Dependabot is a month late on Python and Go CVEs

GitHub's review of PyPI and Go CVEs slowed sharply in 2026: only 31% were reviewed within 30 days versus 88% a year earlier, with a typical wait of 36 days. Critical flaws wait just as long, and Dependabot stays silent until an advisory is reviewed.

• Share of PyPI and Go CVEs reviewed in 30 days fell from 88% to 31%
• PyPI dropped from 81% to 34%, Go from 96% to 27%; typical wait 36 days
• Criticals wait too: seven x/crypto CVEs reviewed after 34 days
• 36 CVEs from May to mid-September remained unreviewed as of 16 October