diff --git a/src/Core/Serialization/JSON/Normalizers/BomNormalizer.php b/src/Core/Serialization/JSON/Normalizers/BomNormalizer.php
index 9324d1a1..9c364536 100644
--- a/src/Core/Serialization/JSON/Normalizers/BomNormalizer.php
+++ b/src/Core/Serialization/JSON/Normalizers/BomNormalizer.php
@@ -37,11 +37,11 @@ class BomNormalizer extends _BaseNormalizer
 
     private const BOM_FORMAT = 'CycloneDX';
 
-    public function normalize(Bom $bom): array
+    public function normalize(Bom $bom): object
     {
         $factory = $this->getNormalizerFactory();
 
-        return array_filter(
+        return (object) array_filter(
             [
                 'bomFormat' => self::BOM_FORMAT,
                 'specVersion' => $factory->getSpec()->getVersion(),
@@ -55,7 +55,7 @@ public function normalize(Bom $bom): array
         );
     }
 
-    private function normalizeMetadata(Metadata $metadata): ?array
+    private function normalizeMetadata(Metadata $metadata): ?object
     {
         $factory = $this->getNormalizerFactory();
 
@@ -63,11 +63,7 @@ private function normalizeMetadata(Metadata $metadata): ?array
             return null;
         }
 
-        $data = $factory->makeForMetadata()->normalize($metadata);
-
-        return empty($data)
-            ? null
-            : $data;
+        return $factory->makeForMetadata()->normalize($metadata);
     }
 
     private function normalizeExternalReferences(Bom $bom): ?array
diff --git a/src/Core/Serialization/JSON/Normalizers/ComponentNormalizer.php b/src/Core/Serialization/JSON/Normalizers/ComponentNormalizer.php
index 462ab3c1..131ebdd3 100644
--- a/src/Core/Serialization/JSON/Normalizers/ComponentNormalizer.php
+++ b/src/Core/Serialization/JSON/Normalizers/ComponentNormalizer.php
@@ -42,7 +42,7 @@ class ComponentNormalizer extends _BaseNormalizer
     /**
      * @throws DomainException if component has unsupported type
      */
-    public function normalize(Component $component): array
+    public function normalize(Component $component): object
     {
         $spec = $this->getNormalizerFactory()->getSpec();
 
@@ -63,7 +63,7 @@ public function normalize(Component $component): array
             ? $component->getBomRef()->getValue()
             : null;
 
-        return array_filter(
+        return (object) array_filter(
             [
                 'bom-ref' => $bomRef,
                 'type' => $type,
diff --git a/src/Core/Serialization/JSON/Normalizers/ComponentRepositoryNormalizer.php b/src/Core/Serialization/JSON/Normalizers/ComponentRepositoryNormalizer.php
index 8c585a45..109a4573 100644
--- a/src/Core/Serialization/JSON/Normalizers/ComponentRepositoryNormalizer.php
+++ b/src/Core/Serialization/JSON/Normalizers/ComponentRepositoryNormalizer.php
@@ -32,7 +32,9 @@
 class ComponentRepositoryNormalizer extends _BaseNormalizer
 {
     /**
-     * @psalm-return list<mixed>
+     * @return object[]
+     *
+     * @psalm-return list<object>
      */
     public function normalize(ComponentRepository $repo): array
     {
diff --git a/src/Core/Serialization/JSON/Normalizers/DependenciesNormalizer.php b/src/Core/Serialization/JSON/Normalizers/DependenciesNormalizer.php
index 49551a0a..024f1a25 100644
--- a/src/Core/Serialization/JSON/Normalizers/DependenciesNormalizer.php
+++ b/src/Core/Serialization/JSON/Normalizers/DependenciesNormalizer.php
@@ -29,9 +29,6 @@
 use CycloneDX\Core\Models\Component;
 use CycloneDX\Core\Serialization\JSON\_BaseNormalizer;
 
-/**
- * @psalm-type Dependency = array{ref: string, dependsOn?: non-empty-list<string>}
- */
 class DependenciesNormalizer extends _BaseNormalizer
 {
     use NullAssertionTrait;
@@ -40,9 +37,9 @@ class DependenciesNormalizer extends _BaseNormalizer
      * Only named {@see \CycloneDX\Core\Models\BomRef BomRefs} will be taken into account.
      * Make sure to use the {@see \CycloneDX\Core\Serialization\BomRefDiscriminator} before calling.
      *
-     * @return array[]
+     * @return object[]
      *
-     * @psalm-return list<Dependency>
+     * @psalm-return list<object>
      */
     public function normalize(Bom $bom): array
     {
@@ -73,17 +70,15 @@ public function normalize(Bom $bom): array
         return $dependencies;
     }
 
-    /**
-     * @psalm-return Dependency|null
-     */
-    private function normalizeDependency(BomRef $componentRef, BomRef ...$dependencyRefs): ?array
+    private function normalizeDependency(BomRef $componentRef, BomRef ...$dependencyRefs): ?object
     {
         $componentRefValue = $componentRef->getValue();
         if (null === $componentRefValue) {
             return null;
         }
 
-        $dep = ['ref' => $componentRefValue];
+        $dep = (object) [];
+        $dep->ref = $componentRefValue;
 
