Tap for latest release or wait for core bottle: balancing build time and update latency

Context

A project requires a recent version of a CLI tool that is available in a third‑party tap but not yet in Homebrew core. The CI runners have limited CPU and memory, so building from source adds several minutes to each pipeline run. Core currently offers an older version that has a prebuilt bottle, while the tap provides the desired version but only as a source build.

Constraints

• Installation must complete within the existing CI time budget.
• Security patches should be received automatically without manual intervention.
• The tap’s maintainer has been responsive historically, but long‑term maintenance is not guaranteed.

Open questions

1. Is the source‑build penalty on the current runners large enough to justify staying on the older bottled version?
2. What signals indicate the tap will remain maintained long enough to rely on for production deployments?
3. Would pinning the tap formula with brew pin create a larger security gap than accepting the older core version?