{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:7a09f27f-01d8-5346-bb32-c2985d58e64a",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "spring-ai-milvus-store",
      "purl": "pkg:maven/org.springframework.ai/spring-ai-milvus-store@1.1.8-tuxcare.1",
      "type": "library",
      "group": "org.springframework.ai",
      "bom-ref": "pkg:maven/org.springframework.ai/spring-ai-milvus-store@1.1.8-tuxcare.1",
      "version": "1.1.8-tuxcare.1",
      "pedigree": {
        "ancestors": [
          {
            "name": "spring-ai-milvus-store",
            "purl": "pkg:maven/org.springframework.ai/spring-ai-milvus-store@1.1.8",
            "type": "library",
            "group": "org.springframework.ai",
            "version": "1.1.8"
          }
        ]
      },
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2026-41705",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework.ai/spring-ai-milvus-store@1.1.8-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:a11745db-c8b5-570c-8b7d-ef9e9aac709c",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2026-41705 does not affect version 1.1.8-tuxcare.1 of org.springframework.ai:spring-ai-milvus-store. The target Spring AI 1.1.8 is not affected by CVE-2026-41705. The vulnerable filter-expression injection pattern in MilvusVectorStore#doDelete(List) was fixed by upstream commit 20206a464 (author: soby.chacko@broadcom.com) which replaced naive string concatenation with Jackson-based JSON serialization for proper escaping. This fix was already present in the upstream 1.1.8 release that TuxCare onboarded, as confirmed by the fix commit being an ancestor of the first TuxCare onboarding commit (91d00bb3a).\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 1.0.0, < 1.0.7; >= 1.1.0, < 1.1.6; >= 1.0.0, < 1.0.7; >= 1.1.0, < 1.1.6), NVD (>= 1.0.0, < 1.0.7; >= 1.1.0, < 1.1.6), cve.org (>= 1.0.0, < 1.0.7; >= 1.1.0, < 1.1.6), Snyk (< 1.0.7; >= 1.1.0-M1, < 1.1.6; < 1.0.7; >= 1.1.0-M1, < 1.1.6).",
        "justification": "code_not_present"
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:maven/org.springframework.ai/spring-ai-milvus-store@1.1.8-tuxcare.1"
    }
  ]
}