pub fn cross_reference(layers: &[FindingsLayer]) -> Vec<Correspondence>Expand description
Cross-reference the dependency findings across layers.
Returns one Correspondence per advisory-and-package, ordered by package,
then version, then advisory — a stable order, so two runs over the same store
render identically. Findings that are not on the dependency axis (no
meta.package) are absent, because there is nothing about a SAST finding for
a dependency scanner to agree with.
The findings themselves are neither modified nor consumed: this borrows them and describes what it saw.