Anything that goes into:
- bullseye-updates goes into byzantium-updates
- bullseye-security goes into byzantium-security
- bookworm-updates goes into crimson-updates
- bookworm-security goes into crimson-security
- trixie-updates goes into dawn-updates
- trixie-security goes into dawn-security
…automatically. The only exception are packages that got forked in PureOS - these need to be updated manually by PureOS maintainers. The tooling notifies about those as they are updated in Debian.
(there’s an additional delay buffer in *-updates as the packages go through the migration path from *-updates-proposed to allow for a testing period; there’s no such thing in *-security though)