Add ability to check whether the update was a security fix
Don't enforce type on review state

Apparently there may be string values.