JQ Sorting by value

I am looking to sort an array in JQ by a custom map of values and struggling to figure it out. Hoping someone here can point out a way to do this.

I have an array of objects that describe software vulnerabilities and want to sort the objects in order by Severity value: CRITICAL, HIGH, MEDIUM, LOW

The array looks like this:

{
  "vulnerabilities": [
    {
      "CVEID": "CVE-2022-29458",
      "Product": "ncurses-base",
      "Severity": "MEDIUM",
      "Version": "6.3-2",
      "Description": "example"
    },
    {
      "CVEID": "CVE-2022-29458",
      "Product": "ncurses-base",
      "Severity": "HIGH",
      "Version": "6.3-2",
      "Description": "example"
    },
    {
      "CVEID": "CVE-2022-29458",
      "Product": "ncurses-base",
      "Severity": "CRITICAL",
      "Version": "6.3-2",
      "Description": "example"
    },
    {
      "CVEID": "CVE-2022-29458",
      "Product": "ncurses-base",
      "Severity": "LOW",
      "Version": "6.3-2",
      "Description": "example"
    }
  ]
}

Is there an easy-ish way to do this with JQ?

Thank you!

I have tried using the sort_by() function in JQ but can't seem to figure out how to apply a custom order (not looking to organize alphabetically)

You could create a stream of booleans, and sort by that. (Use != for the same order, == for reversed order.)

.vulnerabilities |= sort_by(.Severity != ("CRITICAL","HIGH","MEDIUM","LOW"))

{
  "vulnerabilities": [
    {
      "CVEID": "CVE-2022-29458",
      "Product": "ncurses-base",
      "Severity": "CRITICAL",
      "Version": "6.3-2",
      "Description": "example"
    },
    {
      "CVEID": "CVE-2022-29458",
      "Product": "ncurses-base",
      "Severity": "HIGH",
      "Version": "6.3-2",
      "Description": "example"
    },
    {
      "CVEID": "CVE-2022-29458",
      "Product": "ncurses-base",
      "Severity": "MEDIUM",
      "Version": "6.3-2",
      "Description": "example"
    },
    {
      "CVEID": "CVE-2022-29458",
      "Product": "ncurses-base",
      "Severity": "LOW",
      "Version": "6.3-2",
      "Description": "example"
    }
  ]
}

Demo

Create a map from strings to numbers; look up the strings and sort by the resulting numbers.

{ "CRITICAL": 0, "HIGH": 1, "MEDIUM": 2, "LOW": 3} as $priority_orders |
.vulnerabilities | sort_by($priority_orders[.Severity])

...properly returns, given your input data:

[
  {
    "CVEID": "CVE-2022-29458",
    "Product": "ncurses-base",
    "Severity": "CRITICAL",
    "Version": "6.3-2",
    "Description": "example"
  },
  {
    "CVEID": "CVE-2022-29458",
    "Product": "ncurses-base",
    "Severity": "HIGH",
    "Version": "6.3-2",
    "Description": "example"
  },
  {
    "CVEID": "CVE-2022-29458",
    "Product": "ncurses-base",
    "Severity": "MEDIUM",
    "Version": "6.3-2",
    "Description": "example"
  },
  {
    "CVEID": "CVE-2022-29458",
    "Product": "ncurses-base",
    "Severity": "LOW",
    "Version": "6.3-2",
    "Description": "example"
  }
]

(You might want to instead sort by a list or tuple, such as [$priority_orders[.Severity], .Product, .Version], to come up with data that's usefully ordered when there's more than one thing at each severity level; consider it left as an exercise to the reader).