CGA-mphh-pq94-9fmc

This vulnerability was only present in versions prior to 10.3 (this release). v10.3.0 was the first to remediate. The componentVersion is being flagged incorrectly here by some scanners. A bug has been filed upstream against Syft, and the maintainers have confirmed it's a scanner issue:

• https://github.com/anchore/syft/issues/2980
• https://mattermost.com/security-updates/