A rescan only touched the timestamp of findings it had seen before, so a newly published fix version, a changed severity and the package source never reached existing rows. The repository now updates those fields while keeping first_seen and the status the user set. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>