at times one can re-vendor a newer shared library dependency to effectively address a CVE. In such cases one can increase a build number; whilst keeping the wheel version the same.
Some of this was already touched in #103
I wonder if the database here or in osv can support build tags as part of the version stream?