         $deps = [];
         foreach ($dependencyRefs as $dependencyRef) {
@@ -93,7 +88,7 @@ private function normalizeDependency(BomRef $componentRef, BomRef ...$dependency
             }
         }
         if (!empty($deps)) {
-            $dep['dependsOn'] = $deps;
+            $dep->dependsOn = $deps;
         }
 
         return $dep;
diff --git a/src/Core/Serialization/JSON/Normalizers/ExternalReferenceNormalizer.php b/src/Core/Serialization/JSON/Normalizers/ExternalReferenceNormalizer.php
index 5dab9e91..55283e5c 100644
--- a/src/Core/Serialization/JSON/Normalizers/ExternalReferenceNormalizer.php
+++ b/src/Core/Serialization/JSON/Normalizers/ExternalReferenceNormalizer.php
@@ -45,7 +45,7 @@ class ExternalReferenceNormalizer extends _BaseNormalizer
      *
      * @SuppressWarnings(PHPMD.StaticAccess)
      */
-    public function normalize(ExternalReference $externalReference): array
+    public function normalize(ExternalReference $externalReference): object
     {
         $url = $externalReference->getUrl();
         if (false === IriFormats::iriReference($url)) {
@@ -62,7 +62,7 @@ public function normalize(ExternalReference $externalReference): array
             }
         }
 
-        return array_filter(
+        return (object) array_filter(
             [
                 'type' => $type,
                 'url' => $url,
diff --git a/src/Core/Serialization/JSON/Normalizers/ExternalReferenceRepositoryNormalizer.php b/src/Core/Serialization/JSON/Normalizers/ExternalReferenceRepositoryNormalizer.php
index 07ddafca..898e7ae4 100644
--- a/src/Core/Serialization/JSON/Normalizers/ExternalReferenceRepositoryNormalizer.php
+++ b/src/Core/Serialization/JSON/Normalizers/ExternalReferenceRepositoryNormalizer.php
@@ -34,9 +34,9 @@
 class ExternalReferenceRepositoryNormalizer extends _BaseNormalizer
 {
     /**
-     * @return array[]
+     * @return object[]
      *
-     * @psalm-return list<array>
+     * @psalm-return list<object>
      */
     public function normalize(ExternalReferenceRepository $repo): array
     {
@@ -45,12 +45,9 @@ public function normalize(ExternalReferenceRepository $repo): array
         $externalReferences = [];
         foreach ($repo->getItems() as $externalReference) {
             try {
-                $item = $normalizer->normalize($externalReference);
+                $externalReferences[] = $normalizer->normalize($externalReference);
             } catch (DomainException|UnexpectedValueException) {
-                continue;
-            }
-            if (false === empty($item)) {
-                $externalReferences[] = $item;
+                /* pass */
             }
         }
 
diff --git a/src/Core/Serialization/JSON/Normalizers/HashDictionaryNormalizer.php b/src/Core/Serialization/JSON/Normalizers/HashDictionaryNormalizer.php
index 3d8c99ab..126d5b3d 100644
--- a/src/Core/Serialization/JSON/Normalizers/HashDictionaryNormalizer.php
+++ b/src/Core/Serialization/JSON/Normalizers/HashDictionaryNormalizer.php
@@ -31,6 +31,11 @@
  */
 class HashDictionaryNormalizer extends _BaseNormalizer
 {
+    /**
+     * @return object[]
+     *
+     * @psalm-return list<object>
+     */
     public function normalize(HashDictionary $repo): array
     {
         $hashes = [];
diff --git a/src/Core/Serialization/JSON/Normalizers/HashNormalizer.php b/src/Core/Serialization/JSON/Normalizers/HashNormalizer.php
index 8e974f30..3e72cc85 100644
--- a/src/Core/Serialization/JSON/Normalizers/HashNormalizer.php
+++ b/src/Core/Serialization/JSON/Normalizers/HashNormalizer.php
@@ -34,7 +34,7 @@ class HashNormalizer extends _BaseNormalizer
     /**
      * @throws DomainException
      */
-    public function normalize(string $algorithm, string $content): array
+    public function normalize(string $algorithm, string $content): object
     {
         $spec = $this->getNormalizerFactory()->getSpec();
         if (false === $spec->isSupportedHashAlgorithm($algorithm)) {
@@ -44,7 +44,7 @@ public function normalize(string $algorithm, string $content): array
             throw new DomainException("Invalid hash content: $content", 2);
         }
 
-        return [
+        return (object) [
             'alg' => $algorithm,
             'content' => $content,
         ];
diff --git a/src/Core/Serialization/JSON/Normalizers/LicenseNormalizer.php b/src/Core/Serialization/JSON/Normalizers/LicenseNormalizer.php
index a3204dd9..eb1e72dc 100644
--- a/src/Core/Serialization/JSON/Normalizers/LicenseNormalizer.php
+++ b/src/Core/Serialization/JSON/Normalizers/LicenseNormalizer.php
@@ -37,33 +37,33 @@ class LicenseNormalizer extends _BaseNormalizer
 {
     use NullAssertionTrait;
 
-    public function normalize(LicenseExpression|DisjunctiveLicenseWithId|DisjunctiveLicenseWithName $license): array
+    public function normalize(LicenseExpression|DisjunctiveLicenseWithId|DisjunctiveLicenseWithName $license): object
     {
         return $license instanceof LicenseExpression
             ? $this->normalizeExpression($license)
             : $this->normalizeDisjunctive($license);
     }
 
-    private function normalizeExpression(LicenseExpression $license): array
+    private function normalizeExpression(LicenseExpression $license): object
     {
         // TODO: IMPLEMENTED IF NEEDED: may throw, if not supported by the spec
         // $this->getNormalizerFactory()->getSpec()->supportsLicenseExpression()
 
