New open-source package security advisories (weekly)

Weekly digest of newly published GitHub Security Advisories (GHSA) that map to real package ecosystems (pip, npm, go, maven, composer, crates.io, ...). Every advisory published in the trailing 7 complete days with at least one package ``vulnerabilities`` mapping is deduplicated on ghsa_id, normalized across ecosystems (sorted ecosystem:name package set, CVE id, CWE list, affected version ranges, fix availability), and enriched: GitHub severity + CVSS base score -> 0-10 severity_score, GitHub-attached EPSS score/percentile, and a match against a curated ~170-package data/ML universe (ml_stack flag, ml_categories, package_criticality tier 1 foundational .. 3 niche). A documented 0-100 risk_score = 100*(0.50*severity + 0.30*EPSS percentile + 0.20*unpatched) is ranked as risk_rank (ties: CVSS desc, ghsa_id asc) and bucketed into risk_tier p1..p4. Advisories without a package mapping (CVE-imported records with no dependency-triage value) and withdrawn advisories are excluded. Week-granular as-of stamping makes same-window re-runs hash-identical. Columns: snapshot week, fetch timestamp, GHSA id, CVE id, publish and update timestamps, summary, description, severity, CVSS score/vector, EPSS score/percentile, CWEs, packages, ecosystems, ML-stack flag/categories/criticality, fix flag, affected ranges, references, source URL, risk score/tier/rank. Primary key: (snapshot_week, ghsa_id). Cadence: weekly. Nullability: cve_id null when the advisory carries no CVE identifier; cvss_score null when neither cvss.score nor cvss_severities carries a numeric score (severity map used instead); epss_* null when GitHub attaches no EPSS. Caveats: risk_score is a triage heuristic, not a quantified risk measure; version ranges are GitHub-curated and occasionally coarse; the ML universe is curated, not exhaustive. The underlying GitHub Advisory Database is CC-BY-4.0 (commercial_use = yes, attribution required); severity scores, EPSS values and the risk ranking are derived signals computed by this connector. Sample use: filter ml_stack = 1 for the advisories touching your data/ML dependencies, order by risk_rank for what to patch first.