How to Fix “Invalid JSON” in Android Lint SARIF Output

Android Lint can successfully write a SARIF report only for a CI service, SARIF viewer, or JSON parser to reject it as Invalid JSON. Google tracked a defect in which SarifReporter emitted malformed JSON when a LintFix ended with an alternative that produced no edits. The issue is #546124524 and the verified fix is included in Android Gradle Plugin 9.5.0-alpha02.

Representative error

Invalid JSON
Unexpected token ... in JSON at position ...
Failed to parse SARIF file: lint-results.sarif

The exact wording depends on the consumer, such as GitHub Code Scanning, Azure DevOps, a SARIF viewer, or jq. The important signature is that Lint has produced a .sarif file, but the consumer cannot parse that file as JSON.

Cause

In the affected AGP/Lint implementation, SarifReporter can generate syntactically invalid JSON when a built-in or custom lint check returns several fixes through fix().alternatives(...) and the final alternative produces no edits. This is a report-generation defect, not malformed JSON in your application or an API response.

Conditions and affected setups

• Android Lint is configured to generate SARIF.
• A lint fix contains alternatives and its final alternative produces no edit.
• A CI job or external tool parses the resulting .sarif as JSON.
• The build uses an AGP/Lint implementation from before the verified fix.

Recommended solution

1. Validate the generated report

./gradlew lint
jq empty app/build/reports/lint-results-*.sarif

If JSON validation fails while Lint’s HTML or XML report is valid, the result is consistent with this known SARIF defect. Adjust the report path for your project.

2. Upgrade to AGP 9.5.0-alpha02 or later

plugins {
    id("com.android.application") version "9.5.0-alpha02" apply false
}

If AGP is managed in a version catalog or convention plugin, update the actual source of the version. Because this verified fix first appeared in a preview release, confirm that using preview tooling fits your team’s release policy.

3. Align Gradle and the JDK

Use the Gradle and JDK versions required by the selected AGP release, and keep local development and CI on the same toolchain.

./gradlew --version
./gradlew --stop
./gradlew clean lint

Alternatives when you cannot upgrade

• Temporarily pin the last AGP/Lint combination that generated valid SARIF in your project.
• If you own the custom lint rule, avoid returning an edit-free final alternative, after testing that the rule’s intended quick fixes remain intact.
• Use HTML or XML output temporarily to keep CI reporting available. This disables SARIF-based code-scanning integration and is not a permanent fix.

How to verify the fix

1. Run Lint in a clean local checkout and in CI.
2. Validate the generated SARIF with jq empty or another strict JSON parser.
3. Upload it to the same SARIF viewer or code-scanning service that previously failed.
4. Confirm that issue counts, locations, and offered fixes are still present.

Cautions

Invalid JSON is generic. A truncated artifact, a different malformed configuration file, or post-processing that rewrites the report has a different cause. Confirm the failing path is the SARIF file produced by Android Lint. Avoid manually repairing the file in CI because that makes the build harder to reproduce; correct the generator instead.

Summary

When Android Lint SARIF fails with Invalid JSON, check whether the report contains a fix whose final alternative produces no edits. That matches Google Issue #546124524. Upgrade to AGP 9.5.0-alpha02 or later, regenerate the report, validate it as JSON, and retry the original SARIF upload.

Official references

• Google Issue Tracker #546124524
• Android Studio Rabbit 1 Closed Issues
• Android Studio Rabbit 1 Canary 2
• Android Developers: Improve your code with lint checks