{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:5d45b7fd-6058-5832-977c-141085c8d2e4",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "@ai-sdk/provider-utils",
      "purl": "pkg:npm/%40ai-sdk/provider-utils@5.0.33",
      "type": "library",
      "bom-ref": "pkg:npm/%40ai-sdk/provider-utils@5.0.33",
      "version": "5.0.33",
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2026-8769",
      "affects": [
        {
          "ref": "pkg:npm/%40ai-sdk/provider-utils@5.0.33"
        }
      ],
      "bom-ref": "urn:uuid:54873f52-fb7b-5230-bd5e-3b7f4cc511a3",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2026-8769 does not affect version 5.0.33 of @ai-sdk/provider-utils. not_affected \u2014 The target version 5.0.33 is not affected by CVE-2026-8769. The vulnerability (uncontrolled resource consumption in response body reading) was fixed by upstream commit 4024a3af6d on Feb 12, 2026, which was already present in the upstream release before TuxCare onboarded this version. All three vulnerable functions (createJsonResponseHandler, createJsonErrorResponseHandler, createStatusCodeError...",
        "justification": "code_not_present"
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:npm/%40ai-sdk/provider-utils@5.0.33"
    }
  ]
}