OWASP Dependency-Check Report (JSON)
A Dependency-Check-shaped JSON report, including the evidence-collection block that records how a package was identified and the confidence attached to that identification. Advisory identifiers use the invented NOVUS-SAMPLE namespace with SAMPLE-CVE aliases; no identifier here refers to a published CVE, GHSA or OSV record, and no package named exists.
{
"reportSchema": "1.1",
"scanInfo": {
"engineVersion": "0.0.0-sample"
},
"projectInfo": {
"name": "orchard-gateway",
"reportDate": "2026-01-01T00:00:00Z",
"credits": {
"NOVUS-SAMPLE": "Advisory identifiers use the invented NOVUS-SAMPLE namespace with SAMPLE-CVE aliases; no identifier here refers to a published CVE, GHSA or OSV record, and no package named exists."
}
},
"dependencies": [
{
"isVirtual": false,
"fileName": "example-logger-3.4.1.tgz",
"filePath": "/app/node_modules/example-logger",
"sha256": "7fb72ea58987e5327259b66384f96f5e657c3ce5225b8891c567cac6b58430ec",
"evidenceCollected": {
"vendorEvidence": [
{
"type": "vendor",
"confidence": "HIGH",
"source": "package.json",
"name": "author",
"value": "Example Softworks (fictional)"
}
]
},
"packages": [
{
"id": "pkg:npm/example-logger@3.4.1",
"confidence": "HIGHEST",
"url": "https://advisories.orchard.example"
}
],
"vulnerabilities": [
{
"source": "NOVUS-SAMPLE",
"name": "NOVUS-SAMPLE-2026-0001",
"severity": "HIGH",
"cvssv3": {
"baseScore": 8.1,
"attackVector": "NETWORK",
"baseSeverity": "HIGH"
},
"cwes": [
"CWE-20"
],
"description": "SAMPLE advisory: fabricated improper-input-validation issue in a fictional logging library.",Specifications
- Seed
- 51200
- Sample Only
- true
- Tool
- Dependency-Check-shaped
- Report Schema
- 1.1
- Dependencies
- 4
- Evidence Types
- vendor
- Line Endings
- LF
Testing contract
Expected to pass- Scenario
- Read identification confidence alongside findings so low-confidence matches can be filtered.
- Expected result
- Four dependencies load with HIGHEST package confidence and HIGH vendor evidence, each bound to one SAMPLE advisory.
What is a .json file?
JSON (JavaScript Object Notation) is a lightweight, text-based data-interchange format representing objects, arrays, strings, numbers, booleans, and null. It is language-independent, human-readable, and the dominant format for web APIs and configuration. It requires a single well-formed root value.
How to use this file
Use an example JSON file to test parsers and serializers, schema validation, Unicode and number-precision handling, and API request or response processing.
How to use this file for testing
“OWASP Dependency-Check Report (JSON)” is a deterministic Novus Examples fixture for JSON parsing, Schema validation, Conversion testing. Flat, deeply nested, JSON Lines, and intentionally invalid JSON for testing parsers and error handling.
Documented properties for this file: seed 51200 · LF. Compare results against paired or grouped companions on this page when present (clean↔damaged, searchable↔scanned, or format twins) so scores stay reproducible across runs.
Download the file once, keep the path stable in CI or local scripts, and treat the spec table as the contract: dimensions, seeds, field lists, and roles are intentional. Corrupt or invalid samples are labelled as such — expect parsers to fail loudly rather than silently accept them.
SBOM, lockfile, provenance, and advisory fixtures describe the same fabricated component tree across formats, so a converter or scanner can be diffed against a known answer. Every package name, version, hash, and advisory ID is invented — never treat a finding here as real.
Feed the file to your parser and assert it handles the documented quirks — quoted delimiters, embedded newlines, ragged rows, or invalid syntax; the valid↔invalid distinction is labelled in the title.
Code examples
import json
with open("dependency-check-report.json") as f:
data = json.load(f)
print(type(data), len(data))Related files
- jsonCSAF 2.0 VEX DocumentA CSAF 2.0 VEX advisory with the nested product tree that CSAF requires — vendor, product name, product version — and product_status buckets rather than a per-statement status field. Advisory identifiers use the invented NOVUS-SAMPLE namespace with SAMPLE-CVE aliases; no identifier here refers to a published CVE, GHSA or OSV record, and no package named exists.
- jsonCycloneDX VEX DocumentA CycloneDX VEX document asserting a different analysis state for each of the four SAMPLE advisories, so a suppression pipeline can be tested against every branch at once. Advisory identifiers use the invented NOVUS-SAMPLE namespace with SAMPLE-CVE aliases; no identifier here refers to a published CVE, GHSA or OSV record, and no package named exists.
- jsonOpenVEX Statement DocumentAn OpenVEX document covering all four status values, with the justification and impact statement OpenVEX requires alongside not_affected and the action statement it requires alongside affected. Advisory identifiers use the invented NOVUS-SAMPLE namespace with SAMPLE-CVE aliases; no identifier here refers to a published CVE, GHSA or OSV record, and no package named exists.
- jsonAttestation With a Full SPDX PredicateAn in-toto statement whose predicate is an entire SPDX 2.3 document — the nesting that makes attestation payloads large and that a size-limited verifier has to cope with. Every package, version, hash and licence is fictional — the tree describes nothing real.
- jsonCycloneDX 1.5 Application SBOM (JSON)A CycloneDX 1.5 SBOM of the same fictional tree, useful for spec-version migration tests: 1.5 introduced the object form of metadata.tools and this file uses it, while dropping the 1.6-only external references. Every package, version, hash and licence is fictional — the tree describes nothing real.
- jsonCycloneDX 1.6 Application SBOM (JSON)A complete CycloneDX 1.6 SBOM in JSON for a fictional application and its nine dependencies, with purls, SHA-256 hashes, supplier records, external references and an explicit dependency graph. Every package, version, hash and licence is fictional — the tree describes nothing real.
Generated by generation/supply_chain.py. Free for any use, no attribution required — license.