OSV Vulnerability Records (JSON Lines)
All four SAMPLE advisories as newline-delimited OSV records — the bulk shape an advisory database is loaded from, where each line must parse independently. Advisory identifiers use the invented NOVUS-SAMPLE namespace with SAMPLE-CVE aliases; no identifier here refers to a published CVE, GHSA or OSV record, and no package named exists.
{"schema_version":"1.6.0","id":"NOVUS-SAMPLE-2026-0001","modified":"2026-01-10T00:00:00Z","published":"2026-01-05T00:00:00Z","aliases":["SAMPLE-CVE-2026-0001"],"summary":"SAMPLE advisory: fabricated improper-input-validation issue in a fictional logging library.","details":"SAMPLE advisory: fabricated improper-input-validation issue in a fictional logging library. This record exists only as a test fixture; the package, the advisory and the identifier are all invented.","affected":[{"package":{"ecosystem":"npm","name":"example-logger","purl":"pkg:npm/example-logger@3.4.1"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"3.5.0"}]}],"versions":["3.4.1"],"database_specific":{"source":"NOVUS-SAMPLE","cwe":"CWE-20","vulnerable_range":"<3.5.0"}}],"severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"}],"references":[{"type":"ADVISORY","url":"https://advisories.orchard.example/NOVUS-SAMPLE-2026-0001"},{"type":"FIX","url":"https://git.orchard.example/logger/3.5.0"}],"database_specific":{"severity":"HIGH","cvss_score":8.1,"note":"Advisory identifiers use the invented NOVUS-SAMPLE namespace with SAMPLE-CVE aliases; no identifier here refers to a published CVE, GHSA or OSV record, and no package named exists."}}
{"schema_version":"1.6.0","id":"NOVUS-SAMPLE-2026-0002","modified":"2026-01-10T00:00:00Z","published":"2026-01-05T00:00:00Z","aliases":["SAMPLE-CVE-2026-0002"],"summary":"SAMPLE advisory: fabricated unsafe-deserialisation issue in a fictional cache library.","details":"SAMPLE advisory: fabricated unsafe-deserialisation issue in a fictional cache library. This record exists only as a test fixture; the package, the advisory and the identifier are all invented.","affected":[{"package":{"ecosystem":"npm","name":"example-cache","purl":"pkg:npm/example-cache@0.9.2"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"0.9.5"}]}],"versions":["0.9.2"],"database_specific":{"source":"NOVUS-SAMPLE","cwe":"CWE-502","vulnerable_range":">=0.9.0 <0.9.5"}}],"severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H"}],"references":[{"type":"ADVISORY","url":"https://advisories.orchard.example/NOVUS-SAMPLE-2026-0002"},{"type":"FIX","url":"https://git.orchard.example/cache/0.9.5"}],"database_specific":{"severity":"CRITICAL","cvss_score":9.3,"note":"Advisory identifiers use the invented NOVUS-SAMPLE namespace with SAMPLE-CVE aliases; no identifier here refers to a published CVE, GHSA or OSV record, and no package named exists."}}
{"schema_version":"1.6.0","id":"NOVUS-SAMPLE-2026-0003","modified":"2026-01-10T00:00:00Z","published":"2026-01-05T00:00:00Z","aliases":["SAMPLE-CVE-2026-0003"],"summary":"SAMPLE advisory: fabricated uncontrolled-resource-consumption issue in a fictional parser.","details":"SAMPLE advisory: fabricated uncontrolled-resource-consumption issue in a fictional parser. This record exists only as a test fixture; the package, the advisory and the identifier are all invented.","affected":[{"package":{"ecosystem":"npm","name":"example-yaml-lite","purl":"pkg:npm/example-yaml-lite@1.1.7"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.2.0"}]}],"versions":["1.1.7"],"database_specific":{"source":"NOVUS-SAMPLE","cwe":"CWE-400","vulnerable_range":"<1.2.0"}}],"severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"references":[{"type":"ADVISORY","url":"https://advisories.orchard.example/NOVUS-SAMPLE-2026-0003"},{"type":"FIX","url":"https://git.orchard.example/yamllite/1.2.0"}],"database_specific":{"severity":"MEDIUM","cvss_score":5.4,"note":"Advisory identifiers use the invented NOVUS-SAMPLE namespace with SAMPLE-CVE aliases; no identifier here refers to a published CVE, GHSA or OSV record, and no package named exists."}}
{"schema_version":"1.6.0","id":"NOVUS-SAMPLE-2026-0004","modified":"2026-01-10T00:00:00Z","published":"2026-01-05T00:00:00Z","aliases":["SAMPLE-CVE-2026-0004"],"summary":"SAMPLE advisory: fabricated allocation-without-limits issue in a fictional query library.","details":"SAMPLE advisory: fabricated allocation-without-limits issue in a fictional query library. This record exists only as a test fixture; the package, the advisory and the identifier are all invented.","affected":[{"package":{"ecosystem":"npm","name":"example-json-path","purl":"pkg:npm/example-json-path@2.0.5"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"2.1.0"}]}],"versions":["2.0.5"],"database_specific":{"source":"NOVUS-SAMPLE","cwe":"CWE-770","vulnerable_range":"<2.1.0"}}],"severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:N/I:N/A:L"}],"references":[{"type":"ADVISORY","url":"https://advisories.orchard.example/NOVUS-SAMPLE-2026-0004"},{"type":"FIX","url":"https://git.orchard.example/jsonpath/2.1.0"}],"database_specific":{"severity":"LOW","cvss_score":3.1,"note":"Advisory identifiers use the invented NOVUS-SAMPLE namespace with SAMPLE-CVE aliases; no identifier here refers to a published CVE, GHSA or OSV record, and no package named exists."}}
Specifications
- Seed
- 51200
- Sample Only
- true
- Format
- OSV
- Serialisation
- NDJSON
- Records
- 4
- One Record Per Line
- true
- Line Endings
- LF
Testing contract
Expected to pass- Scenario
- Stream-load an advisory feed line by line without buffering the whole file.
