Published repository advisories not appearing in the Advisory Database after 10-13 days

Bắt đầu với các truy vấn API GET /advisories được liệt kê và các tìm kiếm tương ứng trên UI web, sau đó so sánh bốn advisory của repository với các advisory đối chứng và hành vi được mô tả trong #9025. Xác định xem các mục bị thiếu là do thời điểm curation, ánh xạ package, yêu cầu CVE hay một bước lập chỉ mục khác; được xem là hoàn tất khi nguyên nhân và hành động dự kiến của maintainer đã được xác định.

A question about how published repository advisories reach this database, with four concrete examples. I may well be misunderstanding the intended flow — happy to be told this is expected.

Four repository advisories I am credited on were published by their maintainers between 4 and 13 August. All four are live and public on their repos. None appear in the Advisory Database.

All four queries come back empty:

GET /advisories?ecosystem=npm&affects=webdav-server      -> []
GET /advisories?ecosystem=npm&affects=url-sheriff        -> []
GET /advisories?ecosystem=npm&affects=is-local-address   -> []
GET /advisories?ecosystem=pip&affects=tarsafe            -> []

Two controls, to show the query itself is fine:

GET /advisories?ecosystem=npm&affects=extract-zip  -> GHSA-jmr9-qjv8-65gv
GET /advisories?ecosystem=npm&affects=ssrfcheck    -> 3 advisories

Searching the web UI directly (/advisories?query=webdav-server, ?query=tarsafe) also returns only unrelated keyword matches, no advisory for those packages.

It also does not look like a general backlog — repository-sourced advisories published between 14 and 17 August are already present, e.g. GHSA-m44r-7c5h-m6mj, GHSA-ggr8-5vv4-36mx, GHSA-76pc-mqxp-3rq5. The four above are 4 to 13 days older than those.

On each of the four, the advisory form has the package name, ecosystem, affected version range and patched version filled in, so as far as I can tell there is nothing missing that would prevent a package mapping.

Questions

1. Is there a step the maintainer or reporter needs to take beyond publishing the repository advisory?
2. Is 10-13 days inside the normal curation window? The docs say every repository advisory is reviewed "for consideration" as a global advisory, which I read as meaning promotion is not automatic — I would just like to understand what makes the difference.
3. Does requesting a CVE affect whether or when an advisory is curated? Three of the four have a CVE request lodged; GHSA-58r7-5cr4-4ffr (tarsafe) does not, and I would like to know whether that matters so I can advise the maintainer correctly.

Why it matters

Until an advisory is in this database, npm audit, pip audit and Dependabot do not surface it, so people running the affected versions get no signal even though the advisory is fully public. tarsafe alone is around 376k downloads/month and webdav-server around 27k/week.

This is the same shape as an issue I contributed a fix for in #9025, where an advisory existed with an empty affected array and therefore mapped to no package, leaving everything keyed on package mappings silent. I am not claiming that is the cause here — the mappings look populated — but the user-visible effect is identical.

Happy to open separate per-advisory issues instead if that is the preferred format, or to provide anything else useful. Thanks for maintaining this.