Reconcile VeraCrypt advisory records for CVE-2026-108982 #10349

I'm VeraCrypt's maintainer. I have published our advisory under the existing CVE-2026-108982:
GHSA-f3px-f8h2-fm4c

There's also an older imported entry for the same CVE:
GHSA-h6r2-r3xv-333f

Could your team link these records, or advise how to reconcile them? Both describe the same vulnerability. The maintainer advisory has the current fix status and reporting credits. The source fix is merged, but there's still no fixed release. VeraCrypt 1.26.29 with FUSE-T on macOS remains affected.

I couldn't use Suggest improvements because the form requires a supported package ecosystem, and VeraCrypt doesn't fit any of the choices. I also saw that the contribution rules exclude unsupported ecosystems, so I'm asking for guidance here.

Both records should keep CVE-2026-108982. Thank you for helping sort this out.