Merge branch 'support-new-syntax-for-common-vulnerabilities' into 'master'

Support new report syntax for common vulnerabilities (CE backport)

See merge request gitlab-org/gitlab-ce!23962

spec/fixtures/security-reports/deprecated/gl-dependency-scanning-report.json

+[
+  {
+    "category": "dependency_scanning",
+    "name": "io.netty/netty - CVE-2014-3488",
+    "message": "DoS by CPU exhaustion when using malicious SSL packets",
+    "cve": "app/pom.xml:io.netty/netty@3.9.1.Final:CVE-2014-3488",
+    "severity": "Unknown",
+    "solution": "Upgrade to the latest version",
+    "scanner": {
+      "id": "gemnasium",
+      "name": "Gemnasium"
+    },
+    "location": {
+      "file": "app/pom.xml",
+      "dependency": {
+        "package": {
+          "name": "io.netty/netty"
+        },
+        "version": "3.9.1.Final"
+      }
+    },
+    "identifiers": [
+      {
+        "type": "gemnasium",
+        "name": "Gemnasium-d1bf36d9-9f07-46cd-9cfc-8675338ada8f",
+        "value": "d1bf36d9-9f07-46cd-9cfc-8675338ada8f",
+        "url": "https://deps.sec.gitlab.com/packages/maven/io.netty/netty/versions/3.9.1.Final/advisories"
+      },
+      {
+        "type": "cve",
+        "name": "CVE-2014-3488",
+        "value": "CVE-2014-3488",
+        "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3488"
+      }
+    ],
+    "links": [
+      {
+        "url": "https://bugzilla.redhat.com/CVE-2014-3488"
+      },
+      {
+        "url": "http://netty.io/news/2014/06/11/3.html"
+      },
+      {
+        "url": "https://github.com/netty/netty/issues/2562"
+      }
+    ],
+    "priority": "Unknown",
+    "file": "app/pom.xml",
+    "url": "https://bugzilla.redhat.com/CVE-2014-3488",
+    "tool": "gemnasium"
+  },
+  {
+    "category": "dependency_scanning",
+    "name": "Django - CVE-2017-12794",
+    "message": "Possible XSS in traceback section of technical 500 debug page",
+    "cve": "app/requirements.txt:Django@1.11.3:CVE-2017-12794",
+    "severity": "Unknown",
+    "solution": "Upgrade to latest version or apply patch.",
+    "scanner": {
+      "id": "gemnasium",
+      "name": "Gemnasium"
+    },
+    "location": {
+      "file": "app/requirements.txt",
+      "dependency": {
+        "package": {
+          "name": "Django"
+        },
+        "version": "1.11.3"
+      }
+    },
+    "identifiers": [
+      {
+        "type": "gemnasium",
+        "name": "Gemnasium-6162a015-8635-4a15-8d7c-dc9321db366f",
+        "value": "6162a015-8635-4a15-8d7c-dc9321db366f",
+        "url": "https://deps.sec.gitlab.com/packages/pypi/Django/versions/1.11.3/advisories"
+      },
+      {
+        "type": "cve",
+        "name": "CVE-2017-12794",
+        "value": "CVE-2017-12794",
+        "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-12794"
+      }
+    ],
+    "links": [
+      {
+        "url": "https://www.djangoproject.com/weblog/2017/sep/05/security-releases/"
+      }
+    ],
+    "priority": "Unknown",
+    "file": "app/requirements.txt",
+    "url": "https://www.djangoproject.com/weblog/2017/sep/05/security-releases/",
+    "tool": "gemnasium"
+  },
+  {
+    "category": "dependency_scanning",
+    "name": "nokogiri - USN-3424-1",
+    "message": "Vulnerabilities in libxml2",
+    "cve": "rails/Gemfile.lock:nokogiri@1.8.0:USN-3424-1",
+    "severity": "Unknown",
+    "solution": "Upgrade to latest version.",
+    "scanner": {
+      "id": "gemnasium",
+      "name": "Gemnasium"
+    },
+    "location": {
+      "file": "rails/Gemfile.lock",
+      "dependency": {
+        "package": {
+          "name": "nokogiri"
+        },
+        "version": "1.8.0"
+      }
+    },
+    "identifiers": [
+      {
+        "type": "gemnasium",
+        "name": "Gemnasium-06565b64-486d-4326-b906-890d9915804d",
+        "value": "06565b64-486d-4326-b906-890d9915804d",
+        "url": "https://deps.sec.gitlab.com/packages/gem/nokogiri/versions/1.8.0/advisories"
+      },
+      {
+        "type": "usn",
+        "name": "USN-3424-1",
+        "value": "USN-3424-1",
+        "url": "https://usn.ubuntu.com/3424-1/"
+      }
+    ],
+    "links": [
+      {
+        "url": "https://github.com/sparklemotion/nokogiri/issues/1673"
+      }
