the offline updates mechanism until up to 2 weeks after these updates are published in the repos.
   * What outcome did you expect instead? User should be notified immediately in case of security updates.

Some code digging revealed a possible explanation for this issue:
   * packagekit apt backend provides PK_INFO_ENUM_SECURITY as update severity when a package comes from the "-security" repo.
   * gnome-software packagekit plugin only takes into account the PK_INFO_ENUM_CRITICAL severity for marking an update as having critical urgency.
   * the updates logic in gnome-software follows the diagram at https://gitlab.gnome.org/Teams/Design/software-mockups/-/raw/master/old/updates-logic.png