clj-holmes / clj-watson

clojure deps SCA
Eclipse Public License 2.0
83 stars 9 forks source link

`--output json` renders as escaped string #116

Closed lread closed 2 months ago

lread commented 2 months ago

Currently

When I run

clojure -Tclj-watson scan :p deps.edn :o json

For the JSON output, I get:

...
"[{\"dependency\":\"org.codehaus.plexus/plexus-component-annotations\",\"dependents\":[\"org.apache.maven/maven-core\"],\"exclusions\":[\"junit/junit\"],\"paths\":[\"/home/lee/.m2/repository/org/codehaus/plexus/plexus-component-annotations/2.1.0/plexus-component-annotations-2.1.0.jar\"],\"secure-version\":null,\"deps/manifest\":\"mvn\",\"mvn/version\":\"2.1.0\",\"parents\":[[\"org.clojure/tools.deps\",\"org.apache.maven/maven-core\"]],\"vulnerabilities\":[{\"advisory\":{\"identifiers\":[{\"value\":\"CVE-2022-4244\"}],\"cvss\":{\"score\":7.5},\"severity\"...

I Expect...

That this would not be terribly useful to folks expecting JSON output.

So...

Since we emit pretty-printed edn, I think we should probably do the same for JSON.

Next Steps

I'll follow up sometime soon with a PR.