+    ],
+    "priority": "Unknown",
+    "file": "rails/Gemfile.lock",
+    "url": "https://github.com/sparklemotion/nokogiri/issues/1673",
+    "tool": "gemnasium"
+  },
+  {
+    "category": "dependency_scanning",
+    "name": "ffi - CVE-2018-1000201",
+    "message": "ruby-ffi DDL loading issue on Windows OS",
+    "cve": "ffi:1.9.18:CVE-2018-1000201",
+    "severity": "High",
+    "solution": "upgrade to \u003e= 1.9.24",
+    "scanner": {
+      "id": "bundler_audit",
+      "name": "bundler-audit"
+    },
+    "location": {
+      "file": "sast-sample-rails/Gemfile.lock",
+      "dependency": {
+        "package": {
+          "name": "ffi"
+        },
+        "version": "1.9.18"
+      }
+    },
+    "identifiers": [
+      {
+        "type": "cve",
+        "name": "CVE-2018-1000201",
+        "value": "CVE-2018-1000201",
+        "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-1000201"
+      }
+    ],
+    "links": [
+      {
+        "url": "https://github.com/ffi/ffi/releases/tag/1.9.24"
+      }
+    ],
+    "priority": "High",
+    "file": "sast-sample-rails/Gemfile.lock",
+    "url": "https://github.com/ffi/ffi/releases/tag/1.9.24",
+    "tool": "bundler_audit"
+  }
+]

spec/fixtures/security-reports/feature-branch/gl-dependency-scanning-report.json

-[
-  {
-    "category": "dependency_scanning",
-    "name": "io.netty/netty - CVE-2014-3488",
-    "message": "DoS by CPU exhaustion when using malicious SSL packets",
-    "cve": "app/pom.xml:io.netty/netty@3.9.1.Final:CVE-2014-3488",
-    "severity": "Unknown",
-    "solution": "Upgrade to the latest version",
-    "scanner": {
-      "id": "gemnasium",
-      "name": "Gemnasium"
-    },
-    "location": {
-      "file": "app/pom.xml",
-      "dependency": {
-        "package": {
-          "name": "io.netty/netty"
+{
+  "version": "1.3",
+  "vulnerabilities": [
+    {
+      "category": "dependency_scanning",
+      "name": "io.netty/netty - CVE-2014-3488",
+      "message": "DoS by CPU exhaustion when using malicious SSL packets",
+      "cve": "app/pom.xml:io.netty/netty@3.9.1.Final:CVE-2014-3488",
+      "severity": "Unknown",
+      "solution": "Upgrade to the latest version",
+      "scanner": {
+        "id": "gemnasium",
+        "name": "Gemnasium"
+      },
+      "location": {
+        "file": "app/pom.xml",
+        "dependency": {
+          "package": {
+            "name": "io.netty/netty"
+          },
+          "version": "3.9.1.Final"
+        }
+      },
+      "identifiers": [
+        {
+          "type": "gemnasium",
+          "name": "Gemnasium-d1bf36d9-9f07-46cd-9cfc-8675338ada8f",
+          "value": "d1bf36d9-9f07-46cd-9cfc-8675338ada8f",
+          "url": "https://deps.sec.gitlab.com/packages/maven/io.netty/netty/versions/3.9.1.Final/advisories"
+        },
+        {
+          "type": "cve",
+          "name": "CVE-2014-3488",
+          "value": "CVE-2014-3488",
+          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3488"
+        }
+      ],
+      "links": [
+        {
+          "url": "https://bugzilla.redhat.com/CVE-2014-3488"
         },
-        "version": "3.9.1.Final"
-      }
+        {
+          "url": "http://netty.io/news/2014/06/11/3.html"
+        },
+        {
+          "url": "https://github.com/netty/netty/issues/2562"
+        }
+      ],
+      "priority": "Unknown",
+      "file": "app/pom.xml",
+      "url": "https://bugzilla.redhat.com/CVE-2014-3488",
+      "tool": "gemnasium"
     },
-    "identifiers": [
-      {
-        "type": "gemnasium",
-        "name": "Gemnasium-d1bf36d9-9f07-46cd-9cfc-8675338ada8f",
-        "value": "d1bf36d9-9f07-46cd-9cfc-8675338ada8f",
-        "url": "https://deps.sec.gitlab.com/packages/maven/io.netty/netty/versions/3.9.1.Final/advisories"
-      },
-      {
-        "type": "cve",
-        "name": "CVE-2014-3488",
-        "value": "CVE-2014-3488",
-        "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3488"
-      }
-    ],
-    "links": [
-      {
-        "url": "https://bugzilla.redhat.com/CVE-2014-3488"
+    {
+      "category": "dependency_scanning",
+      "name": "Django - CVE-2017-12794",
+      "message": "Possible XSS in traceback section of technical 500 debug page",
