{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:36b61cd4-3442-5a35-9b9a-2ff6e1d79289",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "@ai-sdk/provider-utils",
      "purl": "pkg:npm/%40ai-sdk/provider-utils@4.0.54",
      "type": "library",
      "bom-ref": "pkg:npm/%40ai-sdk/provider-utils@4.0.54",
      "version": "4.0.54",
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2026-8769",
      "affects": [
        {
          "ref": "pkg:npm/%40ai-sdk/provider-utils@4.0.54"
        }
      ],
      "bom-ref": "urn:uuid:8cc98007-099c-53bb-91e8-1a9e9e07bc25",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2026-8769 does not affect version 4.0.54 of @ai-sdk/provider-utils. not_affected \u2014 The target @ai-sdk/provider-utils version 4.0.54 is not affected by CVE-2026-8769. The vulnerability (uncontrolled resource consumption via unbounded response body reads) was fixed in the upstream release version 4.0.33 on June 27, 2026. The current version includes the fix, which adds size limits to all three vulnerable functions (createJsonResponseHandler, createJsonErrorResponseHandler, crea...",
        "justification": "code_not_present"
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:npm/%40ai-sdk/provider-utils@4.0.54"
    }
  ]
}