-        return ['expression' => $license->getExpression()];
+        return (object) ['expression' => $license->getExpression()];
     }
 
     /**
      * @SuppressWarnings(PHPMD.ShortVariable) $id
      * @SuppressWarnings(PHPMD.StaticAccess)
      */
-    private function normalizeDisjunctive(DisjunctiveLicenseWithId|DisjunctiveLicenseWithName $license): array
+    private function normalizeDisjunctive(DisjunctiveLicenseWithId|DisjunctiveLicenseWithName $license): object
     {
         [$id, $name] = $license instanceof DisjunctiveLicenseWithId
             ? [$license->getId(), null]
             : [null, $license->getName()];
         $url = $license->getUrl();
 
-        return ['license' => array_filter(
+        return (object) ['license' => (object) array_filter(
             [
                 'id' => $id,
                 'name' => $name,
diff --git a/src/Core/Serialization/JSON/Normalizers/LicenseRepositoryNormalizer.php b/src/Core/Serialization/JSON/Normalizers/LicenseRepositoryNormalizer.php
index acec54a6..2a8df4bd 100644
--- a/src/Core/Serialization/JSON/Normalizers/LicenseRepositoryNormalizer.php
+++ b/src/Core/Serialization/JSON/Normalizers/LicenseRepositoryNormalizer.php
@@ -31,6 +31,11 @@
  */
 class LicenseRepositoryNormalizer extends _BaseNormalizer
 {
+    /**
+     * @return object[]
+     *
+     * @psalm-return list<object>
+     */
     public function normalize(LicenseRepository $repo): array
     {
         return array_map(
diff --git a/src/Core/Serialization/JSON/Normalizers/MetadataNormalizer.php b/src/Core/Serialization/JSON/Normalizers/MetadataNormalizer.php
index 194cb755..abf66f3e 100644
--- a/src/Core/Serialization/JSON/Normalizers/MetadataNormalizer.php
+++ b/src/Core/Serialization/JSON/Normalizers/MetadataNormalizer.php
@@ -36,9 +36,9 @@ class MetadataNormalizer extends _BaseNormalizer
 {
     use NullAssertionTrait;
 
-    public function normalize(Metadata $metadata): array
+    public function normalize(Metadata $metadata): object
     {
-        return array_filter(
+        return (object) array_filter(
             [
                 // timestamp
                 'tools' => $this->normalizeTools($metadata->getTools()),
@@ -58,7 +58,7 @@ private function normalizeTools(ToolRepository $tools): ?array
             : $this->getNormalizerFactory()->makeForToolRepository()->normalize($tools);
     }
 
-    private function normalizeComponent(?Component $component): ?array
+    private function normalizeComponent(?Component $component): ?object
     {
         if (null === $component) {
             return null;
diff --git a/src/Core/Serialization/JSON/Normalizers/ToolNormalizer.php b/src/Core/Serialization/JSON/Normalizers/ToolNormalizer.php
index 550220cb..ecf66ebe 100644
--- a/src/Core/Serialization/JSON/Normalizers/ToolNormalizer.php
+++ b/src/Core/Serialization/JSON/Normalizers/ToolNormalizer.php
@@ -36,9 +36,9 @@ class ToolNormalizer extends _BaseNormalizer
 {
     use NullAssertionTrait;
 
-    public function normalize(Tool $tool): array
+    public function normalize(Tool $tool): object
     {
-        return array_filter(
+        return (object) array_filter(
             [
                 'vendor' => $tool->getVendor(),
                 'name' => $tool->getName(),
diff --git a/src/Core/Serialization/JSON/Normalizers/ToolRepositoryNormalizer.php b/src/Core/Serialization/JSON/Normalizers/ToolRepositoryNormalizer.php
index 9f413faf..e1b31958 100644
--- a/src/Core/Serialization/JSON/Normalizers/ToolRepositoryNormalizer.php
+++ b/src/Core/Serialization/JSON/Normalizers/ToolRepositoryNormalizer.php
@@ -32,9 +32,9 @@
 class ToolRepositoryNormalizer extends _BaseNormalizer
 {
     /**
-     * @return array[]
+     * @return object[]
      *
-     * @psalm-return list<array>
+     * @psalm-return list<object>
      */
     public function normalize(ToolRepository $repo): array
     {
@@ -43,12 +43,9 @@ public function normalize(ToolRepository $repo): array
         $tools = [];
         foreach ($repo->getItems() as $tool) {
             try {
-                $item = $normalizer->normalize($tool);
+                $tools[] = $normalizer->normalize($tool);
             } catch (\DomainException) {
-                continue;
-            }
-            if (false === empty($item)) {
-                $tools[] = $item;
+                /* pass */
             }
         }
 
diff --git a/src/Core/Serialization/JsonSerializer.php b/src/Core/Serialization/JsonSerializer.php
index 2d6e40a7..dd75baca 100644
--- a/src/Core/Serialization/JsonSerializer.php
+++ b/src/Core/Serialization/JsonSerializer.php
@@ -54,13 +54,12 @@ class JsonSerializer extends BaseSerializer
         Version::v1dot4 => 'http://cyclonedx.org/schema/bom-1.4.schema.json',
     ];
 
-    private function getSchemaBase(): array
+    private function setSchemaBase(object $struct): void
     {
         $schema = self::SCHEMA[$this->getSpec()->getVersion()] ?? null;
-
-        return null === $schema
-            ? [] // @codeCoverageIgnore
-            : ['$schema' => $schema];
+        if (null !== $schema) {
+            $struct->{'$schema'} = $schema;
+        }
     }
 
