{ "bomFormat": "CycloneDX", "specVersion": "1.7", "serialNumber": "urn:uuid:01db3965-0435-48d1-9334-244bbc7d93e1", "version": 1, "metadata": { "timestamp": "2026-09-14T03:36:31Z", "tools": { "components": [ { "group": "@cyclonedx", "name": "cdxgen", "version": "12.8.4", "purl": "pkg:npm/%40cyclonedx/cdxgen@12.8.4", "type": "application", "bom-ref": "pkg:npm/@cyclonedx/cdxgen@12.8.4", "publisher": "OWASP Foundation", "authors": [ { "name": "OWASP Foundation" } ] } ] }, "authors": [ { "name": "OWASP Foundation" } ], "lifecycles": [ { "phase": "pre-build" } ], "component": { "name": "vercel-ai-sdk", "group": "@langfuse", "version": "5.11.1", "description": "Langfuse integration for Vercel AI SDK v7", "purl": "pkg:npm/%40langfuse/vercel-ai-sdk@5.11.1", "bom-ref": "pkg:npm/@langfuse/vercel-ai-sdk@5.11.1", "author": "Langfuse", "properties": [ { "name": "cdx:npm:scripts", "value": "build, test, test:watch, format, format:check, clean" }, { "name": "cdx:npm:buildScripts", "value": "build, test:watch" }, { "name": "cdx:license:category", "value": "Permissive" } ], "type": "application", "licenses": [ { "license": { "id": "MIT", "url": "https://opensource.org/licenses/MIT", "properties": [ { "name": "cdx:license:category", "value": "Permissive" }, { "name": "cdx:license:foss", "value": "true" }, { "name": "cdx:license:osiApproved", "value": "true" }, { "name": "cdx:license:fsfLibre", "value": "true" }, { "name": "cdx:license:deprecated", "value": "false" } ] } } ], "externalReferences": [ { "type": "vcs", "url": "https://github.com/langfuse/langfuse-js.git" } ] }, "properties": [ { "name": "cdx:bom:componentTypes", "value": "npm" }, { "name": "cdx:bom:componentNamespaces", "value": "@ai-sdk\\n@langfuse\\n@opentelemetry" }, { "name": "cdx:bom:componentSrcFiles", "value": "node_modules/@ai-sdk/otel/package.json\\nnode_modules/@langfuse/core/package.json\\nnode_modules/@opentelemetry/api/package.json\\nnode_modules/ai/package.json" } ] }, "components": [ { "group": "", "name": "ai", "version": "7.0.44", "description": "AI SDK by Vercel - build apps like ChatGPT, Claude, Gemini, and more with a single interface for any model using the Vercel AI Gateway or go direct to OpenAI, Anthropic, Google, or any other model provider.", "scope": "required", "licenses": [ { "license": { "id": "Apache-2.0", "url": "https://opensource.org/licenses/Apache-2.0", "properties": [ { "name": "cdx:license:category", "value": "Permissive" }, { "name": "cdx:license:foss", "value": "true" }, { "name": "cdx:license:osiApproved", "value": "true" }, { "name": "cdx:license:fsfLibre", "value": "true" }, { "name": "cdx:license:deprecated", "value": "false" } ] } } ], "purl": "pkg:npm/ai@7.0.44", "externalReferences": [ { "type": "website", "url": "https://ai-sdk.dev/docs" }, { "type": "vcs", "url": "https://github.com/vercel/ai" } ], "type": "library", "bom-ref": "pkg:npm/ai@7.0.44", "properties": [ { "name": "SrcFile", "value": "node_modules/ai/package.json" }, { "name": "ImportedModules", "value": "ai,EmbedEndEvent,ai/EmbedEndEvent,EmbedStartEvent,ai/EmbedStartEvent,EmbeddingModelCallEndEvent,ai/EmbeddingModelCallEndEvent,EmbeddingModelCallStartEvent,ai/EmbeddingModelCallStartEvent,GenerateObjectEndEvent,ai/GenerateObjectEndEvent,GenerateObjectStartEvent,ai/GenerateObjectStartEvent,GenerateObjectStepEndEvent,ai/GenerateObjectStepEndEvent,GenerateObjectStepStartEvent,ai/GenerateObjectStepStartEvent,GenerateTextAbortEvent,ai/GenerateTextAbortEvent,GenerateTextEndEvent,ai/GenerateTextEndEvent,GenerateTextStartEvent,ai/GenerateTextStartEvent,GenerateTextStepEndEvent,ai/GenerateTextStepEndEvent,GenerateTextStepStartEvent,ai/GenerateTextStepStartEvent,LanguageModelCallEndEvent,ai/LanguageModelCallEndEvent,LanguageModelCallStartEvent,ai/LanguageModelCallStartEvent,RerankEndEvent,ai/RerankEndEvent,RerankStartEvent,ai/RerankStartEvent,RerankingModelCallEndEvent,ai/RerankingModelCallEndEvent,RerankingModelCallStartEvent,ai/RerankingModelCallStartEvent,Telemetry,ai/Telemetry,ToolExecutionEndEvent,ai/ToolExecutionEndEvent,ToolExecutionStartEvent,ai/ToolExecutionStartEvent,ToolSet,ai/ToolSet" }, { "name": "cdx:license:category", "value": "Permissive" } ], "evidence": { "identity": [ { "field": "purl", "confidence": 0.7, "methods": [ { "technique": "manifest-analysis", "confidence": 0.7, "value": "node_modules/ai/package.json" } ], "concludedValue": "node_modules/ai/package.json" } ], "occurrences": [ { "location": "src/LangfuseVercelAiSdkIntegration.ts", "line": 26 }, { "location": "dist/index.d.cts", "line": 1 } ] }, "tags": [ "ai" ] }, { "authors": [ { "name": "OpenTelemetry Authors" } ], "group": "@opentelemetry", "name": "api", "version": "1.9.1", "description": "Public API for OpenTelemetry", "scope": "required", "licenses": [ { "license": { "id": "Apache-2.0", "url": "https://opensource.org/licenses/Apache-2.0", "properties": [ { "name": "cdx:license:category", "value": "Permissive" }, { "name": "cdx:license:foss", "value": "true" }, { "name": "cdx:license:osiApproved", "value": "true" }, { "name": "cdx:license:fsfLibre", "value": "true" }, { "name": "cdx:license:deprecated", "value": "false" } ] } } ], "purl": "pkg:npm/%40opentelemetry/api@1.9.1", "externalReferences": [ { "type": "vcs", "url": "https://github.com/open-telemetry/opentelemetry-js/tree/main/api" } ], "type": "library", "bom-ref": "pkg:npm/@opentelemetry/api@1.9.1", "properties": [ { "name": "SrcFile", "value": "node_modules/@opentelemetry/api/package.json" }, { "name": "ImportedModules", "value": "@opentelemetry/api,Tracer,@opentelemetry/api/Tracer,Attributes,@opentelemetry/api/Attributes" }, { "name": "cdx:license:category", "value": "Permissive" } ], "evidence": { "identity": [ { "field": "purl", "confidence": 0.7, "methods": [ { "technique": "manifest-analysis", "confidence": 0.7, "value": "node_modules/@opentelemetry/api/package.json" } ], "concludedValue": "node_modules/@opentelemetry/api/package.json" } ], "occurrences": [ { "location": "src/types.ts", "line": 1 }, { "location": "src/utils.ts", "line": 3 }, { "location": "dist/index.d.cts", "line": 2 } ] }, "tags": [ "api" ] }, { "authors": [ { "name": "Langfuse" } ], "group": "@langfuse", "name": "core", "version": "5.11.1", "description": "Core functions and utilities for Langfuse packages", "scope": "required", "licenses": [ { "license": { "id": "MIT", "url": "https://opensource.org/licenses/MIT", "properties": [ { "name": "cdx:license:category", "value": "Permissive" }, { "name": "cdx:license:foss", "value": "true" }, { "name": "cdx:license:osiApproved", "value": "true" }, { "name": "cdx:license:fsfLibre", "value": "true" }, { "name": "cdx:license:deprecated", "value": "false" } ] } } ], "purl": "pkg:npm/%40langfuse/core@5.11.1", "externalReferences": [ { "type": "vcs", "url": "https://github.com/langfuse/langfuse-js.git" } ], "type": "library", "bom-ref": "pkg:npm/@langfuse/core@5.11.1", "properties": [ { "name": "SrcFile", "value": "node_modules/@langfuse/core/package.json" }, { "name": "ImportedModules", "value": "@langfuse/core,LangfuseOtelSpanAttributes,@langfuse/core/LangfuseOtelSpanAttributes" }, { "name": "cdx:license:category", "value": "Permissive" } ], "evidence": { "identity": [ { "field": "purl", "confidence": 0.7, "methods": [ { "technique": "manifest-analysis", "confidence": 0.7, "value": "node_modules/@langfuse/core/package.json" } ], "concludedValue": "node_modules/@langfuse/core/package.json" } ], "occurrences": [ { "location": "dist/index.cjs", "line": 31 }, { "location": "dist/index.mjs", "line": 5 }, { "location": "src/utils.ts", "line": 2 } ] } }, { "group": "@ai-sdk", "name": "otel", "version": "1.0.44", "scope": "required", "licenses": [ { "license": { "id": "Apache-2.0", "url": "https://opensource.org/licenses/Apache-2.0", "properties": [ { "name": "cdx:license:category", "value": "Permissive" }, { "name": "cdx:license:foss", "value": "true" }, { "name": "cdx:license:osiApproved", "value": "true" }, { "name": "cdx:license:fsfLibre", "value": "true" }, { "name": "cdx:license:deprecated", "value": "false" } ] } } ], "purl": "pkg:npm/%40ai-sdk/otel@1.0.44", "externalReferences": [ { "type": "website", "url": "https://ai-sdk.dev/docs" }, { "type": "vcs", "url": "https://github.com/vercel/ai" } ], "type": "framework", "bom-ref": "pkg:npm/@ai-sdk/otel@1.0.44", "properties": [ { "name": "SrcFile", "value": "node_modules/@ai-sdk/otel/package.json" }, { "name": "ImportedModules", "value": "@ai-sdk/otel,OpenTelemetry,@ai-sdk/otel/OpenTelemetry,OpenTelemetrySpanType,@ai-sdk/otel/OpenTelemetrySpanType" }, { "name": "cdx:license:category", "value": "Permissive" } ], "evidence": { "identity": [ { "field": "purl", "confidence": 0.7, "methods": [ { "technique": "manifest-analysis", "confidence": 0.7, "value": "node_modules/@ai-sdk/otel/package.json" } ], "concludedValue": "node_modules/@ai-sdk/otel/package.json" } ], "occurrences": [ { "location": "dist/index.cjs", "line": 28 }, { "location": "dist/index.mjs", "line": 2 }, { "location": "src/LangfuseVercelAiSdkIntegration.ts", "line": 1 }, { "location": "src/utils.ts", "line": 1 } ] }, "tags": [ "framework" ] } ], "dependencies": [], "annotations": [ { "bom-ref": "metadata-annotations", "subjects": [ "pkg:npm/@langfuse/vercel-ai-sdk@5.11.1" ], "annotator": { "component": { "group": "@cyclonedx", "name": "cdxgen", "version": "12.8.4", "purl": "pkg:npm/%40cyclonedx/cdxgen@12.8.4", "type": "application", "bom-ref": "pkg:npm/@cyclonedx/cdxgen@12.8.4", "publisher": "OWASP Foundation", "authors": [ { "name": "OWASP Foundation" } ] } }, "timestamp": "2026-09-14T03:36:31Z", "text": "This Software Bill-of-Materials (SBOM) document was created on Monday, September 14, 2026 with cdxgen. The data was captured during the pre-build lifecycle phase without building the application. The document describes an application named 'vercel-ai-sdk' with version '5.11.1'. The package type in this SBOM is npm with 3 purl namespaces described under components. The components were identified from 4 source files." } ] }