The advisory should carry a revision history recording what changed and when, since advisories are updated as remediations and affected-product lists change (ISO/IEC 30111 7.1.7 a).
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.