When analyzing https://github.com/aquasecurity/trivy/issues/2034 I was surprised to find the advisory id GHSA-qq97-vm5h-rrhg in two different states: 1. https://github.com/distribution/distribution/security/advisories/GHSA-qq97-vm5h-rrhg from the repo maintainers which seems to be the most up-to-date version, including the CVE number 2. https://github.com/advisories/GHSA-qq97-vm5h-rrhg as a public Github Advisory which has not been updated Because I did not find a machine readable format of the first one I have to ask: - is there any automation to keep the official advisories in-sync (bot for automated pull requests on updates)? - where is the official process documented? - one id, two links, different information: which one is expected to be used by the public? I guess the second one because the on mouse over preview has more details