code: private boolean cpeIdentifiersMatch(Dependency dependency1, Dependency dependency2) {
          if (dependency1 == null || dependency1.getVulnerableSoftwareIdentifiers() == null
                  || dependency2 == null || dependency2.getVulnerableSoftwareIdentifiers() == null) {
              return false;
          }
          boolean matches = false;
          final int cpeCount1 = dependency1.getVulnerableSoftwareIdentifiers().size();
          final int cpeCount2 = dependency2.getVulnerableSoftwareIdentifiers().size();
          if (cpeCount1 > 0 && cpeCount1 == cpeCount2) {
              for (Identifier i : dependency1.getVulnerableSoftwareIdentifiers()) {
                  matches |= dependency2.getVulnerableSoftwareIdentifiers().contains(i);
                  if (!matches) {
                      break;
                  }
              }
          }
          LOGGER.debug("IdentifiersMatch={} ({}, {})", matches, dependency1.getFileName(), dependency2.getFileName());
          return matches;
      }
docs: Returns true if the CPE identifiers in the two supplied dependencies are
  equal.
  
  @param dependency1 a dependency2 to compare
  @param dependency2 a dependency2 to compare
  @return true if the identifiers in the two supplied dependencies are
  equal