{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:286677ce-e2cf-5366-be74-1de6f3fac972",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "@ai-sdk/provider-utils",
      "purl": "pkg:npm/%40ai-sdk/provider-utils@3.0.38",
      "type": "library",
      "bom-ref": "pkg:npm/%40ai-sdk/provider-utils@3.0.38",
      "version": "3.0.38",
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2026-8769",
      "affects": [
        {
          "ref": "pkg:npm/%40ai-sdk/provider-utils@3.0.38"
        }
      ],
      "bom-ref": "urn:uuid:18a417d7-1fc2-5fea-8295-dada6b4407bb",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2026-8769 does not affect version 3.0.38 of @ai-sdk/provider-utils. not_affected \u2014 The target repository (@ai-sdk/provider-utils v3.0.38) is not affected by CVE-2026-8769. The vulnerability described uncontrolled resource consumption in response body reading without size limits. However, the upstream vendor (Vercel) already fixed this vulnerability before version 3.0.38 was released. The fix introduces readResponseWithSizeLimit (2 GiB default limit) that is used by all three ...",
        "justification": "code_not_present"
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:npm/%40ai-sdk/provider-utils@3.0.38"
    }
  ]
}