+      "cve": "app/requirements.txt:Django@1.11.3:CVE-2017-12794",
+      "severity": "Unknown",
+      "solution": "Upgrade to latest version or apply patch.",
+      "scanner": {
+        "id": "gemnasium",
+        "name": "Gemnasium"
       },
-      {
-        "url": "http://netty.io/news/2014/06/11/3.html"
+      "location": {
+        "file": "app/requirements.txt",
+        "dependency": {
+          "package": {
+            "name": "Django"
+          },
+          "version": "1.11.3"
+        }
       },
-      {
-        "url": "https://github.com/netty/netty/issues/2562"
-      }
-    ],
-    "priority": "Unknown",
-    "file": "app/pom.xml",
-    "url": "https://bugzilla.redhat.com/CVE-2014-3488",
-    "tool": "gemnasium"
-  },
-  {
-    "category": "dependency_scanning",
-    "name": "Django - CVE-2017-12794",
-    "message": "Possible XSS in traceback section of technical 500 debug page",
-    "cve": "app/requirements.txt:Django@1.11.3:CVE-2017-12794",
-    "severity": "Unknown",
-    "solution": "Upgrade to latest version or apply patch.",
-    "scanner": {
-      "id": "gemnasium",
-      "name": "Gemnasium"
-    },
-    "location": {
-      "file": "app/requirements.txt",
-      "dependency": {
-        "package": {
-          "name": "Django"
+      "identifiers": [
+        {
+          "type": "gemnasium",
+          "name": "Gemnasium-6162a015-8635-4a15-8d7c-dc9321db366f",
+          "value": "6162a015-8635-4a15-8d7c-dc9321db366f",
+          "url": "https://deps.sec.gitlab.com/packages/pypi/Django/versions/1.11.3/advisories"
         },
-        "version": "1.11.3"
-      }
+        {
+          "type": "cve",
+          "name": "CVE-2017-12794",
+          "value": "CVE-2017-12794",
+          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-12794"
+        }
+      ],
+      "links": [
+        {
+          "url": "https://www.djangoproject.com/weblog/2017/sep/05/security-releases/"
+        }
+      ],
+      "priority": "Unknown",
+      "file": "app/requirements.txt",
+      "url": "https://www.djangoproject.com/weblog/2017/sep/05/security-releases/",
+      "tool": "gemnasium"
     },
-    "identifiers": [
-      {
-        "type": "gemnasium",
-        "name": "Gemnasium-6162a015-8635-4a15-8d7c-dc9321db366f",
-        "value": "6162a015-8635-4a15-8d7c-dc9321db366f",
-        "url": "https://deps.sec.gitlab.com/packages/pypi/Django/versions/1.11.3/advisories"
+    {
+      "category": "dependency_scanning",
+      "name": "nokogiri - USN-3424-1",
+      "message": "Vulnerabilities in libxml2",
+      "cve": "rails/Gemfile.lock:nokogiri@1.8.0:USN-3424-1",
+      "severity": "Unknown",
+      "solution": "Upgrade to latest version.",
+      "scanner": {
+        "id": "gemnasium",
+        "name": "Gemnasium"
       },
-      {
-        "type": "cve",
-        "name": "CVE-2017-12794",
-        "value": "CVE-2017-12794",
-        "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-12794"
-      }
-    ],
-    "links": [
-      {
-        "url": "https://www.djangoproject.com/weblog/2017/sep/05/security-releases/"
-      }
-    ],
-    "priority": "Unknown",
-    "file": "app/requirements.txt",
-    "url": "https://www.djangoproject.com/weblog/2017/sep/05/security-releases/",
-    "tool": "gemnasium"
-  },
-  {
-    "category": "dependency_scanning",
-    "name": "nokogiri - USN-3424-1",
-    "message": "Vulnerabilities in libxml2",
-    "cve": "rails/Gemfile.lock:nokogiri@1.8.0:USN-3424-1",
-    "severity": "Unknown",
-    "solution": "Upgrade to latest version.",
-    "scanner": {
-      "id": "gemnasium",
-      "name": "Gemnasium"
-    },
-    "location": {
-      "file": "rails/Gemfile.lock",
-      "dependency": {
-        "package": {
-          "name": "nokogiri"
+      "location": {
+        "file": "rails/Gemfile.lock",
+        "dependency": {
+          "package": {
+            "name": "nokogiri"
+          },
+          "version": "1.8.0"
+        }
+      },
+      "identifiers": [
+        {
+          "type": "gemnasium",
+          "name": "Gemnasium-06565b64-486d-4326-b906-890d9915804d",
+          "value": "06565b64-486d-4326-b906-890d9915804d",
