{ "bomFormat": "CycloneDX", "specVersion": "1.7", "serialNumber": "urn:uuid:ab0e1d90-7381-4d08-9976-ebe9af8b80af", "version": 1, "metadata": { "timestamp": "2026-04-28T20:06:08Z", "tools": { "components": [ { "group": "@cyclonedx", "name": "cdxgen", "version": "12.2.1", "purl": "pkg:npm/%40cyclonedx/cdxgen@12.2.1", "type": "application", "bom-ref": "pkg:npm/@cyclonedx/cdxgen@12.2.1", "publisher": "OWASP Foundation", "authors": [ { "name": "OWASP Foundation" } ] } ] }, "authors": [ { "name": "OWASP Foundation" } ], "lifecycles": [ { "phase": "pre-build" } ], "distributionConstraints": { "tlp": "CLEAR" }, "component": { "name": "next-codemod", "group": "", "version": "16.0.6-tuxcare.3", "purl": "pkg:npm/next-codemod@16.0.6-tuxcare.3", "bom-ref": "pkg:npm/next-codemod@16.0.6-tuxcare.3", "type": "application", "licenses": [ { "license": { "id": "MIT", "url": "https://opensource.org/licenses/MIT" } } ] }, "properties": [ { "name": "cdx:bom:componentTypes", "value": "npm" }, { "name": "cdx:bom:componentNamespaces", "value": "@types" }, { "name": "cdx:bom:componentSrcFiles", "value": "node_modules/@types/find-up/package.json\\nnode_modules/@types/jscodeshift/package.json\\nnode_modules/@types/prompts/package.json\\nnode_modules/@types/semver/package.json\\nnode_modules/cheerio/package.json\\nnode_modules/commander/package.json\\nnode_modules/execa/package.json\\nnode_modules/find-up/package.json\\nnode_modules/globby/package.json\\nnode_modules/is-git-clean/package.json\\nnode_modules/jscodeshift/package.json\\nnode_modules/picocolors/package.json\\nnode_modules/prompts/package.json\\nnode_modules/semver/package.json\\nnode_modules/strip-ansi/package.json\\nnode_modules/typescript/package.json" } ] }, "components": [ { "authors": [ { "name": "Microsoft Corp." } ], "group": "", "name": "typescript", "version": "5.9.2", "description": "TypeScript is a language for application scale JavaScript development", "scope": "optional", "licenses": [ { "license": { "id": "Apache-2.0", "url": "https://opensource.org/licenses/Apache-2.0" } } ], "purl": "pkg:npm/typescript@5.9.2", "externalReferences": [ { "type": "website", "url": "https://www.typescriptlang.org/" }, { "type": "vcs", "url": "https://github.com/microsoft/TypeScript.git" } ], "type": "library", "bom-ref": "pkg:npm/typescript@5.9.2", "properties": [ { "name": "SrcFile", "value": "node_modules/typescript/package.json" } ], "evidence": { "identity": [ { "field": "purl", "confidence": 0.7, "methods": [ { "technique": "manifest-analysis", "confidence": 0.7, "value": "node_modules/typescript/package.json" } ], "concludedValue": "node_modules/typescript/package.json" } ] } }, { "authors": [ { "name": "Sindre Sorhus (sindresorhus.com)" } ], "group": "", "name": "strip-ansi", "version": "6.0.0", "description": "Strip ANSI escape codes from a string", "scope": "required", "licenses": [ { "license": { "id": "MIT", "url": "https://opensource.org/licenses/MIT" } } ], "purl": "pkg:npm/strip-ansi@6.0.0", "type": "library", "bom-ref": "pkg:npm/strip-ansi@6.0.0", "properties": [ { "name": "SrcFile", "value": "node_modules/strip-ansi/package.json" }, { "name": "ImportedModules", "value": "strip-ansi" } ], "evidence": { "identity": [ { "field": "purl", "confidence": 0.7, "methods": [ { "technique": "manifest-analysis", "confidence": 0.7, "value": "node_modules/strip-ansi/package.json" } ], "concludedValue": "node_modules/strip-ansi/package.json" } ], "occurrences": [ { "location": "bin/transform.js#11" }, { "location": "bin/transform.ts#4" } ] }, "tags": [ "escape" ] }, { "authors": [ { "name": "GitHub Inc." } ], "group": "", "name": "semver", "version": "7.6.3", "description": "The semantic version parser used by npm.", "scope": "required", "licenses": [ { "license": { "id": "ISC", "url": "https://opensource.org/licenses/ISC" } } ], "purl": "pkg:npm/semver@7.6.3", "externalReferences": [ { "type": "vcs", "url": "git+https://github.com/npm/node-semver.git" } ], "type": "library", "bom-ref": "pkg:npm/semver@7.6.3", "properties": [ { "name": "SrcFile", "value": "node_modules/semver/package.json" }, { "name": "ImportedModules", "value": "semver,satisfies,semver/satisfies,compare,semver/compare,major,semver/major" } ], "evidence": { "identity": [ { "field": "purl", "confidence": 0.7, "methods": [ { "technique": "manifest-analysis", "confidence": 0.7, "value": "node_modules/semver/package.json" } ], "concludedValue": "node_modules/semver/package.json" } ], "occurrences": [ { "location": "bin/upgrade.js#43" }, { "location": "transforms/next-lint-to-eslint-cli.js#11" }, { "location": "bin/upgrade.ts#8" }, { "location": "transforms/next-lint-to-eslint-cli.ts#4" } ] } }, { "authors": [ { "name": "Terkel Gjervig (https://terkel.com)" } ], "group": "", "name": "prompts", "version": "2.4.2", "description": "Lightweight, beautiful and user-friendly prompts", "scope": "required", "licenses": [ { "license": { "id": "MIT", "url": "https://opensource.org/licenses/MIT" } } ], "purl": "pkg:npm/prompts@2.4.2", "type": "library", "bom-ref": "pkg:npm/prompts@2.4.2", "properties": [ { "name": "SrcFile", "value": "node_modules/prompts/package.json" }, { "name": "ImportedModules", "value": "prompts" } ], "evidence": { "identity": [ { "field": "purl", "confidence": 0.7, "methods": [ { "technique": "manifest-analysis", "confidence": 0.7, "value": "node_modules/prompts/package.json" } ], "concludedValue": "node_modules/prompts/package.json" } ], "occurrences": [ { "location": "bin/transform.js#10" }, { "location": "bin/upgrade.js#41" }, { "location": "bin/transform.ts#3" }, { "location": "bin/upgrade.ts#2" } ] } }, { "authors": [ { "name": "Alexey Raspopov" } ], "group": "", "name": "picocolors", "version": "1.0.0", "description": "The tiniest and the fastest library for terminal output formatting with ANSI colors", "scope": "required", "licenses": [ { "license": { "id": "ISC", "url": "https://opensource.org/licenses/ISC" } } ], "purl": "pkg:npm/picocolors@1.0.0", "type": "library", "bom-ref": "pkg:npm/picocolors@1.0.0", "properties": [ { "name": "SrcFile", "value": "node_modules/picocolors/package.json" }, { "name": "ImportedModules", "value": "picocolors,yellow,picocolors/yellow,white,picocolors/white,bold,picocolors/bold,picocolors/red,green,picocolors/green,magenta,picocolors/magenta" } ], "evidence": { "identity": [ { "field": "purl", "confidence": 0.7, "methods": [ { "technique": "manifest-analysis", "confidence": 0.7, "value": "node_modules/picocolors/package.json" } ], "concludedValue": "node_modules/picocolors/package.json" } ], "occurrences": [ { "location": "bin/upgrade.js#46" }, { "location": "lib/install.js#8" }, { "location": "lib/utils.js#9" }, { "location": "transforms/next-lint-to-eslint-cli.js#14" }, { "location": "bin/upgrade.ts#11" }, { "location": "lib/install.ts#2" }, { "location": "lib/utils.ts#1" }, { "location": "transforms/next-lint-to-eslint-cli.ts#7" } ] } }, { "authors": [ { "name": "Felix Kling" } ], "group": "", "name": "jscodeshift", "version": "17.0.0", "description": "A toolkit for JavaScript codemods", "scope": "required", "licenses": [ { "license": { "id": "MIT", "url": "https://opensource.org/licenses/MIT" } } ], "purl": "pkg:npm/jscodeshift@17.0.0", "externalReferences": [ { "type": "vcs", "url": "https://github.com/facebook/jscodeshift.git" } ], "type": "library", "bom-ref": "pkg:npm/jscodeshift@17.0.0", "properties": [ { "name": "SrcFile", "value": "node_modules/jscodeshift/package.json" }, { "name": "ImportedModules", "value": "jscodeshift,jscodeshift/parser/babylon,jscodeshift/parser/tsOptions,jscodeshift/src/Runner,jscodeshift/API,FileInfo,jscodeshift/FileInfo,Options,jscodeshift/Options,JSXElement,jscodeshift/JSXElement,Collection,jscodeshift/Collection,JSCodeshift,jscodeshift/JSCodeshift,ASTPath,jscodeshift/ASTPath,CallExpression,jscodeshift/CallExpression,ObjectPattern,jscodeshift/ObjectPattern,Identifier,jscodeshift/Identifier,ArrowFunctionExpression,jscodeshift/ArrowFunctionExpression,ExportDefaultDeclaration,jscodeshift/ExportDefaultDeclaration,ExportNamedDeclaration,jscodeshift/ExportNamedDeclaration,FunctionDeclaration,jscodeshift/FunctionDeclaration,FunctionExpression,jscodeshift/FunctionExpression,ObjectExpression,jscodeshift/ObjectExpression,ObjectProperty,jscodeshift/ObjectProperty,Property,jscodeshift/Property,SpreadElement,jscodeshift/SpreadElement,SpreadProperty,jscodeshift/SpreadProperty,ObjectMethod,jscodeshift/ObjectMethod,ImportDefaultSpecifier,jscodeshift/ImportDefaultSpecifier,JSXAttribute,jscodeshift/JSXAttribute,Node,jscodeshift/Node,ImportSpecifier,jscodeshift/ImportSpecifier" } ], "evidence": { "identity": [ { "field": "purl", "confidence": 0.7, "methods": [ { "technique": "manifest-analysis", "confidence": 0.7, "value": "node_modules/jscodeshift/package.json" } ], "concludedValue": "node_modules/jscodeshift/package.json" } ], "occurrences": [ { "location": "lib/parser.js#7" }, { "location": "lib/parser.js#8" }, { "location": "lib/parser.js#9" }, { "location": "lib/run-jscodeshift.js#8" }, { "location": "lib/cra-to-next/global-css-transform.ts#2" }, { "location": "lib/cra-to-next/index-to-component.ts#1" }, { "location": "lib/parser.ts#1" }, { "location": "lib/parser.ts#2" }, { "location": "lib/parser.ts#3" }, { "location": "lib/run-jscodeshift.ts#2" }, { "location": "transforms/add-missing-react-import.ts#7" }, { "location": "transforms/app-dir-runtime-config-experimental-edge.ts#1" }, { "location": "transforms/built-in-next-font.ts#1" }, { "location": "transforms/lib/async-request-api/index.ts#1" }, { "location": "transforms/lib/async-request-api/next-async-dynamic-api.ts#1" }, { "location": "transforms/lib/async-request-api/next-async-dynamic-prop.ts#7" }, { "location": "transforms/lib/async-request-api/utils.ts#10" }, { "location": "transforms/lib/utils.ts#1" }, { "location": "transforms/metadata-to-viewport-export.ts#1" }, { "location": "transforms/middleware-to-proxy.ts#12" }, { "location": "transforms/name-default-component.ts#9" }, { "location": "transforms/new-link.ts#4" }, { "location": "transforms/next-experimental-turbo-to-turbopack.ts#20" }, { "location": "transforms/next-image-experimental.ts#11" }, { "location": "transforms/next-image-to-legacy-image.ts#1" }, { "location": "transforms/next-og-import.ts#1" }, { "location": "transforms/next-request-geo-ip.ts#10" }, { "location": "transforms/remove-experimental-ppr.ts#1" }, { "location": "transforms/remove-unstable-prefix.ts#1" } ] } }, { "authors": [ { "name": "James Talmage (github.com/jamestalmage)" } ], "group": "", "name": "is-git-clean", "version": "1.1.0", "description": "Find out if a git directory is clean or not", "scope": "required", "licenses": [ { "license": { "id": "MIT", "url": "https://opensource.org/licenses/MIT" } } ], "purl": "pkg:npm/is-git-clean@1.1.0", "type": "library", "bom-ref": "pkg:npm/is-git-clean@1.1.0", "properties": [ { "name": "SrcFile", "value": "node_modules/is-git-clean/package.json" }, { "name": "ImportedModules", "value": "is-git-clean" } ], "evidence": { "identity": [ { "field": "purl", "confidence": 0.7, "methods": [ { "technique": "manifest-analysis", "confidence": 0.7, "value": "node_modules/is-git-clean/package.json" } ], "concludedValue": "node_modules/is-git-clean/package.json" } ], "occurrences": [ { "location": "lib/utils.js#10" }, { "location": "lib/utils.ts#2" } ] } }, { "authors": [ { "name": "Sindre Sorhus (sindresorhus.com)" } ], "group": "", "name": "globby", "version": "11.0.1", "description": "User-friendly glob matching", "scope": "required", "licenses": [ { "license": { "id": "MIT", "url": "https://opensource.org/licenses/MIT" } } ], "purl": "pkg:npm/globby@11.0.1", "type": "library", "bom-ref": "pkg:npm/globby@11.0.1", "properties": [ { "name": "SrcFile", "value": "node_modules/globby/package.json" }, { "name": "ImportedModules", "value": "globby" } ], "evidence": { "identity": [ { "field": "purl", "confidence": 0.7, "methods": [ { "technique": "manifest-analysis", "confidence": 0.7, "value": "node_modules/globby/package.json" } ], "concludedValue": "node_modules/globby/package.json" } ], "occurrences": [ { "location": "bin/transform.js#9" }, { "location": "transforms/cra-to-next.js#10" }, { "location": "bin/transform.ts#2" }, { "location": "transforms/cra-to-next.ts#4" } ] } }, { "authors": [ { "name": "Sindre Sorhus (sindresorhus.com)" } ], "group": "", "name": "find-up", "version": "4.1.0", "description": "Find a file or directory by walking up parent directories", "scope": "required", "licenses": [ { "license": { "id": "MIT", "url": "https://opensource.org/licenses/MIT" } } ], "purl": "pkg:npm/find-up@4.1.0", "type": "library", "bom-ref": "pkg:npm/find-up@4.1.0", "properties": [ { "name": "SrcFile", "value": "node_modules/find-up/package.json" }, { "name": "ImportedModules", "value": "find-up" } ], "evidence": { "identity": [ { "field": "purl", "confidence": 0.7, "methods": [ { "technique": "manifest-analysis", "confidence": 0.7, "value": "node_modules/find-up/package.json" } ], "concludedValue": "node_modules/find-up/package.json" } ], "occurrences": [ { "location": "lib/handle-package.js#11" }, { "location": "lib/handle-package.ts#1" } ] } }, { "authors": [ { "name": "Sindre Sorhus (https://sindresorhus.com)" } ], "group": "", "name": "execa", "version": "4.0.3", "description": "Process execution for humans", "scope": "required", "licenses": [ { "license": { "id": "MIT", "url": "https://opensource.org/licenses/MIT" } } ], "purl": "pkg:npm/execa@4.0.3", "type": "library", "bom-ref": "pkg:npm/execa@4.0.3", "properties": [ { "name": "SrcFile", "value": "node_modules/execa/package.json" }, { "name": "ImportedModules", "value": "execa" } ], "evidence": { "identity": [ { "field": "purl", "confidence": 0.7, "methods": [ { "technique": "manifest-analysis", "confidence": 0.7, "value": "node_modules/execa/package.json" } ], "concludedValue": "node_modules/execa/package.json" } ], "occurrences": [ { "location": "bin/transform.js#8" }, { "location": "lib/handle-package.js#12" }, { "location": "transforms/cra-to-next.js#9" }, { "location": "bin/transform.ts#1" }, { "location": "lib/handle-package.ts#2" }, { "location": "transforms/cra-to-next.ts#3" } ] } }, { "authors": [ { "name": "TJ Holowaychuk " } ], "group": "", "name": "commander", "version": "12.1.0", "description": "the complete solution for node.js command-line programs", "scope": "required", "licenses": [ { "license": { "id": "MIT", "url": "https://opensource.org/licenses/MIT" } } ], "purl": "pkg:npm/commander@12.1.0", "externalReferences": [ { "type": "vcs", "url": "git+https://github.com/tj/commander.js.git" } ], "type": "library", "bom-ref": "pkg:npm/commander@12.1.0", "properties": [ { "name": "SrcFile", "value": "node_modules/commander/package.json" }, { "name": "ImportedModules", "value": "commander,Command,commander/Command" } ], "evidence": { "identity": [ { "field": "purl", "confidence": 0.7, "methods": [ { "technique": "manifest-analysis", "confidence": 0.7, "value": "node_modules/commander/package.json" } ], "concludedValue": "node_modules/commander/package.json" } ], "occurrences": [ { "location": "bin/next-codemod.js#13" }, { "location": "bin/next-codemod.ts#12" } ] } }, { "authors": [ { "name": "Matt Mueller (mat.io)" } ], "group": "", "name": "cheerio", "version": "1.0.0-rc.9", "description": "Tiny, fast, and elegant implementation of core jQuery designed specifically for the server", "scope": "required", "licenses": [ { "license": { "id": "MIT", "url": "https://opensource.org/licenses/MIT" } } ], "purl": "pkg:npm/cheerio@1.0.0-rc.9", "externalReferences": [ { "type": "website", "url": "https://cheerio.js.org/" }, { "type": "vcs", "url": "git://github.com/cheeriojs/cheerio.git" } ], "type": "library", "bom-ref": "pkg:npm/cheerio@1.0.0-rc.9", "properties": [ { "name": "SrcFile", "value": "node_modules/cheerio/package.json" }, { "name": "ImportedModules", "value": "cheerio" } ], "evidence": { "identity": [ { "field": "purl", "confidence": 0.7, "methods": [ { "technique": "manifest-analysis", "confidence": 0.7, "value": "node_modules/cheerio/package.json" } ], "concludedValue": "node_modules/cheerio/package.json" } ], "occurrences": [ { "location": "transforms/cra-to-next.js#11" }, { "location": "transforms/cra-to-next.ts#5" } ] } }, { "group": "@types", "name": "semver", "version": "7.3.1", "description": "TypeScript definitions for semver", "scope": "optional", "licenses": [ { "license": { "id": "MIT", "url": "https://opensource.org/licenses/MIT" } } ], "purl": "pkg:npm/%40types/semver@7.3.1", "externalReferences": [ { "type": "vcs", "url": "https://github.com/DefinitelyTyped/DefinitelyTyped.git" } ], "type": "library", "bom-ref": "pkg:npm/@types/semver@7.3.1", "properties": [ { "name": "SrcFile", "value": "node_modules/@types/semver/package.json" } ], "evidence": { "identity": [ { "field": "purl", "confidence": 0.7, "methods": [ { "technique": "manifest-analysis", "confidence": 