Looks safe to me (but I don't know bodhi's sources that well)

That type is an instance of the UpdateType object which gets its behavior from this class.

On the other hand, now that I look more closely, this may not actually fix the bug:

>>> bodhi.models.UpdateType().security.description
'security'
>>> bodhi.models.UpdateType().security.value
'security'

OK, it works locally with this.

Still ok for me (with the same limitation as before)

Hmm, I don't see how this changes anything. description and value are the same, and we use description all over the place still...