On 11 July, Weblate published six security advisories on its GitHub repo, each naming the fixed version, 2026.7. Two made it into GitHub's Advisory Database seven weeks later. The other four still haven't, even though GitHub itself published CVEs for them on 26 August.

That matters because Dependabot only alerts on advisories GitHub has reviewed into that database. Until then, nobody whose Dependabot watches Weblate hears a thing. GitHub's docs still say review "can take up to 72 hours", and in spring that was about right: Weblate's earlier advisories this year went in within a day or so.

Last week I wrote about the same wait for CVEs that reach GitHub through NVD. This time it's advisories maintainers publish themselves, and I wanted to know who's doing the waiting.

The big ones get through

I picked 250 projects that had an npm or PyPI advisory reviewed by GitHub in 2025, pulled every advisory they've published this year (1,808 of them), and checked each one against GitHub's database on 26 October.…