As stated in the Github GraphQL upcoming breaking changes, CVSS data is switching to provide both CVSS version 3 and 4 in its responses.
The deprecated field name is currently used by vunnel. A bump of the schema schema/vulnerability/github-security-advisory/schema-1.0.2.json to v2 with the new cvssSeverities instead of cvss is necessary.