     /**
@@ -68,12 +67,13 @@ private function getSchemaBase(): array
      */
     protected function normalize(Bom $bom): string
     {
-        $schemaBase = $this->getSchemaBase();
         $data = (new JSON\NormalizerFactory($this->getSpec()))
             ->makeForBom()
             ->normalize($bom);
 
-        $json = json_encode(array_merge($schemaBase, $data), self::NORMALIZE_OPTIONS);
+        $this->setSchemaBase($data);
+
+        $json = json_encode($data, self::NORMALIZE_OPTIONS);
         \assert(false !== $json); // as option JSON_THROW_ON_ERROR is expected to be set
         \assert('' !== $json);
 
diff --git a/tests/Core/Serialization/JSON/Normalizers/BomNormalizerTest.php b/tests/Core/Serialization/JSON/Normalizers/BomNormalizerTest.php
index d9d83a4b..728a58ea 100644
--- a/tests/Core/Serialization/JSON/Normalizers/BomNormalizerTest.php
+++ b/tests/Core/Serialization/JSON/Normalizers/BomNormalizerTest.php
@@ -62,8 +62,8 @@ public function testNormalize(): void
 
         $actual = $normalizer->normalize($bom);
 
-        self::assertSame(
-            [
+        self::assertEquals(
+            (object) [
                 'bomFormat' => 'CycloneDX',
                 'specVersion' => '1.2',
                 'version' => 23,
@@ -100,8 +100,8 @@ public function testNormalizeComponents(): void
 
         $actual = $normalizer->normalize($bom);
 
-        self::assertSame(
-            [
+        self::assertEquals(
+            (object) [
                 'bomFormat' => 'CycloneDX',
                 'specVersion' => '1.2',
                 'version' => 23,
@@ -145,16 +145,16 @@ public function testNormalizeMetadata(): void
         $metadataNormalizer->expects(self::once())
             ->method('normalize')
             ->with($bom->getMetadata())
-            ->willReturn(['FakeMetadata']);
+            ->willReturn((object) ['FakeMetadata' => true]);
 
         $actual = $normalizer->normalize($bom);
 
-        self::assertSame(
-            [
+        self::assertEquals(
+            (object) [
                 'bomFormat' => 'CycloneDX',
                 'specVersion' => '1.2',
                 'version' => 23,
-                'metadata' => ['FakeMetadata'],
+                'metadata' => (object) ['FakeMetadata' => true],
                 'components' => [],
             ],
             $actual
@@ -189,16 +189,17 @@ public function testNormalizeMetadataEmpty(): void
 
         $metadataNormalizer->method('normalize')
             ->with($bom->getMetadata())
-            ->willReturn([/* empty */]);
+            ->willReturn((object) [/* empty */]);
 
         $actual = $normalizer->normalize($bom);
 
-        self::assertSame(
-            [
+        self::assertEquals(
+            (object) [
                 'bomFormat' => 'CycloneDX',
                 'specVersion' => '1.2',
                 'version' => 23,
                 'components' => [],
+                'metadata' => (object) [],
             ],
             $actual
         );
@@ -232,12 +233,12 @@ public function testNormalizeMetadataSkipped(): void
 
         $metadataNormalizer->method('normalize')
             ->with($bom->getMetadata())
-            ->willReturn(['FakeMetadata']);
+            ->willReturn((object) ['FakeMetadata' => true]);
 
         $actual = $normalizer->normalize($bom);
 
-        self::assertSame(
-            [
+        self::assertEquals(
+            (object) [
                 'bomFormat' => 'CycloneDX',
                 'specVersion' => '1.2',
                 'version' => 23,
@@ -280,17 +281,17 @@ public function testNormalizeDependencies(): void
         $dependencyNormalizer->expects(self::once())
             ->method('normalize')
             ->with($bom)
-            ->willReturn(['FakeDependencies' => 'dummy']);
+            ->willReturn(['FakeDependencies']);
 
         $actual = $normalizer->normalize($bom);
 
-        self::assertSame(
-            [
+        self::assertEquals(
+            (object) [
                 'bomFormat' => 'CycloneDX',
                 'specVersion' => '1.2',
                 'version' => 23,
                 'components' => [],
-                'dependencies' => ['FakeDependencies' => 'dummy'],
+                'dependencies' => ['FakeDependencies'],
             ],
             $actual
         );
@@ -329,8 +330,8 @@ public function testNormalizeDependenciesOmitWhenEmpty(): void
 
         $actual = $normalizer->normalize($bom);
 
-        self::assertSame(
-            [
+        self::assertEquals(
+            (object) [
                 'bomFormat' => 'CycloneDX',
                 'specVersion' => '1.2',
                 'version' => 23,
@@ -391,8 +392,8 @@ public function testNormalizeExternalReferencesMergedIfUnsupportedMetadata(): vo
 
         $actual = $normalizer->normalize($bom);
 
