Stale aliases after changing OSV source from `aliases` to `upstream`

[mbauman]

Describe the bug
We corrected three of our advisories' references to their originating advisory from being aliases to upstreams. While the sources no longer have aliases defined at all, the imported records on osv.dev are still showing the alias. Additionally, these three advisories are now being flagged as having import findings:

{"invalid_records":[{"bug_id":"JLSEC-2025-250","source":"julia","findings":["IMPORT_FINDING_TYPE_INVALID_UPSTREAM"],"first_seen":"2026-05-03T05:53:24.932556Z","last_attempt":"2026-05-03T05:53:24.932556Z"},{"bug_id":"JLSEC-2025-7","source":"julia","findings":["IMPORT_FINDING_TYPE_INVALID_UPSTREAM"],"first_seen":"2026-04-11T05:12:29.788928Z","last_attempt":"2026-04-11T05:12:29.788928Z"},{"bug_id":"JLSEC-2025-8","source":"julia","findings":["IMPORT_FINDING_TYPE_INVALID_UPSTREAM"],"first_seen":"2026-04-11T05:12:29.788928Z","last_attempt":"2026-04-11T05:12:29.788928Z"}]}

I don't believe there's anything inherently wrong with these advisories. I think the old state has persisted here in a way that has confused the import checks. The three advisories are:

1. https://osv.dev/vulnerability/JLSEC-2025-7 (markdown source, json export)
2. https://osv.dev/vulnerability/JLSEC-2025-8 (markdown source, json export)
3. https://osv.dev/vulnerability/JLSEC-2025-250 (markdown source, json export)

Expected behaviour
I expect updating an advisory to remove aliases would similarly remove the entries in osv.dev's imported copy. I expect there to be no import findings for these advisories.

Screenshots

[jess-lowe]

I triggered a reimport of all of the JLSEC records, and it does seem to have fixed it. I'm not sure why this isn't being picked up by the importer. We'll keep an eye on this happening again in the future.

The import finding should disappear in a day or two presumably (that Cron job only runs about once per day iirc)

I really appreciate your dedication to data quality! Thanks!