Automated discovery event PRs can have conflicts when working with subpackages

[rawlingsj]

We have automation that automatically created CVE detection events which is great! Some packages that have subpackages have related advisory PRs created but also have merge conflicts.

Some examples:
#788
#786
#781
#756
#755