-        self::assertSame(
-            [
+        self::assertEquals(
+            (object) [
                 'bomFormat' => 'CycloneDX',
                 'specVersion' => '1.2',
                 'version' => 23,
@@ -412,10 +413,10 @@ public function testNormalizeExternalReferencesOmittedWHenEmpty(): void
             'getVersion' => '1.2',
             'supportsMetadata' => false,
         ]);
-        $extRefNormalizer = $this->createMock(Normalizers\ExternalReferenceRepositoryNormalizer::class);
+        $extRefRepoNormalizer = $this->createMock(Normalizers\ExternalReferenceRepositoryNormalizer::class);
         $factory = $this->createConfiguredMock(NormalizerFactory::class, [
             'getSpec' => $spec,
-            'makeForExternalReferenceRepository' => $extRefNormalizer,
+            'makeForExternalReferenceRepository' => $extRefRepoNormalizer,
         ]);
         $normalizer = new Normalizers\BomNormalizer($factory);
         $extRef1 = $this->createStub(ExternalReference::class);
@@ -428,15 +429,15 @@ public function testNormalizeExternalReferencesOmittedWHenEmpty(): void
             ]
         );
 
-        $extRefNormalizer->expects(self::once())
+        $extRefRepoNormalizer->expects(self::once())
             ->method('normalize')
             ->with($bom->getExternalReferences())
             ->willReturn([/* empty */]);
 
         $actual = $normalizer->normalize($bom);
 
-        self::assertSame(
-            [
+        self::assertEquals(
+            (object) [
                 'bomFormat' => 'CycloneDX',
                 'specVersion' => '1.2',
                 'version' => 23,
diff --git a/tests/Core/Serialization/JSON/Normalizers/ComponentNormalizerTest.php b/tests/Core/Serialization/JSON/Normalizers/ComponentNormalizerTest.php
index 22b7b88f..aa7d5869 100644
--- a/tests/Core/Serialization/JSON/Normalizers/ComponentNormalizerTest.php
+++ b/tests/Core/Serialization/JSON/Normalizers/ComponentNormalizerTest.php
@@ -69,7 +69,7 @@ public function testNormalizeThrowsOnUnsupportedType(): void
     /**
      * @dataProvider dptNormalizeMinimal
      */
-    public function testNormalizeMinimal(array $expected, bool $requiresComponentVersion): void
+    public function testNormalizeMinimal(object $expected, bool $requiresComponentVersion): void
     {
         $component = $this->createConfiguredMock(
             Component::class,
@@ -97,13 +97,13 @@ public function testNormalizeMinimal(array $expected, bool $requiresComponentVer
 
         $actual = $normalizer->normalize($component);
 
-        self::assertSame($expected, $actual);
+        self::assertEquals($expected, $actual);
     }
 
     public function dptNormalizeMinimal(): Generator
     {
         yield 'mandatory Component Version' => [
-            [
+            (object) [
                 'type' => 'FakeType',
                 'name' => 'foo',
                 'version' => '',
@@ -111,7 +111,7 @@ public function dptNormalizeMinimal(): Generator
             true,
         ];
         yield 'optional Component Version' => [
-            [
+            (object) [
                 'type' => 'FakeType',
                 'name' => 'foo',
             ],
@@ -169,7 +169,7 @@ public function testNormalizeFull(): void
         $actual = $normalizer->normalize($component);
 
         self::assertEquals(
-            [
+            (object) [
                 'bom-ref' => 'myBomRef',
                 'type' => 'FakeType',
                 'name' => 'myName',
@@ -213,7 +213,7 @@ public function testNormalizeLicenses(): void
 
         $got = $normalizer->normalize($component);
 
-        self::assertEquals([
+        self::assertEquals((object) [
             'type' => 'FakeType',
             'name' => 'myName',
             'licenses' => ['FakeLicenses'],
@@ -247,7 +247,7 @@ public function testNormalizeLicensesEmpty(): void
 
         $got = $normalizer->normalize($component);
 
-        self::assertEquals([
+        self::assertEquals((object) [
             'type' => 'FakeType',
             'name' => 'myName',
         ], $got);
@@ -287,7 +287,7 @@ public function testNormalizeExternalReferences(): void
 
         $actual = $normalizer->normalize($component);
 
-        self::assertSame([
+        self::assertEquals((object) [
             'type' => 'FakeType',
             'name' => 'myName',
             'externalReferences' => ['FakeExternalReference'],
@@ -326,7 +326,7 @@ public function testNormalizeExternalReferencesOmitIfEmpty(): void
 
         $actual = $normalizer->normalize($component);
 
-        self::assertEquals([
+        self::assertEquals((object) [
             'type' => 'FakeType',
             'name' => 'myName',
         ], $actual);
diff --git a/tests/Core/Serialization/JSON/Normalizers/ComponentRepositoryNormalizerTest.php b/tests/Core/Serialization/JSON/Normalizers/ComponentRepositoryNormalizerTest.php
index 2166f181..62eec7c4 100644
--- a/tests/Core/Serialization/JSON/Normalizers/ComponentRepositoryNormalizerTest.php
+++ b/tests/Core/Serialization/JSON/Normalizers/ComponentRepositoryNormalizerTest.php
@@ -65,13 +65,14 @@ public function testNormalize(): void
             'getItems' => [$component],
         ]);
 
-        $componentNormalizer->expects(self::once())->method('normalize')
+        $componentNormalizer->expects(self::once())
+            ->method('normalize')
             ->with($component)
-            ->willReturn(['FakeComponent']);
+            ->willReturn((object) ['FakeComponent' => true]);
 
         $got = $normalizer->normalize($components);
 
