{ "bomFormat": "CycloneDX", "specVersion": "1.7", "serialNumber": "urn:uuid:1f81b07d-7648-4330-9b25-df50fbd063fc", "version": 1, "metadata": { "timestamp": "2026-09-14T03:36:25Z", "tools": { "components": [ { "group": "@cyclonedx", "name": "cdxgen", "version": "12.8.4", "purl": "pkg:npm/%40cyclonedx/cdxgen@12.8.4", "type": "application", "bom-ref": "pkg:npm/@cyclonedx/cdxgen@12.8.4", "publisher": "OWASP Foundation", "authors": [ { "name": "OWASP Foundation" } ] } ] }, "authors": [ { "name": "OWASP Foundation" } ], "lifecycles": [ { "phase": "pre-build" } ], "component": { "name": "client", "group": "@langfuse", "version": "5.11.1", "description": "Langfuse API client for universal JavaScript environments", "purl": "pkg:npm/%40langfuse/client@5.11.1", "bom-ref": "pkg:npm/@langfuse/client@5.11.1", "author": "Langfuse", "properties": [ { "name": "cdx:npm:scripts", "value": "build, test, test:watch, format, format:check, clean" }, { "name": "cdx:npm:buildScripts", "value": "build, test:watch" }, { "name": "cdx:license:category", "value": "Permissive" } ], "type": "application", "licenses": [ { "license": { "id": "MIT", "url": "https://opensource.org/licenses/MIT", "properties": [ { "name": "cdx:license:category", "value": "Permissive" }, { "name": "cdx:license:foss", "value": "true" }, { "name": "cdx:license:osiApproved", "value": "true" }, { "name": "cdx:license:fsfLibre", "value": "true" }, { "name": "cdx:license:deprecated", "value": "false" } ] } } ], "externalReferences": [ { "type": "vcs", "url": "https://github.com/langfuse/langfuse-js.git" } ] }, "properties": [ { "name": "cdx:bom:componentTypes", "value": "npm" }, { "name": "cdx:bom:componentNamespaces", "value": "@langfuse\\n@opentelemetry\\n@types" }, { "name": "cdx:bom:componentSrcFiles", "value": "node_modules/@langfuse/core/package.json\\nnode_modules/@langfuse/tracing/package.json\\nnode_modules/@opentelemetry/api/package.json\\nnode_modules/@types/mustache/package.json\\nnode_modules/mustache/package.json" } ] }, "components": [ { "authors": [ { "name": "mustache.js Authors " } ], "group": "", "name": "mustache", "version": "4.2.0", "description": "Logic-less {{mustache}} templates with JavaScript", "scope": "required", "licenses": [ { "license": { "id": "MIT", "url": "https://opensource.org/licenses/MIT", "properties": [ { "name": "cdx:license:category", "value": "Permissive" }, { "name": "cdx:license:foss", "value": "true" }, { "name": "cdx:license:osiApproved", "value": "true" }, { "name": "cdx:license:fsfLibre", "value": "true" }, { "name": "cdx:license:deprecated", "value": "false" } ] } } ], "purl": "pkg:npm/mustache@4.2.0", "externalReferences": [ { "type": "vcs", "url": "https://github.com/janl/mustache.js" }, { "type": "vcs", "url": "https://github.com/janl/mustache.js.git" } ], "type": "library", "bom-ref": "pkg:npm/mustache@4.2.0", "properties": [ { "name": "SrcFile", "value": "node_modules/mustache/package.json" }, { "name": "ImportedModules", "value": "mustache" }, { "name": "cdx:license:category", "value": "Permissive" } ], "evidence": { "identity": [ { "field": "purl", "confidence": 0.7, "methods": [ { "technique": "manifest-analysis", "confidence": 0.7, "value": "node_modules/mustache/package.json" } ], "concludedValue": "node_modules/mustache/package.json" } ], "occurrences": [ { "location": "dist/index.cjs", "line": 1247 }, { "location": "dist/index.mjs", "line": 1222 }, { "location": "dist/index.mjs", "line": 1339 }, { "location": "dist/index.mjs", "line": 1454 }, { "location": "src/prompt/promptClients.ts", "line": 7 }, { "location": "src/prompt/promptClients.ts", "line": 219 }, { "location": "src/prompt/promptClients.ts", "line": 387 } ] }, "tags": [ "templates" ] }, { "group": "@types", "name": "mustache", "version": "4.2.6", "description": "TypeScript definitions for mustache", "scope": "required", "licenses": [ { "license": { "id": "MIT", "url": "https://opensource.org/licenses/MIT", "properties": [ { "name": "cdx:license:category", "value": "Permissive" }, { "name": "cdx:license:foss", "value": "true" }, { "name": "cdx:license:osiApproved", "value": "true" }, { "name": "cdx:license:fsfLibre", "value": "true" }, { "name": "cdx:license:deprecated", "value": "false" } ] } } ], "purl": "pkg:npm/%40types/mustache@4.2.6", "externalReferences": [ { "type": "vcs", "url": "https://github.com/DefinitelyTyped/DefinitelyTyped/tree/master/types/mustache" }, { "type": "vcs", "url": "https://github.com/DefinitelyTyped/DefinitelyTyped.git" } ], "type": "library", "bom-ref": "pkg:npm/@types/mustache@4.2.6", "properties": [ { "name": "SrcFile", "value": "node_modules/@types/mustache/package.json" }, { "name": "cdx:license:category", "value": "Permissive" } ], "evidence": { "identity": [ { "field": "purl", "confidence": 0.7, "methods": [ { "technique": "manifest-analysis", "confidence": 0.7, "value": "node_modules/@types/mustache/package.json" } ], "concludedValue": "node_modules/@types/mustache/package.json" } ] } }, { "authors": [ { "name": "OpenTelemetry Authors" } ], "group": "@opentelemetry", "name": "api", "version": "1.9.0", "description": "Public API for OpenTelemetry", "scope": "required", "licenses": [ { "license": { "id": "Apache-2.0", "url": "https://opensource.org/licenses/Apache-2.0", "properties": [ { "name": "cdx:license:category", "value": "Permissive" }, { "name": "cdx:license:foss", "value": "true" }, { "name": "cdx:license:osiApproved", "value": "true" }, { "name": "cdx:license:fsfLibre", "value": "true" }, { "name": "cdx:license:deprecated", "value": "false" } ] } } ], "purl": "pkg:npm/%40opentelemetry/api@1.9.0", "externalReferences": [ { "type": "vcs", "url": "https://github.com/open-telemetry/opentelemetry-js/tree/main/api" } ], "type": "library", "bom-ref": "pkg:npm/@opentelemetry/api@1.9.0", "properties": [ { "name": "SrcFile", "value": "node_modules/@opentelemetry/api/package.json" }, { "name": "ImportedModules", "value": "@opentelemetry/api,ProxyTracerProvider,@opentelemetry/api/ProxyTracerProvider,trace,@opentelemetry/api/trace,Span,@opentelemetry/api/Span" }, { "name": "cdx:license:category", "value": "Permissive" } ], "evidence": { "identity": [ { "field": "purl", "confidence": 0.7, "methods": [ { "technique": "manifest-analysis", "confidence": 0.7, "value": "node_modules/@opentelemetry/api/package.json" } ], "concludedValue": "node_modules/@opentelemetry/api/package.json" } ], "occurrences": [ { "location": "dist/index.cjs", "line": 416 }, { "location": "dist/index.cjs", "line": 1843 }, { "location": "dist/index.mjs", "line": 386 }, { "location": "dist/index.mjs", "line": 958 }, { "location": "dist/index.mjs", "line": 1824 }, { "location": "dist/index.mjs", "line": 1978 }, { "location": "dist/index.mjs", "line": 2014 }, { "location": "src/dataset/index.ts", "line": 12 }, { "location": "src/experiment/ExperimentManager.ts", "line": 12 }, { "location": "src/experiment/ExperimentManager.ts", "line": 769 }, { "location": "src/score/index.ts", "line": 12 }, { "location": "src/score/index.ts", "line": 212 }, { "location": "src/score/index.ts", "line": 257 }, { "location": "dist/index.d.cts", "line": 4 } ] }, "tags": [ "api" ] }, { "authors": [ { "name": "Langfuse" } ], "group": "@langfuse", "name": "tracing", "version": "5.11.1", "description": "Langfuse instrumentation methods based on OpenTelemetry", "scope": "required", "licenses": [ { "license": { "id": "MIT", "url": "https://opensource.org/licenses/MIT", "properties": [ { "name": "cdx:license:category", "value": "Permissive" }, { "name": "cdx:license:foss", "value": "true" }, { "name": "cdx:license:osiApproved", "value": "true" }, { "name": "cdx:license:fsfLibre", "value": "true" }, { "name": "cdx:license:deprecated", "value": "false" } ] } } ], "purl": "pkg:npm/%40langfuse/tracing@5.11.1", "externalReferences": [ { "type": "vcs", "url": "https://github.com/langfuse/langfuse-js.git" } ], "type": "library", "bom-ref": "pkg:npm/@langfuse/tracing@5.11.1", "properties": [ { "name": "SrcFile", "value": "node_modules/@langfuse/tracing/package.json" }, { "name": "ImportedModules", "value": "@langfuse/tracing,startActiveObservation,@langfuse/tracing/startActiveObservation" }, { "name": "cdx:license:category", "value": "Permissive" } ], "evidence": { "identity": [ { "field": "purl", "confidence": 0.7, "methods": [ { "technique": "manifest-analysis", "confidence": 0.7, "value": "node_modules/@langfuse/tracing/package.json" } ], "concludedValue": "node_modules/@langfuse/tracing/package.json" } ], "occurrences": [ { "location": "dist/index.cjs", "line": 415 }, { "location": "dist/index.mjs", "line": 385 }, { "location": "dist/index.mjs", "line": 625 }, { "location": "src/experiment/ExperimentManager.ts", "line": 11 }, { "location": "src/experiment/ExperimentManager.ts", "line": 374 } ] } }, { "authors": [ { "name": "Langfuse" } ], "group": "@langfuse", "name": "core", "version": "5.11.1", "description": "Core functions and utilities for Langfuse packages", "scope": "required", "licenses": [ { "license": { "id": "MIT", "url": "https://opensource.org/licenses/MIT", "properties": [ { "name": "cdx:license:category", "value": "Permissive" }, { "name": "cdx:license:foss", "value": "true" }, { "name": "cdx:license:osiApproved", "value": "true" }, { "name": "cdx:license:fsfLibre", "value": "true" }, { "name": "cdx:license:deprecated", "value": "false" } ] } } ], "purl": "pkg:npm/%40langfuse/core@5.11.1", "externalReferences": [ { "type": "vcs", "url": "https://github.com/langfuse/langfuse-js.git" } ], "type": "library", "bom-ref": "pkg:npm/@langfuse/core@5.11.1", "properties": [ { "name": "SrcFile", "value": "node_modules/@langfuse/core/package.json" }, { "name": "ExportedModules", "value": "@langfuse/core,LangfuseMedia,@langfuse/core/LangfuseMedia,LangfuseMediaReference,@langfuse/core/LangfuseMediaReference,LangfuseMediaParams,@langfuse/core/LangfuseMediaParams,LangfuseMediaReferenceParams,@langfuse/core/LangfuseMediaReferenceParams" }, { "name": "ImportedModules", "value": "@langfuse/core,LangfuseAPIClient,@langfuse/core/LangfuseAPIClient,LANGFUSE_SDK_VERSION,@langfuse/core/LANGFUSE_SDK_VERSION,getGlobalLogger,@langfuse/core/getGlobalLogger,getEnv,@langfuse/core/getEnv,LangfuseMedia,@langfuse/core/LangfuseMedia,LangfuseMediaReference,@langfuse/core/LangfuseMediaReference,generateUUID,@langfuse/core/generateUUID,uploadMedia,@langfuse/core/uploadMedia,propagateAttributes,@langfuse/core/propagateAttributes,serializeValue,@langfuse/core/serializeValue,createExperimentId,@langfuse/core/createExperimentId,createExperimentItemId,@langfuse/core/createExperimentItemId,LangfuseOtelSpanAttributes,@langfuse/core/LangfuseOtelSpanAttributes,LANGFUSE_SDK_EXPERIMENT_ENVIRONMENT,@langfuse/core/LANGFUSE_SDK_EXPERIMENT_ENVIRONMENT,bytesToBase64,@langfuse/core/bytesToBase64,LogLevel,@langfuse/core/LogLevel,safeSetTimeout,@langfuse/core/safeSetTimeout,Dataset,@langfuse/core/Dataset,DatasetRunItem,@langfuse/core/DatasetRunItem,DatasetItem,@langfuse/core/DatasetItem,CreateDatasetItemRequest,@langfuse/core/CreateDatasetItemRequest,ScoreBody,@langfuse/core/ScoreBody,ParsedMediaReference,@langfuse/core/ParsedMediaReference,MediaContentType,@langfuse/core/MediaContentType,Prompt,@langfuse/core/Prompt,ChatMessage,@langfuse/core/ChatMessage,BasePrompt,@langfuse/core/BasePrompt,ChatMessageWithPlaceholders,@langfuse/core/ChatMessageWithPlaceholders,CreatePromptRequest,@langfuse/core/CreatePromptRequest,CreateTextPromptRequest,@langfuse/core/CreateTextPromptRequest,CreateChatPromptRequest,@langfuse/core/CreateChatPromptRequest,PlaceholderMessage,@langfuse/core/PlaceholderMessage,IngestionEvent,@langfuse/core/IngestionEvent,IngestionResponse,@langfuse/core/IngestionResponse" }, { "name": "cdx:license:category", "value": "Permissive" } ], "evidence": { "identity": [ { "field": "purl", "confidence": 0.7, "methods": [ { "technique": "manifest-analysis", "confidence": 0.7, "value": "node_modules/@langfuse/core/package.json" } ], "concludedValue": "node_modules/@langfuse/core/package.json" } ], "occurrences": [ { "location": "dist/index.cjs", "line": 51 }, { "location": "dist/index.cjs", "line": 54 }, { "location": "dist/index.cjs", "line": 414 }, { "location": "dist/index.cjs", "line": 1017 }, { "location": "dist/index.cjs", "line": 1178 }, { "location": "dist/index.cjs", "line": 1181 }, { "location": "dist/index.cjs", "line": 1842 }, { "location": "dist/index.cjs", "line": 2321 }, { "location": "dist/index.mjs", "line": 7 }, { "location": "dist/index.mjs", "line": 16 }, { "location": "dist/index.mjs", "line": 91 }, { "location": "dist/index.mjs", "line": 112 }, { "location": "dist/index.mjs", "line": 279 }, { "location": "dist/index.mjs", "line": 294 }, { "location": "dist/index.mjs", "line": 357 }, { "location": "dist/index.mjs", "line": 384 }, { "location": "dist/index.mjs", "line": 405 }, { "location": "dist/index.mjs", "line": 498 }, { "location": "dist/index.mjs", "line": 657 }, { "location": "dist/index.mjs", "line": 666 }, { "location": "dist/index.mjs", "line": 672 }, { "location": "dist/index.mjs", "line": 677 }, { "location": "dist/index.mjs", "line": 680 }, { "location": "dist/index.mjs", "line": 990 }, { "location": "dist/index.mjs", "line": 1068 }, { "location": "dist/index.mjs", "line": 1075 }, { "location": "dist/index.mjs", "line": 1153 }, { "location": "dist/index.mjs", "line": 1156 }, { "location": "dist/index.mjs", "line": 1208 }, { "location": "dist/index.mjs", "line": 1552 }, { "location": "dist/index.mjs", "line": 1823 }, { "location": "dist/index.mjs", "line": 1839 }, { "location": "dist/index.mjs", "line": 1840 }, { "location": "dist/index.mjs", "line": 1845 }, { "location": "dist/index.mjs", "line": 1870 }, { "location": "dist/index.mjs", "line": 1871 }, { "location": "dist/index.mjs", "line": 1874 }, { "location": "dist/index.mjs", "line": 1895 }, { "location": "dist/index.mjs", "line": 2114 }, { "location": "dist/index.mjs", "line": 2115 }, { "location": "dist/index.mjs", "line": 2116 }, { "location": "dist/index.mjs", "line": 2117 }, { "location": "dist/index.mjs", "line": 2131 }, { "location": "dist/index.mjs", "line": 2305 }, { "location": "src/LangfuseClient.ts", "line": 6 }, { "location": "src/LangfuseClient.ts", "line": 275 }, { "location": "src/LangfuseClient.ts", "line": 277 }, { "location": "src/LangfuseClient.ts", "line": 278 }, { "location": "src/LangfuseClient.ts", "line": 281 }, { "location": "src/LangfuseClient.ts", "line": 282 }, { "location": "src/LangfuseClient.ts", "line": 296 }, { "location": "src/dataset/index.ts", "line": 11 }, { "location": "src/dataset/index.ts", "line": 63 }, { "location": "src/dataset/index.ts", "line": 86 }, { "location": "src/dataset/index.ts", "line": 377 }, { "location": "src/dataset/index.ts", "line": 400 }, { "location": "src/dataset/index.ts", "line": 504 }, { "location": "src/experiment/ExperimentManager.ts", "line": 10 }, { "location": "src/experiment/ExperimentManager.ts", "line": 97 }, { "location": "src/experiment/ExperimentManager.ts", "line": 197 }, { "location": "src/experiment/ExperimentManager.ts", "line": 415 }, { "location": "src/experiment/ExperimentManager.ts", "line": 430 }, { "location": "src/experiment/ExperimentManager.ts", "line": 441 }, { "location": "src/experiment/ExperimentManager.ts", "line": 446 }, { "location": "src/experiment/ExperimentManager.ts", "line": 449 }, { "location": "src/experiment/types.ts", "line": 1 }, { "location": "src/index.ts", "line": 16 }, { "location": "src/media/index.ts", "line": 7 }, { "location": "src/media/index.ts", "line": 122 }, { "location": "src/media/index.ts", "line": 130 }, { "location": "src/prompt/promptCache.ts", "line": 1 }, { "location": "src/prompt/promptCache.ts", "line": 83 }, { "location": "src/prompt/promptClients.ts", "line": 6 }, { "location": "src/prompt/promptManager.ts", "line": 10 }, { "location": "src/prompt/promptManager.ts", "line": 50 }, { "location": "src/prompt/types.ts", "line": 6 }, { "location": "src/score/index.ts", "line": 11 }, { "location": "src/score/index.ts", "line": 43 }, { "location": "src/score/index.ts", "line": 44 }, { "location": "src/score/index.ts", "line": 53 }, { "location": "src/score/index.ts", "line": 78 }, { "location": "src/score/index.ts", "line": 79 }, { "location": "src/score/index.ts", "line": 83 }, { "location": "src/score/index.ts", "line": 107 }, { "location": "dist/index.d.cts", "line": 1 }, { "location": "dist/index.d.cts", "line": 2 }, { "location": "dist/index.d.cts", "line": 3 } ] } } ], "dependencies": [], "annotations": [ { "bom-ref": "metadata-annotations", "subjects": [ "pkg:npm/@langfuse/client@5.11.1" ], "annotator": { "component": { "group": "@cyclonedx", "name": "cdxgen", "version": "12.8.4", "purl": "pkg:npm/%40cyclonedx/cdxgen@12.8.4", "type": "application", "bom-ref": "pkg:npm/@cyclonedx/cdxgen@12.8.4", "publisher": "OWASP Foundation", "authors": [ { "name": "OWASP Foundation" } ] } }, "timestamp": "2026-09-14T03:36:25Z", "text": "This Software Bill-of-Materials (SBOM) document was created on Monday, September 14, 2026 with cdxgen. The data was captured during the pre-build lifecycle phase without building the application. The document describes an application named 'client' with version '5.11.1'. The package type in this SBOM is npm with 3 purl namespaces described under components. The components were identified from 5 source files." } ] }