Dependency Graph Diff

{
  "$schema": "https://json-schema.org/draft/2020-12/schema",
  "$id": "#/components/schemas/dependency-graph-diff",
  "title": "Dependency Graph Diff",
  "description": "A diff of the dependencies between two commits.",
  "type": "array",
  "items": {
    "type": "object",
    "properties": {
      "change_type": {
        "type": "string",
        "enum": [
          "added",
          "removed"
        ]
      },
      "manifest": {
        "type": "string",
        "example": "path/to/package-lock.json"
      },
      "ecosystem": {
        "type": "string",
        "example": "npm"
      },
      "name": {
        "type": "string",
        "example": "@actions/core"
      },
      "version": {
        "type": "string",
        "example": "1.0.0"
      },
      "package_url": {
        "type": "string",
        "nullable": true,
        "example": "pkg:/npm/%40actions/core@1.1.0"
      },
      "license": {
        "type": "string",
        "nullable": true,
        "example": "MIT"
      },
      "source_repository_url": {
        "type": "string",
        "nullable": true,
        "example": "https://github.com/github/actions"
      },
      "vulnerabilities": {
        "type": "array",
        "items": {
          "type": "object",
          "properties": {
            "severity": {
              "type": "string",
              "example": "critical"
            },
            "advisory_ghsa_id": {
              "type": "string",
              "example": "GHSA-rf4j-j272-fj86"
            },
            "advisory_summary": {
              "type": "string",
              "example": "A summary of the advisory."
            },
            "advisory_url": {
              "type": "string",
              "example": "https://github.com/advisories/GHSA-rf4j-j272-fj86"
            }
          },
          "required": [
            "severity",
            "advisory_ghsa_id",
            "advisory_summary",
            "advisory_url"
          ]
        }
      },
      "scope": {
        "description": "Where the dependency is utilized. `development` means that the dependency is only utilized in the development environment. `runtime` means that the dependency is utilized at runtime and in the development environment.",
        "type": "string",
        "enum": [
          "unknown",
          "runtime",
          "development"
        ]
      }
    },
    "required": [
      "change_type",
      "manifest",
      "ecosystem",
      "name",
      "version",
      "package_url",
      "license",
      "source_repository_url",
      "vulnerabilities",
      "scope"
    ]
  }
}