register the database to github/advisory-database

[TristanCacqueray]

Once the system is in place, creates an issue for https://github.com/github/advisory-database#sources .

[MathiasSM]

Was this ever done/attempted? I don't see relevant issues in github's repo.

Should this be reopened?

[frasertweedale]

@MathiasSM I think you're right - that this was closed by mistake. But, the scope was to create a ticket
to link the GH advisory database. And you have done that now. Thank you :)

In retrospect, I am not sure if replicating all our advisories in the GitHub repo, with their own GHSA ID,
is necessarily helpful. If it is a prerequisite for dependabot integration, then sure. Apart from that, the
advantages are not obvious.

[MathiasSM]

I honestly have little knowledge on how to setup the integration, but will gladly help once Github answers the ticket :) thanks!

[mihaimaruseac]

I think the benefit of the advisories being in the GitHub database too is that projects that use a vulnerable dependency will receive a security warning (and dependabot PR if enabled) when GitHub records the vulnerability.