Data quality issue. CVE-2026-86145 not reported on pcre2, possibly others are missing as well

**Describe the bug**
Hi there from [Erlang/OTP](https://github.com/erlang/otp) team.

We have been using OSV to do our vulnerability scanning using the REST API, and OSV is great!

However, we have noticed recently that some of the [reporting](https://github.com/erlang/otp/actions/runs/34176106105/job/101996056772) (data quality) seem to be incorrect.

We discovered that we are possibly affected by a pcre2 issue and we were wondering if OSV should have alert us in the CI pipeline that we have, which relies on OSV.

This is the information we send using the `https://api.osv.dev/v1/querybatch` REST API:

```
{
"queries": [
{
"commit": "37d575ede5ade50ad95b857f22ed7f1be4b1f2df",
"package": { "name": "github.com/microsoft/STL" }
},
{
"commit": "4c0618b0e44f7ef027ebae05d2cc7812048f7c8f",
"package": { "name": "github.com/ulfjack/ryu" }
},
{
"commit": "5fe1940275d04432da841896bac0a66cc2375551",
"package": { "name": "github.com/asmjit/asmjit" }
},
{
"commit": "c9a9e5b10105ad850b6e4d1122c645c67767c341",
"package": { "name": "github.com/openssl/openssl" }
},
{
"commit": "da607da739fa6047df13e66a2af6b8bec7c2a498",
"package": { "name": "github.com/madler/zlib" }
},
{
"commit": "f454e231fe5006dd7ff8f4693fd2b8eb94333429",
"package": { "name": "github.com/PCRE2Project/pcre2" }
},
{
"commit": "f8745da6ff1ad1e7bab384bd1f9d742439278e99",
"package": { "name": "github.com/facebook/zstd" }
},
{
"package": {
"ecosystem": "npm",
"name": "jquery"
},
"version": "4.0.0"
},
{
"package": {
"ecosystem": "npm",
"name": "jquery-migrate"
},
"version": "4.0.2"
},
{
"package": {
"ecosystem": "npm",
"name": "tablesorter"
},
"version": "2.32"
}
]
}
```

and I would like to focus on `pcre2`
```
{
"commit": "f454e231fe5006dd7ff8f4693fd2b8eb94333429",
"package": { "name": "github.com/PCRE2Project/pcre2" }
```
where I believe commit `f454e231fe5006dd7ff8f4693fd2b8eb94333429` tags [pcre 10.47](https://github.com/PCRE2Project/pcre2/releases#release-pcre2-10.47). When we run the query, we were expecting to get [CVE-2026-86145](https://osv.dev/vulnerability/CVE-2026-86145), but we didn't. The report says that this has been fixed in pcre 10.48 and we run pcre 10.47, so we were expecting to get a notification from our integration with OSV.

**To Reproduce**
Steps to reproduce the behaviour:
1. Make a query towards `https://api.osv.dev/v1/querybatch` with the payload from above
2. See the response. The response does not report of CVE-2026-86145 among possible others. I believe CVE-2026-86145 should have been reported, but it wasn't. Please, correct me if I am mistaken.

**Expected behaviour**
I was expecting to get all the CVEs for which PCRE2 10.47 is vulnerable.

Thanks for looking in this and keep up the good work!

Start by replaying the payload against the `https://api.osv.dev/v1/querybatch` endpoint, focusing on the PCRE2 commit query for `f454e231fe5006dd7ff8f4693fd2b8eb94333429`. Trace how the service resolves that commit to PCRE2 10.47 and matches CVE-2026-86145. Done means determining whether the CVE should be returned and correcting the data or query behavior if it should.

Written by the indexing model from the issue text.