is there any way to filter redundant security vulnerabilities entries of same JS Library in response?

[mathuriga]

There could be a possibility to use a js library in different locations in a project. When I tried to Retire.js scan against project root directory, I got redundant entries of some JS Libraries. Is there any way to filter those redundant entries in retire.json?

[eoftedal]

It currently reports every file it find that contains a certain vulnerability (or every module) and there is no way to filter that, because they are actually separate findings.

[eoftedal]

@mathuriga Maybe we could add a flag that would merge redundant findings... Is this something you need for console output, or JSON output ?

[mathuriga]

@eoftedal Yes. I need kind of requirement to generate separate JSON output which merges the redundant findings. Is it possible to do with retire.js?

[eoftedal]

The CycloneDX-JSON export actually does this, so closing.