{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:cc22fc6e-9245-5ffd-9d63-d32071311f9b",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "baseline-browser-mapping",
      "purl": "pkg:npm/baseline-browser-mapping@2.11.26",
      "type": "library",
      "bom-ref": "pkg:npm/baseline-browser-mapping@2.11.26",
      "version": "2.11.26",
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2026-45819",
      "affects": [
        {
          "ref": "pkg:npm/baseline-browser-mapping@2.11.26"
        }
      ],
      "bom-ref": "urn:uuid:6b60f15e-9dff-529b-b86e-49b76243bf98",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2026-45819 does not affect version 2.11.26 of baseline-browser-mapping. not_affected \u2014 Target version 2.11.26 is not affected by CVE-2026-45819. The vulnerability (calling process.exit() instead of throwing errors on invalid input) was fixed in upstream version 2.11.0 by commit de733e2. Version 2.11.26 is built on top of the 2.11.0 release and contains the upstream fix. The vulnerable pattern (process.exit() calls in library functions getCompatibleVersions() and getAllVersions())...",
        "justification": "code_not_present"
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:npm/baseline-browser-mapping@2.11.26"
    }
  ]
}