[V6] Same CVE but different bom-ref

I'm checking V6 result towards V5 and I have a doubt about the report

With V5 I have this result:

With V6 I have a different result:

the vdr file is correct with 2 different vulnerabilties for ansi-regex@5.0.0 and ansi-regex@5.0.0 and ansi-regex@3.0.0

This is the sbom I use to debug this issue

SonarQube-master-short.cdx.json

vdr result for V5.5

SonarQube-master-short.cdx_V5.vdr.json

And V6 report files:

SonarQube-master-short_V6.vdr.json
depscan_V6.txt

I tried to understand and fix the procedure but I just found where it could be the issue:

In generate_console_output there is some code to group the packages before output but in this case there is a CVE with 2 different bom-ref

I think this is a bug but I'm not sure :)

Thanks !
Michela

[prabhu]

Thanks @michelar68 for the test cases. I think to support lifecycle and semantic analysis (where the post-build SBOM could lack the correct version), we relaxed the grouping criteria to be PURL with no version. Will take a look later this week. But if you manage to hunt down the problematic code, let me know so that we can collaborate on some fixes or enhancements.

I tried without success :(
I will check again a possible solution or at least give more information

I set also "--no-suggest" so to disable 'Normalize fix versions automatically' otherwise the pkg list was updated

[michelar-68]

sorry I had to drop the old account and now I will follow the project with this one

michelar-68 it's always me :)