Repository navigation
fix: sort machine-readable output by code unit - #432
Merged
Merged
Conversation
Bare localeCompare follows LANG/LC_ALL, so the same names can reorder (Estonian collates zod before tslib). Scan JSON, SARIF, SBOM export, and coded warnings now share compareCodeUnit. Signed-off-by: Cursor Agent <cursoragent@cursor.com> Co-authored-by: vibgrate-team <vibgrate-team@users.noreply.github.com>
Compare string keys in scan JSON, SARIF, and SBOM by code unit so LANG and LC_ALL do not change those documents. Signed-off-by: Cursor Agent <cursoragent@cursor.com> Co-authored-by: vibgrate-team <vibgrate-team@users.noreply.github.com>
Signed-off-by: Cursor Agent <cursoragent@cursor.com> # Conflicts: # CHANGELOG.md Co-authored-by: vibgrate-team <vibgrate-team@users.noreply.github.com>
Signed-off-by: Cursor Agent <cursoragent@cursor.com> # Conflicts: # src/core-open/run-core-scan.ts # src/reporting/commands/sbom.ts Co-authored-by: vibgrate-team <vibgrate-team@users.noreply.github.com>
Co-authored-by: vibgrate-team <vibgrate-team@users.noreply.github.com>
Vendored files under src/core-open carry the vendor header and no tests. Keeping +build metadata stays covered by the scanner and SBOM test. Signed-off-by: Cursor Agent <cursoragent@cursor.com> Co-authored-by: vibgrate-team <vibgrate-team@users.noreply.github.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Bare
localeComparefollowsLANGandLC_ALL, so machine-readable output could change order between machines. Sorts that shapevg scanJSON, SARIF andvg sbomoutput now use one shared UTF-16 code-unit comparator, the same ordering the JUnit report already used.This covers dependency rows, vulnerability packages and advisory ids, license-parse findings, coded and skipped-path warnings, SBOM component keys and project lists, reachability and duplicate/phantom dependency lists, and architecture-gate findings.
The same inputs now produce the same bytes on every locale.
Flaskstill sorts beforeflask, and Swedish collation no longer movesÄpfelrelative tozebra.Related issues
Closes #410
Closes #417
Checklist
pnpm testpassespnpm lintis cleanpnpm typecheckis cleanHow to verify
pnpm test pnpm lint pnpm typecheck