in packages/repocop/src/evaluation/repository.ts [332:359]
export function deduplicateVulnerabilitiesByCve(
vulns: RepocopVulnerability[],
): RepocopVulnerability[] {
const vulnsWithSortedCVEs = vulns.map((v) => {
return {
...v,
cves: v.cves.sort(),
};
});
const [withCVEs, withoutCVEs] = partition(
vulnsWithSortedCVEs,
(v) => v.cves.length > 0,
);
//group withCVEs by CVEs
const dedupedWithCVEs = withCVEs
.sort(vulnSortPredicate)
.reduce<Record<string, RepocopVulnerability>>((acc, vuln) => {
const key = vuln.cves.join(',');
if (!acc[key]) {
acc[key] = vuln;
}
return acc;
}, {});
const dedupedVulns = Object.values(dedupedWithCVEs).concat(withoutCVEs);
return dedupedVulns;
}