{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:172e7b18-d6ae-5728-9808-84c01f815531",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "@babel/runtime-corejs3",
      "purl": "pkg:npm/%40babel/runtime-corejs3@7.29.0-tuxcare.3",
      "type": "library",
      "bom-ref": "pkg:npm/%40babel/runtime-corejs3@7.29.0-tuxcare.3",
      "version": "7.29.0-tuxcare.3",
      "pedigree": {
        "ancestors": [
          {
            "name": "@babel/runtime-corejs3",
            "purl": "pkg:npm/%40babel/runtime-corejs3@7.29.0",
            "type": "library",
            "version": "7.29.0"
          }
        ]
      },
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2025-27789",
      "affects": [
        {
          "ref": "pkg:npm/%40babel/runtime-corejs3@7.29.0-tuxcare.3"
        }
      ],
      "bom-ref": "urn:uuid:d72615c0-4e33-5761-9b1c-d2ea9298e3b0",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2025-27789 does not affect version 7.29.0-tuxcare.3 of @babel/runtime-corejs3. not_affected \u2014 CVE-2025-27789 (quadratic complexity in Babel's wrapRegExp helper for regex named capturing groups) is not present in this target. The upstream fix (commit d5952e80c0) was shipped in the upstream release (version 7.29.0) before TuxCare onboarded this codebase. The vulnerable regex pattern /\\$<([^>]+)>/g has been replaced with /\\$<([^>]+)(>|$)/g plus validation that prevents quadratic-time proce...",
        "justification": "code_not_present"
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:npm/%40babel/runtime-corejs3@7.29.0-tuxcare.3"
    }
  ]
}