+          "url": "https://deps.sec.gitlab.com/packages/gem/nokogiri/versions/1.8.0/advisories"
         },
-        "version": "1.8.0"
-      }
+        {
+          "type": "usn",
+          "name": "USN-3424-1",
+          "value": "USN-3424-1",
+          "url": "https://usn.ubuntu.com/3424-1/"
+        }
+      ],
+      "links": [
+        {
+          "url": "https://github.com/sparklemotion/nokogiri/issues/1673"
+        }
+      ],
+      "priority": "Unknown",
+      "file": "rails/Gemfile.lock",
+      "url": "https://github.com/sparklemotion/nokogiri/issues/1673",
+      "tool": "gemnasium"
     },
-    "identifiers": [
-      {
-        "type": "gemnasium",
-        "name": "Gemnasium-06565b64-486d-4326-b906-890d9915804d",
-        "value": "06565b64-486d-4326-b906-890d9915804d",
-        "url": "https://deps.sec.gitlab.com/packages/gem/nokogiri/versions/1.8.0/advisories"
+    {
+      "category": "dependency_scanning",
+      "name": "ffi - CVE-2018-1000201",
+      "message": "ruby-ffi DDL loading issue on Windows OS",
+      "cve": "ffi:1.9.18:CVE-2018-1000201",
+      "severity": "High",
+      "solution": "upgrade to \u003e= 1.9.24",
+      "scanner": {
+        "id": "bundler_audit",
+        "name": "bundler-audit"
       },
-      {
-        "type": "usn",
-        "name": "USN-3424-1",
-        "value": "USN-3424-1",
-        "url": "https://usn.ubuntu.com/3424-1/"
-      }
-    ],
-    "links": [
-      {
-        "url": "https://github.com/sparklemotion/nokogiri/issues/1673"
-      }
-    ],
-    "priority": "Unknown",
-    "file": "rails/Gemfile.lock",
-    "url": "https://github.com/sparklemotion/nokogiri/issues/1673",
-    "tool": "gemnasium"
-  },
-  {
-    "category": "dependency_scanning",
-    "name": "ffi - CVE-2018-1000201",
-    "message": "ruby-ffi DDL loading issue on Windows OS",
-    "cve": "ffi:1.9.18:CVE-2018-1000201",
-    "severity": "High",
-    "solution": "upgrade to \u003e= 1.9.24",
-    "scanner": {
-      "id": "bundler_audit",
-      "name": "bundler-audit"
-    },
-    "location": {
+      "location": {
+        "file": "sast-sample-rails/Gemfile.lock",
+        "dependency": {
+          "package": {
+            "name": "ffi"
+          },
+          "version": "1.9.18"
+        }
+      },
+      "identifiers": [
+        {
+          "type": "cve",
+          "name": "CVE-2018-1000201",
+          "value": "CVE-2018-1000201",
+          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-1000201"
+        }
+      ],
+      "links": [
+        {
+          "url": "https://github.com/ffi/ffi/releases/tag/1.9.24"
+        }
+      ],
+      "priority": "High",
       "file": "sast-sample-rails/Gemfile.lock",
-      "dependency": {
-        "package": {
-          "name": "ffi"
-        },
-        "version": "1.9.18"
-      }
-    },
-    "identifiers": [
-      {
-        "type": "cve",
-        "name": "CVE-2018-1000201",
-        "value": "CVE-2018-1000201",
-        "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-1000201"
-      }
-    ],
-    "links": [
-      {
-        "url": "https://github.com/ffi/ffi/releases/tag/1.9.24"
-      }
-    ],
-    "priority": "High",
-    "file": "sast-sample-rails/Gemfile.lock",
-    "url": "https://github.com/ffi/ffi/releases/tag/1.9.24",
-    "tool": "bundler_audit"
-  }
-]
+      "url": "https://github.com/ffi/ffi/releases/tag/1.9.24",
+      "tool": "bundler_audit"
+    }
+  ]
+}

spec/fixtures/security-reports/feature-branch/gl-license-management-report.json

 {
     "licenses": [
         {
-            "count": 13,
-            "name": "MIT"
-        },
-        {
-            "count": 2,
-            "name": "New BSD"
+            "count": 1,
+            "name": "WTFPL"
         },
         {
             "count": 1,
-            "name": "LGPL"
+            "name": "MIT"
         }
     ],
     "dependencies": [
@@ -20,107 +16,9 @@
                 "url": "http://opensource.org/licenses/mit-license"
             },
             "dependency": {
-                "name": "bundler",
-                "url": "http://bundler.io",
-                "description": "The best way to manage your application's dependencies",
-                "pathes": [
-                    "."