0.7, "value": "node_modules/@types/semver/package.json" } ], "concludedValue": "node_modules/@types/semver/package.json" } ] } }, { "group": "@types", "name": "prompts", "version": "2.4.2", "description": "TypeScript definitions for prompts", "scope": "optional", "licenses": [ { "license": { "id": "MIT", "url": "https://opensource.org/licenses/MIT" } } ], "purl": "pkg:npm/%40types/prompts@2.4.2", "externalReferences": [ { "type": "vcs", "url": "https://github.com/DefinitelyTyped/DefinitelyTyped/tree/master/types/prompts" }, { "type": "vcs", "url": "https://github.com/DefinitelyTyped/DefinitelyTyped.git" } ], "type": "library", "bom-ref": "pkg:npm/@types/prompts@2.4.2", "properties": [ { "name": "SrcFile", "value": "node_modules/@types/prompts/package.json" } ], "evidence": { "identity": [ { "field": "purl", "confidence": 0.7, "methods": [ { "technique": "manifest-analysis", "confidence": 0.7, "value": "node_modules/@types/prompts/package.json" } ], "concludedValue": "node_modules/@types/prompts/package.json" } ] } }, { "group": "@types", "name": "jscodeshift", "version": "0.11.0", "description": "TypeScript definitions for jscodeshift", "scope": "optional", "licenses": [ { "license": { "id": "MIT", "url": "https://opensource.org/licenses/MIT" } } ], "purl": "pkg:npm/%40types/jscodeshift@0.11.0", "externalReferences": [ { "type": "vcs", "url": "https://github.com/DefinitelyTyped/DefinitelyTyped.git" } ], "type": "library", "bom-ref": "pkg:npm/@types/jscodeshift@0.11.0", "properties": [ { "name": "SrcFile", "value": "node_modules/@types/jscodeshift/package.json" } ], "evidence": { "identity": [ { "field": "purl", "confidence": 0.7, "methods": [ { "technique": "manifest-analysis", "confidence": 0.7, "value": "node_modules/@types/jscodeshift/package.json" } ], "concludedValue": "node_modules/@types/jscodeshift/package.json" } ] } }, { "group": "@types", "name": "find-up", "version": "4.0.0", "description": "Stub TypeScript definitions entry for find-up, which provides its own types definitions", "scope": "optional", "licenses": [ { "license": { "id": "MIT", "url": "https://opensource.org/licenses/MIT" } } ], "purl": "pkg:npm/%40types/find-up@4.0.0", "type": "library", "bom-ref": "pkg:npm/@types/find-up@4.0.0", "properties": [ { "name": "SrcFile", "value": "node_modules/@types/find-up/package.json" } ], "evidence": { "identity": [ { "field": "purl", "confidence": 0.7, "methods": [ { "technique": "manifest-analysis", "confidence": 0.7, "value": "node_modules/@types/find-up/package.json" } ], "concludedValue": "node_modules/@types/find-up/package.json" } ] } } ], "dependencies": [], "annotations": [ { "bom-ref": "metadata-annotations", "subjects": [ "pkg:npm/next-codemod@16.0.6-tuxcare.3" ], "annotator": { "component": { "group": "@cyclonedx", "name": "cdxgen", "version": "12.2.1", "purl": "pkg:npm/%40cyclonedx/cdxgen@12.2.1", "type": "application", "bom-ref": "pkg:npm/@cyclonedx/cdxgen@12.2.1", "publisher": "OWASP Foundation", "authors": [ { "name": "OWASP Foundation" } ] } }, "timestamp": "2026-04-28T20:06:08Z", "text": "This Software Bill-of-Materials (SBOM) document was created on Tuesday, April 28, 2026 with cdxgen. The data was captured during the pre-build lifecycle phase without building the application. The document describes an application named 'next-codemod' with version '16.0.6-tuxcare.3'. The package type in this SBOM is npm with a single purl namespace '@types' described under components. The components were identified from 16 source files." } ] }