GHSA-7h2j-956f-4vf2
The advisories a survey carries survive only in its brief's rendered list of affected locations, and that list stops after a fixed number of entries without the count above it changing — so what a survey was seen to carry is what fitted.
The package it is raised against
Seen against @isaacs/brace-expansion.