Developer is notified when a new CVE affecting Metabase is disclosed

[vevetron]

User story / feature request

As a developer maintaining Metabase,
When a new CVE affecting Metabase is disclosed upstream,
I am notified (e.g. by email) so we can assess our exposure — instead of learning about it reactively as we did with the latest CVE-2026-72898.

Acceptance Criteria

1. When a new CVE / security advisory affecting Metabase is published upstream, we receive a notification (email, or an issue in this repo) naming the CVE and its severity.
2. The notification is driven by the public advisory feed for the Metabase product — it does not scan or depend on our deployed image or infrastructure.
3. Routine, non-security Metabase releases do not trigger this notification — this is a security-advisory alert only.

Notes

• Candidate mechanisms (engineer's call): an OpenCVE (opencve.io) subscription to the Metabase vendor/product that emails on new CVEs; watching Security advisories on the metabase/metabase GitHub repo; or a small scheduled Action polling the OSV.dev / GitHub Advisory API for the Metabase package and emailing / opening an issue.
• Staying current on Metabase releases (patch/version drift) is handled separately — see Move to the next Metabase LTS line when one is designated #5665 (LTS line) and the closed Formalize cloud-run metabase updates #4928; this story is only about proactive CVE awareness, including the window before a fix ships.