-                ]
-            }
-        },
-        {
-            "license": {
-                "name": "MIT",
-                "url": "http://opensource.org/licenses/mit-license"
-            },
-            "dependency": {
-                "name": "concurrent-ruby",
-                "url": "http://www.concurrent-ruby.com",
-                "description": "Modern concurrency tools for Ruby. Inspired by Erlang, Clojure, Scala, Haskell, F#, C#, Java, and classic concurrency patterns.",
-                "pathes": [
-                    "."
-                ]
-            }
-        },
-        {
-            "license": {
-                "name": "MIT",
-                "url": "http://opensource.org/licenses/mit-license"
-            },
-            "dependency": {
-                "name": "connection_pool",
-                "url": "https://github.com/mperham/connection_pool",
-                "description": "Generic connection pool for Ruby",
-                "pathes": [
-                    "."
-                ]
-            }
-        },
-        {
-            "license": {
-                "name": "MIT",
-                "url": "http://opensource.org/licenses/mit-license"
-            },
-            "dependency": {
-                "name": "mini_portile2",
-                "url": "http://github.com/flavorjones/mini_portile",
-                "description": "Simplistic port-like solution for developers",
-                "pathes": [
-                    "."
-                ]
-            }
-        },
-        {
-            "license": {
-                "name": "MIT",
-                "url": "http://opensource.org/licenses/mit-license"
-            },
-            "dependency": {
-                "name": "mustermann",
-                "url": "https://github.com/sinatra/mustermann",
-                "description": "Your personal string matching expert.",
-                "pathes": [
-                    "."
-                ]
-            }
-        },
-        {
-            "license": {
-                "name": "MIT",
-                "url": "http://opensource.org/licenses/mit-license"
-            },
-            "dependency": {
-                "name": "nokogiri",
-                "url": "http://nokogiri.org",
-                "description": "Nokogiri (鋸) is an HTML, XML, SAX, and Reader parser",
-                "pathes": [
-                    "."
-                ]
-            }
-        },
-        {
-            "license": {
-                "name": "New BSD",
-                "url": "http://opensource.org/licenses/BSD-3-Clause"
-            },
-            "dependency": {
-                "name": "pg",
-                "url": "https://bitbucket.org/ged/ruby-pg",
-                "description": "Pg is the Ruby interface to the {PostgreSQL RDBMS}[http://www.postgresql.org/]",
-                "pathes": [
-                    "."
-                ]
-            }
-        },
-        {
-            "license": {
-                "name": "New BSD",
-                "url": "http://opensource.org/licenses/BSD-3-Clause"
-            },
-            "dependency": {
-                "name": "puma",
-                "url": "http://puma.io",
-                "description": "Puma is a simple, fast, threaded, and highly concurrent HTTP 1.1 server for Ruby/Rack applications",
+                "name": "actioncable",
+                "url": "http://rubyonrails.org",
+                "description": "WebSocket framework for Rails.",
                 "pathes": [
                     "."
                 ]
@@ -128,111 +26,13 @@
         },
         {
             "license": {
-                "name": "MIT",
-                "url": "http://opensource.org/licenses/mit-license"
-            },
-            "dependency": {
-                "name": "rack",
-                "url": "https://rack.github.io/",
-                "description": "a modular Ruby webserver interface",
-                "pathes": [
-                    "."
-                ]
-            }
-        },
-        {
-            "license": {
-                "name": "MIT",
-                "url": "http://opensource.org/licenses/mit-license"
-            },
-            "dependency": {
-                "name": "rack-protection",
-                "url": "http://github.com/sinatra/sinatra/tree/master/rack-protection",
-                "description": "Protect against typical web attacks, works with all Rack apps, including Rails.",
-                "pathes": [
-                    "."
-                ]
-            }
-        },
-        {
-            "license": {
-                "name": "MIT",
-                "url": "http://opensource.org/licenses/mit-license"
-            },
-            "dependency": {
-                "name": "redis",
-                "url": "https://github.com/redis/redis-rb",
-                "description": "A Ruby client library for Redis",
-                "pathes": [
-                    "."
