When analyzing aquasecurity/trivy#2034 I was surprised to find the advisory id GHSA-qq97-vm5h-rrhg in two different states:

1. GHSA-qq97-vm5h-rrhg from the repo maintainers which seems to be the most up-to-date version, including the CVE number
2. GHSA-qq97-vm5h-rrhg as a public Github Advisory which has not been updated

Because I did not find a machine readable format of the first one I have to ask:

• is there any automation to keep the official advisories in-sync (bot for automated pull requests on updates)?
• where is the official process documented?
• one id, two links, different information: which one is expected to be used by the public? I guess the second one because the on mouse over preview has more details