/advisories: the forge listens to CVE.org, OSV, GHSA, NVD, CISA KEV and EPSS, matches them to every repo's dependencies, and gives a sleek explorer with fix-pull actions, MCP tools and integrations #6005

Owner, 2026-10-25: "like aren't CVEs posted? would love to listen to that, and the forge should have its own sleek interface for exploring with integrations." (Builds on #6004.)

The sources: all public, all free, the forge subscribes itself:

Done when: /advisories, the forge's own explorer.

• A live feed. New and updated advisories as they land (streamed, not polled by the page), with the newest first and our matches on top. Each card shows:

- severity (CVSS) - KEV: "exploited in the wild" - EPSS percentile - ecosystem and package - fixed versions - "affects N of your repos"

• Your exposure. Every repo's dependencies, from its lockfiles (an SBOM per repo, CycloneDX/SPDX export). An advisory shows exactly which repos, apps and versions are hit, and the dependency path ("scratchpad → @xyflow/react → …").
• Actions (each a fleet op with undo):

- Open the fix pull: the smallest safe bump (#6004 step 1). - Accept the risk with a reason and an expiry. - Mute for this repo. - Mark as not reachable (the vulnerable function is never called).

KEV + affected + a fix available pages the owner and jumps the crew's queue.

• Explore. Search by CVE, package, CWE or vendor. Filter by "affects me", KEV, EPSS > x, or ecosystem. Trends: new advisories per day in our ecosystems, and our mean time to patch.
• Integrations:

- MCP tools: advisories_search, advisory_read, repo_exposure, advisory_fix. Claude and the crew can ask "am I exposed to X?" - Webhooks and notifications: web push, email. - A scratchpad board view: advisories as cards on the dependency graph. - An RSS/Atom feed of matches. - The posture page (#6004 step 6).

• The design bar: sleek and fast, from the component library (#5817). A phone shows "Am I exposed today?" in one glance.
• KPIs:

Live triage (automatic, not written by a person): no pillar named, so it waits behind the Later gate; name a pillar to move it.

Parked by the crew: the check stayed red through 2 automatic tries (pull #6017 closed). Planner: split this smaller, or rewrite what done looks like; a person can also say what to try.