-                ]
-            }
-        },
-        {
-            "license": {
-                "name": "LGPL",
-                "url": "http://www.gnu.org/licenses/lgpl.txt"
-            },
-            "dependency": {
-                "name": "sidekiq",
-                "url": "http://sidekiq.org",
-                "description": "Simple, efficient background processing for Ruby",
-                "pathes": [
-                    "."
-                ]
-            }
-        },
-        {
-            "license": {
-                "name": "MIT",
-                "url": "http://opensource.org/licenses/mit-license"
-            },
-            "dependency": {
-                "name": "sinatra",
-                "url": "http://www.sinatrarb.com/",
-                "description": "Classy web-development dressed in a DSL",
-                "pathes": [
-                    "."
-                ]
-            }
-        },
-        {
-            "license": {
-                "name": "MIT",
-                "url": "http://opensource.org/licenses/mit-license"
-            },
-            "dependency": {
-                "name": "slim",
-                "url": "http://slim-lang.com/",
-                "description": "Slim is a template language.",
-                "pathes": [
-                    "."
-                ]
-            }
-        },
-        {
-            "license": {
-                "name": "MIT",
-                "url": "http://opensource.org/licenses/mit-license"
-            },
-            "dependency": {
-                "name": "temple",
-                "url": "https://github.com/judofyr/temple",
-                "description": "Template compilation framework in Ruby",
-                "pathes": [
-                    "."
-                ]
-            }
-        },
-        {
-            "license": {
-                "name": "MIT",
-                "url": "http://opensource.org/licenses/mit-license"
+                "name": "WTFPL",
+                "url": "http://www.wtfpl.net/"
             },
             "dependency": {
-                "name": "tilt",
-                "url": "http://github.com/rtomayko/tilt/",
-                "description": "Generic interface to multiple Ruby template engines",
+                "name": "wtfpl_init",
+                "url": "https://rubygems.org/gems/wtfpl_init",
+                "description": "Download WTFPL license file and rename to LICENSE.md or something",
                 "pathes": [
                     "."
                 ]

spec/fixtures/security-reports/master/gl-dependency-scanning-report.json

-[
-  {
-    "category": "dependency_scanning",
-    "name": "io.netty/netty - CVE-2014-3488",
-    "message": "DoS by CPU exhaustion when using malicious SSL packets",
-    "cve": "app/pom.xml:io.netty/netty@3.9.1.Final:CVE-2014-3488",
-    "severity": "Unknown",
-    "solution": "Upgrade to the latest version",
-    "scanner": {
-      "id": "gemnasium",
-      "name": "Gemnasium"
-    },
-    "location": {
-      "file": "app/pom.xml",
-      "dependency": {
-        "package": {
-          "name": "io.netty/netty"
+{
+  "version": "1.3",
+  "vulnerabilities": [
+    {
+      "category": "dependency_scanning",
+      "name": "io.netty/netty - CVE-2014-3488",
+      "message": "DoS by CPU exhaustion when using malicious SSL packets",
+      "cve": "app/pom.xml:io.netty/netty@3.9.1.Final:CVE-2014-3488",
+      "severity": "Unknown",
+      "solution": "Upgrade to the latest version",
+      "scanner": {
+        "id": "gemnasium",
+        "name": "Gemnasium"
+      },
+      "location": {
+        "file": "app/pom.xml",
+        "dependency": {
+          "package": {
+            "name": "io.netty/netty"
+          },
+          "version": "3.9.1.Final"
+        }
+      },
+      "identifiers": [
+        {
+          "type": "gemnasium",
+          "name": "Gemnasium-d1bf36d9-9f07-46cd-9cfc-8675338ada8f",
+          "value": "d1bf36d9-9f07-46cd-9cfc-8675338ada8f",
+          "url": "https://deps.sec.gitlab.com/packages/maven/io.netty/netty/versions/3.9.1.Final/advisories"
+        },
+        {
+          "type": "cve",
+          "name": "CVE-2014-3488",
+          "value": "CVE-2014-3488",
+          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3488"
+        }
+      ],
+      "links": [
+        {
+          "url": "https://bugzilla.redhat.com/CVE-2014-3488"
