{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:fd580667-f0f1-5892-a279-c204ae2c1736",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "@ai-sdk/provider-utils",
      "purl": "pkg:npm/%40ai-sdk/provider-utils@5.0.55",
      "type": "library",
      "bom-ref": "pkg:npm/%40ai-sdk/provider-utils@5.0.55",
      "version": "5.0.55",
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2026-8769",
      "affects": [
        {
          "ref": "pkg:npm/%40ai-sdk/provider-utils@5.0.55"
        }
      ],
      "bom-ref": "urn:uuid:b4e789f1-00da-5550-a226-8a39f1ca3e44",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2026-8769 does not affect version 5.0.55 of @ai-sdk/provider-utils. not_affected \u2014 CVE-2026-8769 describes uncontrolled resource consumption in @ai-sdk/provider-utils versions before 3.0.28, 4.0.0-4.0.32, and 5.0.0 (before 5.0.1) where createJsonResponseHandler, createJsonErrorResponseHandler, and createStatusCodeErrorResponseHandler read response bodies without size limits. The target version (5.0.55) contains the upstream vendor fix that was already present in the release b...",
        "justification": "code_not_present"
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:npm/%40ai-sdk/provider-utils@5.0.55"
    }
  ]
}