{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:6179c527-f7b2-51b2-b360-aff672dc55c5",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "@ai-sdk/provider-utils",
      "purl": "pkg:npm/%40ai-sdk/provider-utils@3.0.28",
      "type": "library",
      "bom-ref": "pkg:npm/%40ai-sdk/provider-utils@3.0.28",
      "version": "3.0.28",
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2026-8769",
      "affects": [
        {
          "ref": "pkg:npm/%40ai-sdk/provider-utils@3.0.28"
        }
      ],
      "bom-ref": "urn:uuid:7e75a128-16b9-559d-87a4-31067ac06c7d",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2026-8769 does not affect version 3.0.28 of @ai-sdk/provider-utils. not_affected \u2014 Target version 3.0.28 is NOT AFFECTED by CVE-2026-8769. The vulnerability in JSON response handlers (createJsonResponseHandler, createJsonErrorResponseHandler, createStatusCodeErrorResponseHandler) that allowed unbounded memory consumption through arbitrarily large response bodies has been fixed by upstream commit b85c4fbc60. All affected handlers now use readResponseWithSizeLimit with a 2 GiB ...",
        "justification": "code_not_present"
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:npm/%40ai-sdk/provider-utils@3.0.28"
    }
  ]
}