         },
-        "version": "3.9.1.Final"
-      }
+        {
+          "url": "http://netty.io/news/2014/06/11/3.html"
+        },
+        {
+          "url": "https://github.com/netty/netty/issues/2562"
+        }
+      ],
+      "priority": "Unknown",
+      "file": "app/pom.xml",
+      "url": "https://bugzilla.redhat.com/CVE-2014-3488",
+      "tool": "gemnasium"
     },
-    "identifiers": [
-      {
-        "type": "gemnasium",
-        "name": "Gemnasium-d1bf36d9-9f07-46cd-9cfc-8675338ada8f",
-        "value": "d1bf36d9-9f07-46cd-9cfc-8675338ada8f",
-        "url": "https://deps.sec.gitlab.com/packages/maven/io.netty/netty/versions/3.9.1.Final/advisories"
-      },
-      {
-        "type": "cve",
-        "name": "CVE-2014-3488",
-        "value": "CVE-2014-3488",
-        "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3488"
-      }
-    ],
-    "links": [
-      {
-        "url": "https://bugzilla.redhat.com/CVE-2014-3488"
+    {
+      "category": "dependency_scanning",
+      "name": "Django - CVE-2017-12794",
+      "message": "Possible XSS in traceback section of technical 500 debug page",
+      "cve": "app/requirements.txt:Django@1.11.3:CVE-2017-12794",
+      "severity": "Unknown",
+      "solution": "Upgrade to latest version or apply patch.",
+      "scanner": {
+        "id": "gemnasium",
+        "name": "Gemnasium"
       },
-      {
-        "url": "http://netty.io/news/2014/06/11/3.html"
+      "location": {
+        "file": "app/requirements.txt",
+        "dependency": {
+          "package": {
+            "name": "Django"
+          },
+          "version": "1.11.3"
+        }
       },
-      {
-        "url": "https://github.com/netty/netty/issues/2562"
-      }
-    ],
-    "priority": "Unknown",
-    "file": "app/pom.xml",
-    "url": "https://bugzilla.redhat.com/CVE-2014-3488",
-    "tool": "gemnasium"
-  },
-  {
-    "category": "dependency_scanning",
-    "name": "Django - CVE-2017-12794",
-    "message": "Possible XSS in traceback section of technical 500 debug page",
-    "cve": "app/requirements.txt:Django@1.11.3:CVE-2017-12794",
-    "severity": "Unknown",
-    "solution": "Upgrade to latest version or apply patch.",
-    "scanner": {
-      "id": "gemnasium",
-      "name": "Gemnasium"
-    },
-    "location": {
-      "file": "app/requirements.txt",
-      "dependency": {
-        "package": {
-          "name": "Django"
+      "identifiers": [
+        {
+          "type": "gemnasium",
+          "name": "Gemnasium-6162a015-8635-4a15-8d7c-dc9321db366f",
+          "value": "6162a015-8635-4a15-8d7c-dc9321db366f",
+          "url": "https://deps.sec.gitlab.com/packages/pypi/Django/versions/1.11.3/advisories"
         },
-        "version": "1.11.3"
-      }
+        {
+          "type": "cve",
+          "name": "CVE-2017-12794",
+          "value": "CVE-2017-12794",
+          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-12794"
+        }
+      ],
+      "links": [
+        {
+          "url": "https://www.djangoproject.com/weblog/2017/sep/05/security-releases/"
+        }
+      ],
+      "priority": "Unknown",
+      "file": "app/requirements.txt",
+      "url": "https://www.djangoproject.com/weblog/2017/sep/05/security-releases/",
+      "tool": "gemnasium"
     },
-    "identifiers": [
-      {
-        "type": "gemnasium",
-        "name": "Gemnasium-6162a015-8635-4a15-8d7c-dc9321db366f",
-        "value": "6162a015-8635-4a15-8d7c-dc9321db366f",
-        "url": "https://deps.sec.gitlab.com/packages/pypi/Django/versions/1.11.3/advisories"
+    {
+      "category": "dependency_scanning",
+      "name": "nokogiri - USN-3424-1",
+      "message": "Vulnerabilities in libxml2",
+      "cve": "rails/Gemfile.lock:nokogiri@1.8.0:USN-3424-1",
+      "severity": "Unknown",
+      "solution": "Upgrade to latest version.",
+      "scanner": {
+        "id": "gemnasium",
+        "name": "Gemnasium"
       },
-      {
-        "type": "cve",
-        "name": "CVE-2017-12794",
-        "value": "CVE-2017-12794",
-        "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-12794"
-      }
-    ],
-    "links": [
-      {
-        "url": "https://www.djangoproject.com/weblog/2017/sep/05/security-releases/"
-      }
-    ],
-    "priority": "Unknown",
-    "file": "app/requirements.txt",
