[lelia]

--strict-blocking reports every alert on an added package twice, once as new and once as existing. Against an empty baseline, every finding doubles (70 alerts rendered as 140 JSON entries in an internal reproduction). The exit code is correct; only the rendered output and counts are wrong.

Root Cause

create_new_diff builds the unchanged package set by filtering packages against added_packages and removed_packages. packages is keyed by type/purl, but the other two are keyed by artifact ID, so the membership check never matches and every added package is also treated as unchanged. Its alerts land in both diff.new_alerts and diff.unchanged_alerts, and select_diff_alerts concatenates the two.

This isn't specific to empty baselines: any added package is affected. An empty baseline just makes every package an added one.

Affected under --strict-blocking:

• JSON, SARIF, Slack, GitLab security report and FOSSA-format output (duplicate findings).
• The summary's "EXISTING blocking issues" count and the GitLab commit status description (inflated counts).

Fix

• New Core.get_unchanged_packages selects unchanged packages by Package.id and keys the result by artifact ID, matching the added and removed dicts. That also lets get_source_data resolve topLevelAncestors for transitive unchanged alerts, which it couldn't do against purl keys.
• select_diff_alerts skips an unchanged alert already listed as new, matching on ecosystem, purl and alert type. The ecosystem is part of the key because Issue.purl holds only name and version, so an npm and a PyPI package can share it. Alerts without a purl are never deduped.
• Version bumped to 2.12.1, with a CHANGELOG entry.

Out of scope: --strict-blocking exiting 0 against a real baseline despite existing blocking alerts. The diff-scans API returns unchanged artifacts with empty alerts, so that needs a backend change, tracked separately.

Testing

• New tests/core/test_strict_blocking_duplicates.py runs Core.create_new_diff against a mocked diff response, with the scan upload mocked out, then checks the JSON and summary output. It covers an empty baseline, a real baseline with new and existing alerts, a failure on existing alerts alone, output without --strict-blocking, artifact-ID keying, and the dedupe, including the same purl in two ecosystems. 4 of the 7 tests fail on main, and 3 fail if create_new_diff alone goes back to the purl-keyed filter.
• uv run pytest: 605 passed. ruff check is clean and uv lock --locked is in sync.

Public Changelog

Fixed --strict-blocking listing each finding on an added package twice in JSON, SARIF, Slack and GitLab output, and double-counting it as an existing issue in the summary.

Fixes CE-498

[cursor]

PR Summary

Low Risk
Bug fix in diff package classification and alert selection for --strict-blocking; exit codes were already correct and behavior without strict blocking is covered by tests.

Overview
Fixes duplicate findings when --strict-blocking is on. Added packages were incorrectly included in the unchanged set because membership was checked against mismatched dict keys (type/purl vs artifact ID), so each alert appeared in both new and existing output.

Core.get_unchanged_packages now classifies unchanged packages by Package.id and returns artifact-ID–keyed maps aligned with added/removed data (including transitive topLevelAncestors resolution). select_diff_alerts additionally skips unchanged alerts that duplicate a new alert on the same (purl, type) pair.

Release 2.12.1 with CHANGELOG and regression tests in tests/core/test_strict_blocking_duplicates.py for JSON/summary output and dedupe behavior.

^{Reviewed by Cursor Bugbot for commit fd2501d. Configure here.}

[lelia]

bugbot run

[cursor]

✅ Bugbot reviewed your changes and found no new issues!

Comment @cursor review or bugbot run to trigger another review on this PR

^{Reviewed by Cursor Bugbot for commit fd2501d. Configure here.}