Make output ordering deterministic

[michaelkedar]

Currently, it looks like the order of the package source files (in every output format) can change between runs.

e.g.

# Output 1
╭─────────────────────────────────────┬───────────┬──────────────────────────┬─────────┬────────────────────╮
│ OSV URL (ID IN BOLD)                │ ECOSYSTEM │ PACKAGE                  │ VERSION │ SOURCE             │
├─────────────────────────────────────┼───────────┼──────────────────────────┼─────────┼────────────────────┤
│ https://osv.dev/GHSA-m5pq-gvj9-9vr8 │ crates.io │ regex                    │ 1.3.1   │ path/to/Cargo.lock │
│ https://osv.dev/RUSTSEC-2022-0013   │           │                          │         │                    │
│ https://osv.dev/GHSA-c3h9-896r-86jm │ Go        │ github.com/gogo/protobuf │ 1.3.1   │ path/to/go.mod     │
│ https://osv.dev/GO-2021-0053        │           │                          │         │                    │
╰─────────────────────────────────────┴───────────┴──────────────────────────┴─────────┴────────────────────╯

# Output 2
╭─────────────────────────────────────┬───────────┬──────────────────────────┬─────────┬────────────────────╮
│ OSV URL (ID IN BOLD)                │ ECOSYSTEM │ PACKAGE                  │ VERSION │ SOURCE             │
├─────────────────────────────────────┼───────────┼──────────────────────────┼─────────┼────────────────────┤
│ https://osv.dev/GHSA-c3h9-896r-86jm │ Go        │ github.com/gogo/protobuf │ 1.3.1   │ path/to/go.mod     │
│ https://osv.dev/GO-2021-0053        │           │                          │         │                    │
│ https://osv.dev/GHSA-m5pq-gvj9-9vr8 │ crates.io │ regex                    │ 1.3.1   │ path/to/Cargo.lock │
│ https://osv.dev/RUSTSEC-2022-0013   │           │                          │         │                    │
╰─────────────────────────────────────┴───────────┴──────────────────────────┴─────────┴────────────────────╯

(this can also happen in the json output)

From what I can tell, this only affects the ordering of package sources - the ordering of packages from a source, and vulnerabilities in a package seem to be consistent between runs.

[oliverchang]

+1 thanks for filing this. We should make this more deterministic for easy comparisons between runs.