We use Grype for container vulnerability scanning, but the recent `GHSA-2xp9-vwfh-vxw4` (CVSS 9.5 rating) vulnerability, which was initially reported on reposi

We use Grype for container vulnerability scanning, but the recent `GHSA-2xp9-vwfh-vxw4` (CVSS 9.5 rating) vulnerability, which was initially reported on repository advisory on 25th Aug, was completely missed by our scanners. Even our socket.dev scans returned nothing related to vulnerability The advisory exists through GitHub’s repository-advisory API: - GET /repos/vercel/next.js/security-advisories/GHSA-2xp9-vwfh-vxw4 - HTTP 200 - state: "published" - severity: "critical" - published_at: "2026-08-25T16:16:28Z" but it's completely missing from the public DB's our scanners rely on: - https://api.github.com/advisories/GHSA-2xp9-vwfh-vxw4 https://api.github.com/advisories/GHSA-2xp9-vwfh-vxw4 - HTTP 404 - https://api.osv.dev/v1/vulns/GHSA-2xp9-vwfh-vxw4 https://api.osv.dev/v1/vulns/GHSA-2xp9-vwfh-vxw4 - HTTP 404 There's already a blog published by Vercel about this, which is seriously concerning because some developers might not know about it until it's too late. Is this delay expected? If so, how is everyone covering this gap in the scanning pipeline?