-        self::assertSame([['FakeComponent']], $got);
+        self::assertEquals([(object) ['FakeComponent' => true]], $got);
     }
 
     public function testNormalizeSkipsOnThrow(): void
diff --git a/tests/Core/Serialization/JSON/Normalizers/DependenciesNormalizerTest.php b/tests/Core/Serialization/JSON/Normalizers/DependenciesNormalizerTest.php
index d309650c..ffc3d51d 100644
--- a/tests/Core/Serialization/JSON/Normalizers/DependenciesNormalizerTest.php
+++ b/tests/Core/Serialization/JSON/Normalizers/DependenciesNormalizerTest.php
@@ -31,7 +31,6 @@
 use CycloneDX\Core\Models\Metadata;
 use CycloneDX\Core\Serialization\JSON\NormalizerFactory;
 use CycloneDX\Core\Serialization\JSON\Normalizers\DependenciesNormalizer;
-use Exception;
 use Generator;
 use PHPUnit\Framework\TestCase;
 
@@ -58,8 +57,6 @@ protected function setUp(): void
     }
 
     /**
-     * @param string[] $expecteds
-     *
      * @dataProvider dpNormalize
      *
      * @uses         \CycloneDX\Core\Models\BomRef
@@ -69,28 +66,9 @@ public function testNormalize(Bom $bom, array $expecteds): void
         $actuals = $this->normalizer->normalize($bom);
 
         self::assertSameSize($expecteds, $actuals);
-
-        $missing = [];
         foreach ($expecteds as $expected) {
-            foreach ($actuals as $actual) {
-                try {
-                    self::assertEquals($expected, $actual);
-                    continue 2; // expected was found
-                } catch (Exception $exception) {
-                    // pass
-                }
-            }
-            $missing[] = $expected;
+            self::assertContainsEquals($expected, $actuals, print_r($actuals, true));
         }
-
-        self::assertCount(
-            0,
-            $missing,
-            sprintf("missing:\n%s\nin:\n%s",
-                print_r($missing, true),
-                print_r($actuals, true),
-            )
-        );
     }
 
     public function dpNormalize(): Generator
@@ -181,16 +159,16 @@ public function dpNormalize(): Generator
         yield 'with metadata' => [
             $bom,
             [
-                [
+                (object) [
                     'ref' => 'myRootComponent',
                     'dependsOn' => [
                         'ComponentWithDeps',
                         'ComponentWithoutDeps',
                     ],
                 ],
-                ['ref' => 'ComponentWithoutDeps'],
-                ['ref' => 'ComponentWithNoDeps'],
-                [
+                (object) ['ref' => 'ComponentWithoutDeps'],
+                (object) ['ref' => 'ComponentWithNoDeps'],
+                (object) [
                     'ref' => 'ComponentWithDeps',
                     'dependsOn' => [
                         'ComponentWithoutDeps',
diff --git a/tests/Core/Serialization/JSON/Normalizers/ExternalReferenceNormalizerTest.php b/tests/Core/Serialization/JSON/Normalizers/ExternalReferenceNormalizerTest.php
index 08df7a32..22117a75 100644
--- a/tests/Core/Serialization/JSON/Normalizers/ExternalReferenceNormalizerTest.php
+++ b/tests/Core/Serialization/JSON/Normalizers/ExternalReferenceNormalizerTest.php
@@ -59,7 +59,7 @@ public function testNormalizeTypeAndUrl(): void
 
         $actual = $normalizer->normalize($extRef);
 
-        self::assertSame([
+        self::assertEquals((object) [
             'type' => 'someType',
             'url' => 'someUrl',
             // comment omitted
@@ -89,7 +89,7 @@ public function testNormalizeTypeConvertIfNotSupported(): void
 
         $actual = $normalizer->normalize($extRef);
 
-        self::assertSame([
+        self::assertEquals((object) [
             'type' => 'other',
             'url' => 'someUrl',
             // comment omitted
@@ -167,7 +167,7 @@ public function testNormalizeComment(): void
 
         $actual = $normalizer->normalize($extRef);
 
-        self::assertSame([
+        self::assertEquals((object) [
             'type' => 'someType',
             'url' => 'someUrl',
             'comment' => 'someComment',
@@ -204,7 +204,7 @@ public function testNormalizeHashes(): void
 
         $actual = $normalizer->normalize($extRef);
 
-        self::assertSame([
+        self::assertEquals((object) [
             'type' => 'someType',
             'url' => 'someUrl',
             'hashes' => ['NormalizedHashDictFake'],
@@ -238,7 +238,7 @@ public function testNormalizeHashesOmitIfEmpty(): void
 
         $actual = $normalizer->normalize($extRef);
 
-        self::assertSame([
+        self::assertEquals((object) [
             'type' => 'someType',
             'url' => 'someUrl',
             // hashes is omitted
@@ -272,7 +272,7 @@ public function testNormalizeHashesOmitIfNotSupported(): void
 
         $actual = $normalizer->normalize($extRef);
 
-        self::assertSame([
+        self::assertEquals((object) [
             'type' => 'someType',
             'url' => 'someUrl',
             // hashes is omitted
diff --git a/tests/Core/Serialization/JSON/Normalizers/ExternalReferenceRepositoryNormalizerTest.php b/tests/Core/Serialization/JSON/Normalizers/ExternalReferenceRepositoryNormalizerTest.php
index 12ea5226..834fafa2 100644
--- a/tests/Core/Serialization/JSON/Normalizers/ExternalReferenceRepositoryNormalizerTest.php
+++ b/tests/Core/Serialization/JSON/Normalizers/ExternalReferenceRepositoryNormalizerTest.php
@@ -76,11 +76,11 @@ public function testNormalize(): void
         $externalReferenceNormalizer->expects(self::once())
             ->method('normalize')
             ->with($externalReference)
-            ->willReturn(['FakeExtRef' => 'dummy']);
+            ->willReturn((object) ['FakeExtRef' => true]);
 
