tell about patched versions

if a user runs a vulnerable version for trust and there exists a patched version with a better label perhaps, provide the user with that information as well. As an example

protobuf 3.7.1 -> is vulnerable and gets low severity 
protobuf 3.7.2 -> is patched and audited and gets safe.