Vulnerability report normalizer

It reads Trivy JSON, Grype JSON, generic JSON arrays, and CSV or TSV tables, normalizes severity and status vocabularies, and merges only exact matches: same identifier, same asset, same component version. Same identifier on a different version is listed as a near-duplicate and kept separate; findings without an identifier are never merged. It is not a scanner: it never checks whether a CVE applies to your version range, never fetches advisories, and never resolves version comparisons. Exported CSV cells that start with =, +, -, or @ are prefixed with an apostrophe so spreadsheets cannot run them as formulas.