Feature: Adding insight in json report

[Ali-Yazdani]

Request Description

It would be great to include insights showing indirect dependencies in the .json report, similar to the insights currently available in both HTML and CLI output.

Additional Information

No response

[prabhu]

@Ali-Yazdani did you check the .vdr.json file? It must have the insights as a property.

[Ali-Yazdani]

@prabhu While I'm using depscan --bom bom.json --explain, there is just a bom.vdr.json file which is not for that reason. The insights are not part of the depscan-bom.json file, which contains the results.

[prabhu]

VDR would also have the vulnerabilities. The jsonlines file is going away in v6, so best to not use that file.

[gnittala]

@prabhu - so, if I want to check the vulnerabilities in the SBOM, the file to check is the bom.vdr.json or is it the depscan-python.json (for a python project) ?

[prabhu]

bom.vdr.json

[gnittala]

Thank you @prabhu for confirming this. On a separate note, is the bom.vdr.json supposed to be in the --reports-dir or in the /app dir? I see that it is created in the /app dir and to avoid modifying a project directory, wouldn't it be better to include it in the --reports-dir ? Would that be a bug or a feature request or as-designed ?