If it helps, in the Renovate project we don't usually request a full CVE ID, but use the GitHub Security Advisory (GHSA) ID You can use those numbers in change

If it helps, in the Renovate project we don't usually request a full CVE ID, but use the GitHub Security Advisory (GHSA) ID You can use those numbers in changelogs as soon as they're published There is some human review, which takes time, before the GHSA is "GitHub-reviewed" which then allows security scanners to pick it up Then, the CVE ID can be assigned to it after-the-fact if need be, but the GHSA should be a sufficient starting point