pub fn cross_reference(layers: &[FindingsLayer]) -> Vec<Correspondence>Expand description
Cross-reference the dependency findings across layers.
Returns one Correspondence per advisory-and-package, ordered by package,
then version, then advisory — a stable order, so two runs over the same store
render identically. Findings that are not on the dependency axis (no
meta.package) are absent, because there is nothing about a SAST finding for
a dependency scanner to agree with.
The findings themselves are neither modified nor consumed: this borrows them and describes what it saw.
§This does not suppress single-source rows
Nothing here counts analyzers. One dependency analyzer with N advisories yields
N correspondences, each reading confirmed_by: 1 — which is a true description
of what it saw and the wrong thing to report, because a table in which every
row says “confirmed by 1” is noise dressed as information. The suppression is
across_analyzers, and a caller that renders a cross-reference section wants
that one. Said here rather than only there because taking this function for the
reporting view is a mistake that has actually been made (PR #468 review):
security list --json had the guard inline and the model-facing surface, added
later, documented it and did not have it.