add --min-severity flag to filter vulnerabilities by severity level

PROJECTS/simple-vulnerability-scanner/internal/cli/output.go

@@ -307,6 +307,26 @@ func truncate(s string, maxLen int) string {
 	return s[:maxLen-3] + "..."
 }
 
+func filterVulnsBySeverity(
+	vulns map[string][]types.Vulnerability,
+	minSev string,
+) map[string][]types.Vulnerability {
+	threshold := severityRank(minSev)
+	filtered := make(map[string][]types.Vulnerability)
+	for pkg, vlist := range vulns {
+		var kept []types.Vulnerability
+		for _, v := range vlist {
+			if severityRank(v.Severity) <= threshold {
+				kept = append(kept, v)
+			}
+		}
+		if len(kept) > 0 {
+			filtered[pkg] = kept
+		}
+	}
+	return filtered
+}
+
 // PrintSummary displays final counts after an update or scan operation
 func PrintSummary(result types.ScanResult, updated bool) {
 	if updated {

PROJECTS/simple-vulnerability-scanner/internal/cli/update.go

@@ -18,7 +18,10 @@ import (
 	"github.com/spf13/cobra"
 )
 
-var verbose bool
+var (
+	verbose     bool
+	minSeverity string
+)
 
 type updateFlags struct {
 	file              string
@@ -50,6 +53,10 @@ latest stable versions, and checks for known CVEs using OSV.dev.`,
 		&verbose, "verbose", "v", false,
 		"show full vulnerability details",
 	)
+	root.PersistentFlags().StringVar(
+		&minSeverity, "min-severity", "low",
+		"minimum severity to report (critical, high, moderate, low)",
+	)
 
 	root.AddCommand(
 		newUpdateCmd(),
@@ -220,6 +227,7 @@ func runUpdate(
 	}
 
 	if vulns != nil {
+		vulns = filterVulnsBySeverity(vulns, minSeverity)
 		PrintVulnerabilities(vulns)
 	}
 
@@ -255,6 +263,7 @@ func runScan(ctx context.Context, file string) error {
 	PrintScanning(len(deps))
 
 	vulns := scanForVulns(ctx, deps)
+	vulns = filterVulnsBySeverity(vulns, minSeverity)
 	PrintVulnerabilities(vulns)
 
 	totalVulns := 0