Vulnerability Deduplication

[KramNamez]

Current Behavior:

Multiple analyzers report the same vulnerability from multiple sources, e.g.:
Internal reports GHSA-ww39-953v-wcq6 while OSS Index reports CVE-2020-28469 - both of which are the same thing.

Both issues have to be read and evaluated and suppressed independently.

Proposed Behavior:

Only one issue should be created, ideally with at least the references merged, if not the descriptions. Only one issue exists that needs to be handled by the project team.

[msymons]

This is effectively a duplicate of #1642

[KramNamez]

Argh, you're right. I searched for "dedup" and "deduplication" but not "de-dup". My bad.

[nscuro]

Thanks @msymons, closing as duplicate.

[github-actions]

This thread has been automatically locked since there has not been any recent activity after it was closed. Please open a new issue for related bugs.