Skip to content

Allow empty statements list in schema #64

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
TimCares wants to merge 2 commits into
base: main
Choose a base branch
from
Open

Allow empty statements list in schema #64

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
77567a2
fix(schema): list of statements can be empty
TimCares Jun 19, 2026
4279884
docs(schema): adjusted documentation based on schema change
TimCares Jun 19, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
11 changes: 8 additions & 3 deletions OPENVEX-SPEC.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -35,7 +35,7 @@ structures (see [Inheritance Flow](#inheritance-flow)).

## VEX Documents

A VEX document is a data structure grouping one or more VEX statements.
A VEX document is a data structure grouping zero or more VEX statements.
Documents also have timestamps, which may cascade down to statements (see
[Inheritance Flow](#inheritance-flow)). Documents can also be versioned.

Expand Down Expand Up @@ -74,7 +74,7 @@ described in [RFC2119].

#### Document

A data structure that groups together one or more VEX statements. A document
A data structure that groups together zero or more VEX statements. A document
MUST define a timestamp to express when it was issued.

#### Encapsulating Document
Expand Down Expand Up @@ -119,6 +119,11 @@ product's dependencies.
A VEX document consists of two parts: The document metadata and a collection
of statements. Some fields in the document metadata are required.

__Note:__ A document with an empty `statements` array is valid when all required
metadata fields (`@context`, `@id`, `author`, `timestamp`, `version`) are present.
An empty `statements` list indicates that the author is not asserting any
vulnerability impact at the time the document was issued.

OpenVEX documents are serialized in json-ld structs. File encoding MUST be UTF8.

Here is a sample of a minimal OpenVEX document:
Expand Down Expand Up @@ -161,7 +166,7 @@ The following table lists the fields in the document struct
| last_updated | ✕ | Date of last modification to the document. |
| version | ✓ | Version is the document version. It must be incremented when any content within the VEX document changes, including any VEX statements included within the VEX document. |
| tooling | ✕ | Tooling expresses how the VEX document and contained VEX statements were generated. It may specify tools or automated processes used in the document or statement generation. |
| statements | ✓ | The list of statements to contain within the document. |
| statements | ✓ | The list of statements contained in the document. May be empty. |

### Statement

Expand Down
2 changes: 1 addition & 1 deletion openvex_json_schema.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -196,7 +196,7 @@
"statements": {
"type": "array",
"uniqueItems": true,
"minItems": 1,
"minItems": 0,
"description": "A statement is an assertion made by the document's author about the impact a vulnerability has on one or more software 'products'.",
"items": {
"type": "object",
Expand Down