Let's see if this helps fixing weird issues I see when building
on my local Jenkins (old news showing up before new ones) that
break reproducibility.

Also, fallback to sorting by path: some of our old security advisories have the
exact same publication name, so without any means of disambiguation, the
resulting sort order is random.