Dependency Vulnerability & Outdated-Version Audit (npm / Python)

{
  "type": "object",
  "anyOf": [
    {
      "required": [
        "requirements_txt"
      ]
    },
    {
      "required": [
        "package_json"
      ]
    }
  ],
  "properties": {
    "package_json": {
      "type": "string",
      "description": "package.json contents"
    },
    "requirements_txt": {
      "type": "string",
      "description": "requirements.txt contents"
    }
  },
  "additionalProperties": false
}

{
  "type": "object",
  "properties": {
    "summary": {
      "type": "object",
      "properties": {
        "total": {
          "type": "number"
        },
        "errors": {
          "type": "number"
        },
        "outdated": {
          "type": "number"
        },
        "deprecated": {
          "type": "number",
          "description": "Only present on the npm fixture -- may not appear for every input."
        },
        "up_to_date": {
          "type": "number"
        },
        "vulnerable": {
          "type": "number"
        }
      },
      "description": "Same counts as the top-level fields, grouped together.",
      "additionalProperties": true
    },
    "ecosystem": {
      "type": "string",
      "description": "Which package ecosystem was audited, e.g. 'npm' or 'pypi'."
    },
    "dependencies": {
      "type": "array",
      "items": {
        "type": "object",
        "properties": {
          "name": {
            "type": "string",
            "description": "Package name, e.g. 'express', 'django'."
          },
          "is_outdated": {
            "type": "boolean"
          },
          "is_deprecated": {
            "type": "boolean",
            "description": "Only present on the npm fixture -- may not appear for every input."
          },
          "latest_version": {
            "type": "string",
            "description": "Latest version available in the registry."
          },
          "current_version": {
            "type": "string",
            "description": "Version pinned in the submitted file."
          },
          "vulnerabilities": {
            "type": "array",
            "items": {
              "type": "object",
              "properties": {
                "id": {
                  "type": "string",
                  "description": "Vulnerability advisory id, e.g. a GHSA or PYSEC-style identifier."
                },
                "aliases": {
                  "type": "array",
                  "items": {
                    "type": "string"
                  },
                  "description": "Alternate ids for the same vulnerability. Observed empty on both fixtures."
                }
              },
              "additionalProperties": true
            },
            "description": "Known vulnerabilities for this specific package version. Empty when none found."
          },
          "highest_severity": {
            "type": [
              "string",
              "null"
            ],
            "description": "Highest severity among this package's known vulnerabilities, e.g. 'low'; observed null (react fixture entry) when the package has zero known vulnerabilities."
          },
          "is_dev_dependency": {
            "type": "boolean",
            "description": "Only present on the npm fixture -- may not appear for every input."
          },
          "vulnerability_count": {
            "type": "number"
          }
        },
        "additionalProperties": true
      },
      "description": "One entry per dependency found in the submitted file."
    },
    "outdated_count": {
      "type": "number",
      "description": "Count of dependencies with a newer version available."
    },
    "critical_updates": {
      "type": "array",
      "items": {
        "type": "string"
      },
      "description": "Short human-readable flags for the packages needing the most urgent attention, e.g. 'express (2 vulns)'."
    },
    "deprecated_count": {
      "type": "number",
      "description": "Count of deprecated dependencies. Only present on the npm fixture -- absent on the pypi fixture, so may not appear for every input."
    },
    "vulnerable_count": {
      "type": "number",
      "description": "Count of dependencies with at least one known vulnerability."
    },
    "total_dependencies": {
      "type": "number",
      "description": "Count of dependencies audited."
    },
    "total_vulnerabilities": {
      "type": "number",
      "description": "Total vulnerability count across all dependencies."
    }
  },
  "description": "The dependency-audit record, as returned at routing.responseResultPath ($.output).",
  "additionalProperties": true
}