Improve dependency resolving from lockfiles #1237

Resolves dependency for cases where multiple requirements
are resolved by one package and all the version requirements
are joined for that package.

Reference: #1237
Signed-off-by: Ayan Sinha Mahapatra <ayansmahapatra@gmail.com>

Author: AyanSinhaMahapatra

scanpipe/pipes/scancode.py

@@ -602,6 +602,7 @@ def match_and_resolve_dependencies(project):
             dependency_data={"purl": dependency.purl},
             ignore_nulls=True,
         )
+
         matched_dependencies = DiscoveredDependency.objects.filter(
             project=project,
             extracted_requirement=dependency.extracted_requirement,
@@ -611,6 +612,22 @@ def match_and_resolve_dependencies(project):
         other_dependencies = [
             dep for dep in matched_dependencies if dep.purl != dependency.purl
         ]
+        if not other_dependencies:
+            # We also have cases where multiple dependency requirements have one
+            # resolved package and the extracted requirements field is combined
+            matched_dependencies = DiscoveredDependency.objects.filter(
+                project=project,
+                **purl_data,
+            )
+            other_dependencies = [
+                dep
+                for dep in matched_dependencies
+                if (
+                    dep.purl != dependency.purl
+                    and dependency.extracted_requirement in dep.extracted_requirement
+                )
+            ]
+
         if other_dependencies:
             resolved_dependency = other_dependencies.pop()
             dependency.update(

setup.cfg

@@ -72,7 +72,7 @@ install_requires =
     # Docker
     container-inspector==33.0.0
     # ScanCode-toolkit
-    scancode-toolkit[packages] @ git+https://github.com/nexB/scancode-toolkit.git@b24b29f5e04b72a723fcc0e55e5d4cb60fc879e4
+    scancode-toolkit[packages] @ git+https://github.com/nexB/scancode-toolkit.git@ce8e0d1ddc9e8968958313e82481d46498d51f25
     extractcode[full]==31.0.0
     commoncode==31.2.1
     # FetchCode