When an advisory is published for a dependency, more often than not, the project does not use the dependency in a way that is affected by the problem described in the advisory. For this reason we don't accept the simple fact that an advisory exists for a dependency as a security issue in itself.
If you have done any analysis to confirm the issue described in the advisory does impact this project, please share that information with us though the private channels described at https://www.apache.org/security/.
If you have verified the issue does not impact the project, it would be appreciated to share this analysis through the projects' public channels.
If you have not done any analysis on whether the advisory for the dependency impacts the project, you can consult the projects' public channels, such as their issue tracker or public mailinglists, to find out if anyone else has done any research into this advisory. If not, you may open a public issue or discussion on the mailinglist. Contributions upgrading the dependency to a version that is not affected by the problem are also generally welcomed.
For Java (Maven/Gradle) projects, the DependencyCheck plugin can be a useful tool to discover advisories in dependencies.
The Security team has also set up an experimental DependencyTrack instance at https://security-tools-ec2-va.apache.org/. If you make sure recent SBOMs are uploaded to this tool, you can use its interface to discover whether there are any current advisories for dependencies of your project. Email engelen@apache.org if you would like access.
Various scanning tools exist to flag advisories in dependencies, which can be run by us, but also by users of our software. To improve the accuracy of such tools, it would be great if we could share the analysis of whether an advisory in a dependency affects our project in a machine-readable way. VEX (and to some extent VDR) file formats are meant for this. The ecosystem around these tools is still very much in development, if you want to experiment with these feel free to email security@apache.org.