         $actual = $normalizer->normalize($repo);
 
-        self::assertSame([['FakeExtRef' => 'dummy']], $actual);
+        self::assertEquals([(object) ['FakeExtRef' => true]], $actual);
     }
 
     public function testNormalizeSkipsOnThrow(): void
diff --git a/tests/Core/Serialization/JSON/Normalizers/HashDictionaryNormalizerTest.php b/tests/Core/Serialization/JSON/Normalizers/HashDictionaryNormalizerTest.php
index f5e14afd..fd1e511c 100644
--- a/tests/Core/Serialization/JSON/Normalizers/HashDictionaryNormalizerTest.php
+++ b/tests/Core/Serialization/JSON/Normalizers/HashDictionaryNormalizerTest.php
@@ -48,16 +48,17 @@ public function testNormalize(): void
         $hashNormalizer = $this->createMock(HashNormalizer::class);
         $factory = $this->createConfiguredMock(NormalizerFactory::class, ['makeForHash' => $hashNormalizer]);
         $normalizer = new HashDictionaryNormalizer($factory);
-        $repo = $this->createStub(HashDictionary::class);
-        $repo->method('getItems')->willReturn(['alg1' => 'content1', 'alg2' => 'content2']);
+        $repo = $this->createConfiguredMock(HashDictionary::class, [
+            'getItems' => ['alg1' => 'content1', 'alg2' => 'content2'],
+        ]);
 
         $hashNormalizer->expects(self::exactly(2))->method('normalize')
             ->withConsecutive(['alg1', 'content1'], ['alg2', 'content2'])
-            ->willReturnOnConsecutiveCalls(['dummy1'], ['dummy2']);
+            ->willReturnOnConsecutiveCalls((object) ['dummy1' => true], (object) ['dummy2' => true]);
 
         $normalized = $normalizer->normalize($repo);
 
-        self::assertSame([['dummy1'], ['dummy2']], $normalized);
+        self::assertEquals([(object) ['dummy1' => true], (object) ['dummy2' => true]], $normalized);
     }
 
     /**
diff --git a/tests/Core/Serialization/JSON/Normalizers/HashNormalizerTest.php b/tests/Core/Serialization/JSON/Normalizers/HashNormalizerTest.php
index 2133f177..eb03b9a9 100644
--- a/tests/Core/Serialization/JSON/Normalizers/HashNormalizerTest.php
+++ b/tests/Core/Serialization/JSON/Normalizers/HashNormalizerTest.php
@@ -58,7 +58,7 @@ public function testNormalize(): void
 
         $normalized = $normalizer->normalize('foo', 'bar');
 
-        self::assertSame(['alg' => 'foo', 'content' => 'bar'], $normalized);
+        self::assertEquals((object) ['alg' => 'foo', 'content' => 'bar'], $normalized);
     }
 
     public function testNormalizeThrowOnUnsupportedAlgorithm(): void
diff --git a/tests/Core/Serialization/JSON/Normalizers/LicenseNormalizerTest.php b/tests/Core/Serialization/JSON/Normalizers/LicenseNormalizerTest.php
index c7392380..d45e8b28 100644
--- a/tests/Core/Serialization/JSON/Normalizers/LicenseNormalizerTest.php
+++ b/tests/Core/Serialization/JSON/Normalizers/LicenseNormalizerTest.php
@@ -40,7 +40,7 @@ class LicenseNormalizerTest extends \PHPUnit\Framework\TestCase
     /**
      * @dataProvider dpNormalize
      */
-    public function testNormalize(LicenseExpression|DisjunctiveLicenseWithId|DisjunctiveLicenseWithName $license, array $expected): void
+    public function testNormalize(LicenseExpression|DisjunctiveLicenseWithId|DisjunctiveLicenseWithName $license, object $expected): void
     {
         $spec = $this->createMock(Spec::class);
         $factory = $this->createConfiguredMock(NormalizerFactory::class, ['getSpec' => $spec]);
@@ -48,7 +48,7 @@ public function testNormalize(LicenseExpression|DisjunctiveLicenseWithId|Disjunc
 
         $actual = $normalizer->normalize($license);
 
-        self::assertSame($expected, $actual);
+        self::assertEquals($expected, $actual);
     }
 
     public function dpNormalize(): Generator
@@ -57,17 +57,19 @@ public function dpNormalize(): Generator
             $this->createConfiguredMock(LicenseExpression::class, [
                 'getExpression' => 'MIT OR Apache-2.0',
             ]),
-            ['expression' => 'MIT OR Apache-2.0'],
+            (object) [
+                'expression' => 'MIT OR Apache-2.0',
+            ],
         ];
         yield 'SPDX license' => [
             $this->createConfiguredMock(DisjunctiveLicenseWithId::class, [
                 'getId' => 'MIT',
                 'getUrl' => 'https://foo.bar',
             ]),
-            [
-                'license' => [
-                'id' => 'MIT',
-                'url' => 'https://foo.bar',
+            (object) [
+                'license' => (object) [
+                    'id' => 'MIT',
+                    'url' => 'https://foo.bar',
                 ],
             ],
         ];
@@ -76,11 +78,11 @@ public function dpNormalize(): Generator
                 'getName' => 'copyright by the crew',
                 'getUrl' => 'https://foo.bar',
             ]),
-            [
-                'license' => [
-                'name' => 'copyright by the crew',
-                'url' => 'https://foo.bar',
-                    ],
+            (object) [
+                'license' => (object) [
+                    'name' => 'copyright by the crew',
+                    'url' => 'https://foo.bar',
+                ],
             ],
         ];
     }
diff --git a/tests/Core/Serialization/JSON/Normalizers/LicenseRepositoryNormalizerTest.php b/tests/Core/Serialization/JSON/Normalizers/LicenseRepositoryNormalizerTest.php
index 732c8108..d4523258 100644
--- a/tests/Core/Serialization/JSON/Normalizers/LicenseRepositoryNormalizerTest.php
+++ b/tests/Core/Serialization/JSON/Normalizers/LicenseRepositoryNormalizerTest.php
@@ -70,10 +70,10 @@ public function testNormalize(): void
 