-    "url": "https://www.djangoproject.com/weblog/2017/sep/05/security-releases/",
-    "tool": "gemnasium"
-  },
-  {
-    "category": "dependency_scanning",
-    "name": "nokogiri - USN-3424-1",
-    "message": "Vulnerabilities in libxml2",
-    "cve": "rails/Gemfile.lock:nokogiri@1.8.0:USN-3424-1",
-    "severity": "Unknown",
-    "solution": "Upgrade to latest version.",
-    "scanner": {
-      "id": "gemnasium",
-      "name": "Gemnasium"
-    },
-    "location": {
-      "file": "rails/Gemfile.lock",
-      "dependency": {
-        "package": {
-          "name": "nokogiri"
+      "location": {
+        "file": "rails/Gemfile.lock",
+        "dependency": {
+          "package": {
+            "name": "nokogiri"
+          },
+          "version": "1.8.0"
+        }
+      },
+      "identifiers": [
+        {
+          "type": "gemnasium",
+          "name": "Gemnasium-06565b64-486d-4326-b906-890d9915804d",
+          "value": "06565b64-486d-4326-b906-890d9915804d",
+          "url": "https://deps.sec.gitlab.com/packages/gem/nokogiri/versions/1.8.0/advisories"
         },
-        "version": "1.8.0"
-      }
+        {
+          "type": "usn",
+          "name": "USN-3424-1",
+          "value": "USN-3424-1",
+          "url": "https://usn.ubuntu.com/3424-1/"
+        }
+      ],
+      "links": [
+        {
+          "url": "https://github.com/sparklemotion/nokogiri/issues/1673"
+        }
+      ],
+      "priority": "Unknown",
+      "file": "rails/Gemfile.lock",
+      "url": "https://github.com/sparklemotion/nokogiri/issues/1673",
+      "tool": "gemnasium"
     },
-    "identifiers": [
-      {
-        "type": "gemnasium",
-        "name": "Gemnasium-06565b64-486d-4326-b906-890d9915804d",
-        "value": "06565b64-486d-4326-b906-890d9915804d",
-        "url": "https://deps.sec.gitlab.com/packages/gem/nokogiri/versions/1.8.0/advisories"
+    {
+      "category": "dependency_scanning",
+      "name": "ffi - CVE-2018-1000201",
+      "message": "ruby-ffi DDL loading issue on Windows OS",
+      "cve": "ffi:1.9.18:CVE-2018-1000201",
+      "severity": "High",
+      "solution": "upgrade to \u003e= 1.9.24",
+      "scanner": {
+        "id": "bundler_audit",
+        "name": "bundler-audit"
       },
-      {
-        "type": "usn",
-        "name": "USN-3424-1",
-        "value": "USN-3424-1",
-        "url": "https://usn.ubuntu.com/3424-1/"
-      }
-    ],
-    "links": [
-      {
-        "url": "https://github.com/sparklemotion/nokogiri/issues/1673"
-      }
-    ],
-    "priority": "Unknown",
-    "file": "rails/Gemfile.lock",
-    "url": "https://github.com/sparklemotion/nokogiri/issues/1673",
-    "tool": "gemnasium"
-  },
-  {
-    "category": "dependency_scanning",
-    "name": "ffi - CVE-2018-1000201",
-    "message": "ruby-ffi DDL loading issue on Windows OS",
-    "cve": "ffi:1.9.18:CVE-2018-1000201",
-    "severity": "High",
-    "solution": "upgrade to \u003e= 1.9.24",
-    "scanner": {
-      "id": "bundler_audit",
-      "name": "bundler-audit"
-    },
-    "location": {
+      "location": {
+        "file": "sast-sample-rails/Gemfile.lock",
+        "dependency": {
+          "package": {
+            "name": "ffi"
+          },
+          "version": "1.9.18"
+        }
+      },
+      "identifiers": [
+        {
+          "type": "cve",
+          "name": "CVE-2018-1000201",
+          "value": "CVE-2018-1000201",
+          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-1000201"
+        }
+      ],
+      "links": [
+        {
+          "url": "https://github.com/ffi/ffi/releases/tag/1.9.24"
+        }
+      ],
+      "priority": "High",
       "file": "sast-sample-rails/Gemfile.lock",
-      "dependency": {
-        "package": {
-          "name": "ffi"
-        },
-        "version": "1.9.18"
-      }
-    },
-    "identifiers": [
-      {
-        "type": "cve",
-        "name": "CVE-2018-1000201",
-        "value": "CVE-2018-1000201",
-        "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-1000201"
-      }
-    ],
-    "links": [
-      {
-        "url": "https://github.com/ffi/ffi/releases/tag/1.9.24"
-      }
-    ],
-    "priority": "High",
-    "file": "sast-sample-rails/Gemfile.lock",
-    "url": "https://github.com/ffi/ffi/releases/tag/1.9.24",
-    "tool": "bundler_audit"
-  }
-]
+      "url": "https://github.com/ffi/ffi/releases/tag/1.9.24",
+      "tool": "bundler_audit"
+    }
+  ]
+}