Project and releases
project
Project-level metadata. Used in report generation.
| Field | Type | Required | Description |
|---|---|---|---|
|
String |
Yes |
Name of the organization or vendor. |
|
String |
Yes |
Name of the software project. |
|
String |
Yes |
Name of the responsible security team or author. |
|
String (email) |
No |
Contact email for the security team. |
Validation reports a blank project field as an error: VEX documents name their author and supplier from it.
releases
Defines the releases tracked in this Vulnlog file.
Releases must be listed in chronological order (oldest first).
This ordering is used by the CLI to resolve --as-of filtering.
Validation warns when two releases carrying published_at are declared out of order.
| Field | Type | Required | Description |
|---|---|---|---|
|
String |
Yes |
Unique release identifier (e.g., |
|
String (date, |
No |
Publication date of the release. Absence indicates the release is not yet published, and leaves it out of VEX documents unless |
|
Array of PURL entries |
No |
Versioned Package URLs identifying the release artifacts. |
PURL entry
A release artifact identified by its Package URL, optionally tagged for scoping.
| Field | Type | Required | Description |
|---|---|---|---|
|
String (Package URL) |
Yes |
The versioned Package URL for this artifact in this release. Validation warns about a purl without a version, because VEX statements for it would apply to every version of the artifact. |
|
Array of String |
No |
Tags associated with this purl. Must reference tags defined in the |