Ground-Truth Dataset for SCA Tool Evaluation

Ground-truth vulnerability dataset for benchmarking Software Composition Analysis (SCA) tools. Derived from the Open Source Vulnerabilities database (OSV), the dataset resolves advisories to explicit (ecosystem, component, version, vulnerability-id) tuples across four package ecosystems: Maven, npm, NuGet, and PyPI. It comprises 1,000 OSV entries (250 per ecosystem) covering 430 distinct components and 924 CVE-backed findings (189 distinct CVEs). The dataset was used to evaluate five SCA tools — OWASP Dependency-Track, Snyk, Sonatype OSS Index, GitHub Advisory Database, and Trivy — on recall and overlap metrics. Sampling is reproducible via a fixed random seed; the accompanying evaluation framework is archived separately.