fix(reporter): dedupe lockfile poisoning markdown threats by URL

[Carla232]

Fixes #231

Summary

• consolidate lockfile poisoning threat entries by resolved URL
• apply the URL-based consolidation to both the markdown summary and the CLI summary output
• keep existing wording for non-lockfile threats and lockfile threats without a URL in the message
• add unit tests for URL-based grouping and markdown/summary rendering behavior

Why

When multiple package entries resolve through the same private or non-registry URL, the report can repeat nearly identical lockfile poisoning findings. Grouping by URL makes the report shorter and easier to review, even when different package names point to the same resolved artifact.

Testing

• go test ./pkg/reporter -run "Test(GroupLockfilePoisoningThreatsByURL|AddThreatsSectionConsolidatesLockfilePoisoningByURL|GroupLockfilePoisoningMessagesByURL)$" -count=1 -v
• go test ./pkg/reporter -count=1
• manual repro with glob and globx pointing to the same tarball URL: CLI summary contains the URL once
• manual repro with --report-markdown-summary: markdown summary contains the URL once

---

[safedep]

SafeDep Report Summary

No dependency changes detected. Nothing to scan.

View complete scan results →

_{This report is generated by SafeDep Github App}

[KunalSin9h]

@Carla232 thanks for contribution

[KunalSin9h]

@Carla232 builds are failing..

[Carla232]

@Carla232 builds are failing..

Thanks for the heads-up. I pushed a fix in commit e342908 (the previous build break is addressed).
The checks on this fork PR now show action_required (not a new code failure).
Could a maintainer please approve/re-run the workflows?

[Carla232]

I pushed a follow-up fix in 7547b3a for the Go Linter failure (gci import grouping in the markdown summary test). I verified locally with the targeted tests and golangci-lint --new-from-patch, which now reports 0 issues.

Could you please approve/re-run the workflows?

[Carla232]

I pushed another follow-up in ea7c8a5 for the run-test failure in pkg/scanner.

The failure was caused by a flaky test: the query-worker test was starting the full Malysis enricher, so the result worker and the test were both consuming from the same resultsChannel. The test now starts only the query worker it is meant to verify, which avoids that race.

Locally verified:

• go test ./pkg/scanner -run "TestMalysisMalwareEnricherQueryWorker/MalysisMalwareEnricher/QueryWorker/should_return_error_for_requests_with_future_retry$" -count=1 -v
• go test ./pkg/scanner -run "MalysisMalware" -count=1 -v
• go test ./pkg/scanner -count=1

Could you please approve/re-run the workflows for the latest commit?

[devin-ai-integration]

✅ Devin Review: No Issues Found

Devin Review analyzed this PR and found no potential bugs to report.

View in Devin Review to see 3 additional findings.

[KunalSin9h]

@Carla232 i tested it loally (from your branch) by building vet.

Why the url is repeated, it should solve this?

my package.json

{
  "name": "vet-test",
  "version": "1.0.0",
  "description": "",
  "main": "index.js",
  "scripts": {
    "test": "echo \"Error: no test specified\" && exit 1"
  },
  "keywords": [],
  "author": "",
  "license": "ISC",
  "type": "commonjs",
  "dependencies": {
    "glob": "https://github.com/isaacs/node-glob/archive/refs/tags/v10.3.0.tar.gz",
    "globx": "https://github.com/isaacs/node-glob/archive/refs/tags/v10.3.0.tar.gz"
  }
}

[Carla232]

Thanks for testing this and for the screenshot. You were right: the previous change still allowed the same resolved URL to appear multiple times in the CLI summary output, especially when different package names point to the same tarball URL.

I pushed ddf97b4 to address that. The PR now groups lockfile poisoning signals strictly by resolved URL in both places:

• CLI summary output
• --report-markdown-summary

I also updated the PR description to reflect this broader scope.

Verified with the glob / globx repro case from your comment:

• CLI summary now prints one consolidated line: 4 lockfile poisoning signals share URL https://github.com/isaacs/node-glob/archive/refs/tags/v10.3.0.tar.gz
• markdown summary contains that URL once
• go test ./pkg/reporter -run "Test(GroupLockfilePoisoningThreatsByURL|AddThreatsSectionConsolidatesLockfilePoisoningByURL|GroupLockfilePoisoningMessagesByURL)$" -count=1 -v
• go test ./pkg/reporter -count=1

[KunalSin9h]

thanks will test

[abhisek]

@KunalSin9h Can you please review and take this forward?

[KunalSin9h]

merged fix in #729.

@Carla232 thanks for contribution.