CVE requests on four repository security advisories pending since 25 October, with no response

[pankajkgoswami]

I maintain nlqueries/nlqueries (PyPI package nlqueries-core). Four draft repository security advisories there have had CVE requests open since 25 October 2026, with no CVE ID and no message:

• GHSA-j3gq-jhhw-fhv2
• GHSA-85wf-qxr5-4q6f
• GHSA-j2m4-hfwp-v29x
• GHSA-qphh-479q-cp29

Each one has the affected range (<= 0.3.0) and the patched version (0.4.0, released 25 October) filled in. Each timeline shows the CVE requests, and I re-requested on at least one advisory. I opened a support ticket, but it was closed because my plan only includes self-service support.

The fixes are public, so I'd like to publish the advisories soon. Three questions:

1. Are these requests queued for review, or is something wrong with them that I need to fix?
2. If I publish the advisories now, does the pending CVE request stay with each advisory, or do I need to request again after publishing?
3. Did re-requesting create duplicate requests or move them back in the queue?

Thanks.

[xcorail]

Hello

1. They are queued for review - https://github.blog/security/supply-chain-security/inside-the-advisory-database-and-what-happens-when-vulnerability-volume-breaks-records/
2. The pending CVE request stays with each advisory
3. Do no re-request. It doesn't create duplicate requests, but it might move them back in the queue.