         $licenseNormalizer->expects(self::once())->method('normalize')
             ->with($license)
-            ->willReturn(['FakeLicense' => true]);
+            ->willReturn((object) ['FakeLicense' => true]);
 
         $actual = $normalizer->normalize($licenses);
 
-        self::assertSame([['FakeLicense' => true]], $actual);
+        self::assertEquals([(object) ['FakeLicense' => true]], $actual);
     }
 }
diff --git a/tests/Core/Serialization/JSON/Normalizers/MetadataNormalizerTest.php b/tests/Core/Serialization/JSON/Normalizers/MetadataNormalizerTest.php
index e83c536e..1508506f 100644
--- a/tests/Core/Serialization/JSON/Normalizers/MetadataNormalizerTest.php
+++ b/tests/Core/Serialization/JSON/Normalizers/MetadataNormalizerTest.php
@@ -49,7 +49,7 @@ public function testNormalizeEmpty(): void
 
         $actual = $normalizer->normalize($metadata);
 
-        self::assertSame([], $actual);
+        self::assertEquals((object) [], $actual);
     }
 
     public function testNormalizeTools(): void
@@ -74,12 +74,12 @@ public function testNormalizeTools(): void
         $toolsRepoFactory->expects(self::once())
             ->method('normalize')
             ->with($metadata->getTools())
-            ->willReturn(['FakeTool' => 'dummy']);
+            ->willReturn(['FakeTool']);
 
         $actual = $normalizer->normalize($metadata);
 
-        self::assertSame(
-            ['tools' => ['FakeTool' => 'dummy']],
+        self::assertEquals(
+            (object) ['tools' => ['FakeTool']],
             $actual
         );
     }
@@ -109,12 +109,12 @@ public function testNormalizeComponent(): void
         $componentFactory->expects(self::once())
             ->method('normalize')
             ->with($metadata->getComponent())
-            ->willReturn(['FakeComponent' => 'dummy']);
+            ->willReturn((object) ['FakeComponent' => true]);
 
         $actual = $normalizer->normalize($metadata);
 
-        self::assertSame(
-            ['component' => ['FakeComponent' => 'dummy']],
+        self::assertEquals(
+            (object) ['component' => (object) ['FakeComponent' => true]],
             $actual
         );
     }
@@ -145,6 +145,6 @@ public function testNormalizeComponentUnsupported(): void
 
         $actual = $normalizer->normalize($metadata);
 
-        self::assertSame([], $actual);
+        self::assertEquals((object) [], $actual);
     }
 }
diff --git a/tests/Core/Serialization/JSON/Normalizers/ToolNormalizerTest.php b/tests/Core/Serialization/JSON/Normalizers/ToolNormalizerTest.php
index 358afeeb..d6b84c43 100644
--- a/tests/Core/Serialization/JSON/Normalizers/ToolNormalizerTest.php
+++ b/tests/Core/Serialization/JSON/Normalizers/ToolNormalizerTest.php
@@ -50,7 +50,7 @@ public function testNormalizeEmpty(): void
 
         $actual = $normalizer->normalize($tool);
 
-        self::assertSame([], $actual);
+        self::assertEquals((object) [], $actual);
     }
 
     public function testNormalizeFull(): void
@@ -91,8 +91,8 @@ public function testNormalizeFull(): void
 
         $actual = $normalizer->normalize($tool);
 
-        self::assertSame(
-            [
+        self::assertEquals(
+            (object) [
                 'vendor' => 'myVendor',
                 'name' => 'myName',
                 'version' => 'myVersion',
@@ -139,8 +139,8 @@ public function testNormalizeMinimal(): void
 
         $actual = $normalizer->normalize($tool);
 
-        self::assertSame(
-            [],
+        self::assertEquals(
+            (object) [],
             $actual
         );
     }
diff --git a/tests/Core/Serialization/JSON/Normalizers/ToolRepositoryNormalizerTest.php b/tests/Core/Serialization/JSON/Normalizers/ToolRepositoryNormalizerTest.php
index b2ea27e6..75c277f9 100644
--- a/tests/Core/Serialization/JSON/Normalizers/ToolRepositoryNormalizerTest.php
+++ b/tests/Core/Serialization/JSON/Normalizers/ToolRepositoryNormalizerTest.php
@@ -75,11 +75,11 @@ public function testNormalize(): void
 
         $toolNormalizer->expects(self::once())->method('normalize')
             ->with($tool)
-            ->willReturn(['FakeTool' => 'dummy']);
+            ->willReturn((object) ['FakeTool' => 'dummy']);
 
         $actual = $normalizer->normalize($tools);
 
-        self::assertSame([['FakeTool' => 'dummy']], $actual);
+        self::assertEquals([(object) ['FakeTool' => 'dummy']], $actual);
     }
 
     public function testNormalizeSkipsOnThrow(): void