Thanks: it's not trivially clear how I could try it out to check if it works well: it seems to use Debian security tracker to note which CVEs have been fixed, so version numbering scheme should not come into play.

I'll try to find some time later to play with it in depth as it seems to be an interesting set of tools!