- Expected result
- Four lines each parse to a complete OSV record; no line depends on a surrounding array or trailing comma.
What is a .jsonl file?
JSONL (JSON Lines) is a text format where each line is a complete, independent JSON value, allowing records to be streamed and appended without parsing the whole file. It is not itself a JSON array and each line must stand alone. It is common in logging, machine learning datasets, and data pipelines.
How to use this file
Use an example JSONL to test line-by-line streaming parsers, append-and-resume ingestion, and batch pipelines that process one record per line.
How to use this file for testing
“OSV Vulnerability Records (JSON Lines)” is a deterministic Novus Examples fixture for JSON parsing, Data import, Conversion testing. Flat, deeply nested, JSON Lines, and intentionally invalid JSON for testing parsers and error handling.
Documented properties for this file: seed 51200 · 4 records · LF. Compare results against paired or grouped companions on this page when present (clean↔damaged, searchable↔scanned, or format twins) so scores stay reproducible across runs.
Download the file once, keep the path stable in CI or local scripts, and treat the spec table as the contract: dimensions, seeds, field lists, and roles are intentional. Corrupt or invalid samples are labelled as such — expect parsers to fail loudly rather than silently accept them.
SBOM, lockfile, provenance, and advisory fixtures describe the same fabricated component tree across formats, so a converter or scanner can be diffed against a known answer. Every package name, version, hash, and advisory ID is invented — never treat a finding here as real.
Feed the file to your parser and assert it handles the documented quirks — quoted delimiters, embedded newlines, ragged rows, or invalid syntax; the valid↔invalid distinction is labelled in the title.
Code examples
import json
with open("osv-records.jsonl") as f:
rows = [json.loads(line) for line in f]
print(len(rows), rows[0])Related files
- jsonColumnar Nulls Schema (JSON)JSON description of nullable columns in the null-heavy columnar fixtures.
- jsonCSAF 2.0 VEX DocumentA CSAF 2.0 VEX advisory with the nested product tree that CSAF requires — vendor, product name, product version — and product_status buckets rather than a per-statement status field. Advisory identifiers use the invented NOVUS-SAMPLE namespace with SAMPLE-CVE aliases; no identifier here refers to a published CVE, GHSA or OSV record, and no package named exists.
- jsonCycloneDX VEX DocumentA CycloneDX VEX document asserting a different analysis state for each of the four SAMPLE advisories, so a suppression pipeline can be tested against every branch at once. Advisory identifiers use the invented NOVUS-SAMPLE namespace with SAMPLE-CVE aliases; no identifier here refers to a published CVE, GHSA or OSV record, and no package named exists.
- jsonOpenVEX Statement DocumentAn OpenVEX document covering all four status values, with the justification and impact statement OpenVEX requires alongside not_affected and the action statement it requires alongside affected. Advisory identifiers use the invented NOVUS-SAMPLE namespace with SAMPLE-CVE aliases; no identifier here refers to a published CVE, GHSA or OSV record, and no package named exists.
- jsonAttestation With a Full SPDX PredicateAn in-toto statement whose predicate is an entire SPDX 2.3 document — the nesting that makes attestation payloads large and that a size-limited verifier has to cope with. Every package, version, hash and licence is fictional — the tree describes nothing real.
- lockbun.lock (Text Lockfile)Bun's text lockfile, where each package is a positional array of descriptor, dependency map and integrity string rather than an object — a shape that breaks parsers assuming every lock entry is keyed. Every package, version, hash and licence is fictional — the tree describes nothing real.
Generated by generation/supply_chain.py. Free for any use, no attribution required — license.