https://github.com/CVEProject/cve-services/blob/69b28595b2d5217548abd97aaed11ea05db7d6ae/src/repositories/baseUserRepository.js#L517-L519 This seems to be converting in the wrong direction (i.e., a Legacy to Registry conversion would be expected).