Bug wrong path issue dependency check in SonarQube

[Eiken0tt]

Describe the bug
I scan a project that has two package-lock.json. One is located at the frontend/package-lock.json path and one is located at the backend/package-lock.json path.
The package-lock.json with vulnerabilities is the frontend/package-lock.json but if I look at the report from the project's sonarqube issues dashboard the report is assigned to package-lock.json located at backend/package-lock.json.

To Reproduce
Run a dependency-check. Run the Sonarscanner scan and push the reports ( i push the reports in format .html, .xml and .json). Then check the path from the report in html and the path from the Sonarqube issues dashboard.

Current behavior
In the Sonarqube issues section the issues are associated to the backend/package-lock.json but the issues are in the frontend/package-lock.json

Expected behavior
In the Sonarqube issues section the issues must be associated correctly.

Screenshots

• Part of json report file which shows where the vulnerable library was detected:

{
            "evidenceCollected": {
                "productEvidence": [
                    {
                        "confidence": "HIGHEST",
                        "name": "name",
                        "source": "package.json",
                        "type": "product",
                        "value": "store2"
                    }
                ],
                "vendorEvidence": [
                    {
                        "confidence": "HIGH",
                        "name": "name",
                        "source": "package.json",
                        "type": "vendor",
                        "value": "store2"
                    }
                ],
                "versionEvidence": [
                    {
                        "confidence": "HIGHEST",
                        "name": "version",
                        "source": "package.json",
                        "type": "version",
                        "value": "2.14.2"
                    }
                ]
            },
            "fileName": "store2:2.14.2",
            "filePath": "/code/source/frontend/package-lock.json?store2",
            "isVirtual": true,
            "packages": [
                {
                    "confidence": "HIGHEST",
                    "id": "pkg:npm/store2@2.14.2",
                    "url": "https://ossindex.sonatype.org/component/pkg:npm/store2@2.14.2?utm_source=dependency-check&utm_medium=integration&utm_content=12.1.0"
                }
            ],
.      .       .
.      .       .
.      .       .

• Screeenshot html report

• Path mismatch

• Some other libraries with mismatch paths

Versions (please complete the following information):

• Dependency-Check Core version 12.1.0
• Sonarqube Community Edition v25.5.0.107428
• dependency-check-sonar-plugin 5.0.0

Additional context

I already opened an issue in the sonarqube issues manager (community.sonarsource.com). They replied me to open the issue here.

[Reamer]

You have definitely come to the right place. I am open to pull requests to fix this problem.

[Eiken0tt]

Are there any updates @Reamer? Thanks!