EUVD support in GHSA

未指定任何文件、测试或入口点。首先检查 advisory database 和 Dependabot 当前如何使用 GHSA 和 CVE 数据，然后研究 EUVD API 及标识符要求。要视为完成，需要明确支持范围并达成一致的实施计划，而此 issue 目前尚未提供这些内容。

Hello,

Yesterday I have commented an old issue, but I think it is better to open a new one :) (https://github.com/github/advisory-database/issues/5745)

According to the CRA (Cyber Resilience Act) requirements, generating an SBOM — and therefore performing vulnerability scanning — will become mandatory by the end of the year (September 2026 at the time of writing). As far as I understand, Dependabot relies on the GHSA database to detect vulnerabilities.

It would be highly valuable for European developers if GitHub could also support the EUVD, since the CRA mandates the use of EUVD instead of CVE. GitHub + GHSA + Dependabot already form a strong native tooling stack for automated vulnerability scanning, without requiring external tools — most of which currently do not support EUVD either.

The commonly mentioned issue is that the EUVD API is not well documented and currently only exposes CVE-based entries, but the database is expected to be populated with EUVD identifiers once the CRA becomes applicable. So yes, today EUVD is a « copy » of CVE IDs but later EUVD IDs would be unique and not in the CVE database.

I’m commenting this ticket to ask for your thoughts regarding potential EUVD support.
Is this something you are considering, and if so, is it planned before September 2026?

Thanks in advance.