DSL Reference

The Vulnlog DSL is Kotlin-based and can be used in *.vl.kts files. The Vulnlog CLI can parse the DSL.

The Vulnlog CLI requires a definitions.vl.kts file and reads all *.vl.kts files in the same folder as the definition file.

• definitins.vl.kts defines all resources and configurations that are available in a Vulnlog file. It is similar to a Gradle settings file.
• *.vl.kts contains the vulnerability reports.

Example:

// definitions.vl.kts
releases {
    branch("Release Branch 0") {
        release("0.1.0")
    }
}

reporters {
    reporter("OWASP Dependency Check")
}

// demo.vl.kts
val releaseBranch0 by ReleaseBranchProvider
val owaspDependencyCheck by ReporterProvider

vuln("CVE-2025-005") {
    report from dependencyScanner1 at "2025-04-08" on releaseBranch0..releaseBranch0
}

The Vulnlog DSL consists of context or block definitions, providers and specifiers.

Top level context definitions. The DSL consists of these functions with their context or blocks.

Providers provide definitions from within the definitions.vl.kts file in a *.vl.kts file.

Example:

// The definition file has a release branch definition of "Release Branch 0" that
// is providable by its camel-case version.
val releaseBranch0 by ReleaseBranchProvider

// The definition file has a reporter definition of "Dependency Scanner 1" that
// is providable by its camel-case version.
val dependencyScanner1 by ReporterProvider

Specifiers are DSL constants values allowing to configure or define functions within the DSL.

Release branch specifiers help to describe a set of release branches.

Suppress specifiers help to describe how long a suppression is active.

Verdict specifiers define what severity level a vulnerability regarding the software project has. A critical verdict has a more citical impact on the software project than a low verdict. If the project is not at all affected or has mitigations in place the notAffected verdict is used.