v0.4.3 feedback: hard-blocker-safe clustering

[CAOShurong]

VulnFuse v0.4.3 changes clustering so that a transitive match bridge cannot carry an existing hard conflict into one cluster.

Release: https://github.com/CAOShurong/vulnfuse/releases/tag/v0.4.3

The concrete failure was: scanner A matched B, B matched C, but A and C had explicit disjoint vulnerability identifiers and conflicting components. v0.4.2 still collapsed all three through connected-component transitivity. v0.4.3 considers stronger edges first and checks every cross-cluster pair against VulnFuse's existing hard blockers before merging.

This is a conservative rule, not a claim of universal vulnerability identity or scientifically validated deduplication accuracy. It can split records that a domain expert would join when the reports do not carry enough compatible evidence.

Useful feedback would include:

• sanitized scanner outputs where a bridge still produces a false merge;
• legitimate aliases that the cluster-wide blocker rule now splits;
• evidence about how primary versus related identifiers should affect clustering;
• scale measurements that approach the documented 1,000,000 safety-comparison ceiling.

Please remove internal asset names, repository paths, credentials, and other sensitive data before sharing. A minimal synthetic fixture is welcome. For reproducible defects, open an issue and include vulnfuse --version, the command, expected clusters, actual clusters, and the smallest safe fixture.