Dependabot misses vulnerabilities in small npm and PyPI packages for months

An analysis of 1,808 advisories from 250 projects found GitHub reviewed 93% of advisories for packages with over 10M monthly downloads within 30 days, versus 35% for packages under 100k. As a result, Dependabot never alerts users to many flaws, including critical ones.

• 93% of advisories for packages with 10M+ downloads reviewed in 30 days, 35% for those under 100k
• Half of small-package advisories remain unreviewed two to four months after publication
• Criticals aren't prioritized: 48% reviewed in 30 days versus 72% of low-severity ones
• Four of Weblate's six advisories from 11 July are still missing from GitHub's database