code: private void enrich(final Dependency dependency) {
          log.debug("Enrich dependency: {}", dependency);
  
          for (Identifier id : dependency.getSoftwareIdentifiers()) {
              if (id instanceof PurlIdentifier) {
                  log.debug("  Package: {} -> {}", id, id.getConfidence());
  
                  PackageUrl purl = parsePackageUrl(id.getValue());
                  if (purl != null) {
                      try {
                          ComponentReport report = reports.get(purl);
                          if (report == null) {
                              throw new IllegalStateException("Missing component-report for: " + purl);
                          }
  
                          // expose the URL to the package details for report generation
                          id.setUrl(report.getReference().toString());
  
                          for (ComponentReportVulnerability vuln : report.getVulnerabilities()) {
                              Vulnerability v = transform(report, vuln);
                              Vulnerability existing = dependency.getVulnerabilities().stream().filter(e->e.getName().equals(v.getName())).findFirst().orElse(null);
                              if (existing!=null) {
                                  //TODO - can we enhance anything other than the references?
                                  existing.getReferences().addAll(v.getReferences());
                              } else {
                                  dependency.addVulnerability(v);
                              }
                          }
                      } catch (Exception e) {
                          log.warn("Failed to fetch component-report for: {}", purl, e);
                      }
                  }
              }
          }
      }
docs: Attempt to enrich given dependency with vulnerability details from OSS
  Index component-report.