The stuff they announced today on dependency security feels like a really good step. They stopped short of saying they were going to resurrect OSVDB, but not far short. In the meantime, they're going to display a project's dependency graph in the insights tab, and in future will suggest fixes for any security vulnerabilities in it (i.e., insecure versions).