Prefer CVE ids and merge duplicate vuln findings

Use CVE identifiers when GitHub advisories provide them, while keeping
alternate advisory ids as aliases for reconciliation.

Also merge duplicate findings across the final vulnerability output so
the same issue is not reported separately under GHSA and CVE ids.

Author: santigimeno

dep_checker/main.py

@@ -96,6 +96,10 @@ def default(self, obj):
           vulnerableVersionRange
           advisory {
             ghsaId
+            identifiers {
+              type
+              value
+            }
             permalink
             withdrawnAt
           }
@@ -105,6 +109,38 @@ def default(self, obj):
 """
 )
 
+def preferred_advisory_id(advisory: dict) -> str:
+    for identifier in advisory.get("identifiers") or []:
+        if identifier.get("type") == "CVE" and identifier.get("value"):
+            return identifier["value"]
+    return advisory["ghsaId"]
+
+
+def advisory_aliases(advisory: dict, preferred_id: str) -> list[str]:
+    aliases: list[str] = []
+    for identifier in advisory.get("identifiers") or []:
+        value = identifier.get("value")
+        if value and value != preferred_id and value not in aliases:
+            aliases.append(value)
+    return aliases
+
+
+def merge_vulnerabilities(vulnerabilities: list[Vulnerability]) -> list[Vulnerability]:
+    merged: dict[str, Vulnerability] = {}
+    for vuln in vulnerabilities:
+        candidate_ids = [vuln.id, *(vuln.advisory_aliases or [])]
+        for candidate_id in candidate_ids:
+            existing = merged.get(candidate_id)
+            if existing is None:
+                continue
+            for alias in vuln.advisory_aliases or []:
+                if alias != existing.id and alias not in existing.advisory_aliases:
+                    existing.advisory_aliases.append(alias)
+            break
+        else:
+            merged[vuln.id] = vuln
+    return list(merged.values())
+
 
 def resolve_dependencies(
     repo_path: Path, repo_branch: str
@@ -202,16 +238,19 @@ def query_ghad(
             for v in result["securityVulnerabilities"]["nodes"]
             if v["advisory"]["withdrawnAt"] is None
             and dep_version in SpecifierSet(v["vulnerableVersionRange"])
-            and v["advisory"]["ghsaId"] not in ignore_list
+            and preferred_advisory_id(v["advisory"]) not in ignore_list
         ]
         if matching_vulns:
             found_vulnerabilities.extend(
                 [
                     Vulnerability(
-                        id=vuln["advisory"]["ghsaId"],
+                        id=preferred_advisory_id(vuln["advisory"]),
                         url=vuln["advisory"]["permalink"],
                         dependency=name,
                         version=dep_version,
+                        advisory_aliases=advisory_aliases(
+                            vuln["advisory"], preferred_advisory_id(vuln["advisory"])
+                        ),
                     )
                     for vuln in matching_vulns
                 ]
@@ -417,11 +456,14 @@ def main() -> int:
             print(f"Warning: npm vulnerability checking failed: {e}", file=sys.stderr)
             print(f"Traceback: {traceback.format_exc()}", file=sys.stderr)
 
+    merged_vulnerabilities = merge_vulnerabilities(
+        ghad_vulnerabilities + nvd_vulnerabilities + npm_vulnerabilities
+    )
     all_vulnerabilities = {
-        "vulnerabilities": ghad_vulnerabilities + nvd_vulnerabilities + npm_vulnerabilities,
+        "vulnerabilities": merged_vulnerabilities,
         "scan_complete": scan_complete,
     }
-    no_vulnerabilities_found = not ghad_vulnerabilities and not nvd_vulnerabilities and not npm_vulnerabilities
+    no_vulnerabilities_found = not merged_vulnerabilities
 
     if scan_file is not None:
         with open(scan_file, "w") as f: