The fix ships weeks before your scanner knows
In late September I published a release of compose-lint , a security linter for Docker Compose files that I maintain. It fixed two vulnerabilities , and I published the advisories about fifteen minutes later. GitHub reviewed them 44 days after that, and until then no scanner that relies on GitHub's advisory data could tell anyone running an affected version that a fix existed. I wanted to know…
In late September, the author released a security linter called compose-lint for Docker Compose files, fixing two vulnerabilities and promptly publishing advisories. However, GitHub took 44 days to review the advisories, leaving scanners that relied on GitHub's advisory data unaware of the fixes. To determine the typical delay, the author collected data on 14,173 advisories reviewed by GitHub between August 2025 and November 2026.
The median time for reviews ranged from 1 to 5 days for fixes released in August 2025 to March 2026, but increased to 19 to 42 days for fixes released in June and July 2026. The author found that the majority of delays occurred due to the review process, with maintainer-published advisories being published within a day of the fix, but GitHub's review taking significantly longer during certain months.
The review time was not significantly affected by the severity of the vulnerability or the publication of a Common Vulnerabilities and Exposures (CVE) identifier. The author concluded that updating when the release ships, rather than waiting for the advisory review, can significantly reduce exposure time to potential vulnerabilities.
Written by urgent.news from Dev.to's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
