{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:3fe38b42-4f6e-530a-9e5c-1f6d637d007c",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "@ai-sdk/provider-utils",
      "purl": "pkg:npm/%40ai-sdk/provider-utils@3.0.37",
      "type": "library",
      "bom-ref": "pkg:npm/%40ai-sdk/provider-utils@3.0.37",
      "version": "3.0.37",
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2026-8769",
      "affects": [
        {
          "ref": "pkg:npm/%40ai-sdk/provider-utils@3.0.37"
        }
      ],
      "bom-ref": "urn:uuid:d6036e0e-ed30-515a-9752-7dce92d25c6e",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2026-8769 does not affect version 3.0.37 of @ai-sdk/provider-utils. not_affected \u2014 The target version 3.0.37 of @ai-sdk/provider-utils is NOT AFFECTED by CVE-2026-8769. The vulnerability (uncontrolled resource consumption in response body reading) was fixed in the upstream release before TuxCare onboarded this package. The three vulnerable functions (createJsonResponseHandler, createJsonErrorResponseHandler, createStatusCodeErrorResponseHandler) all use readResponseWithSizeLi...",
        "justification": "code_not_present"
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:npm/%40ai-sdk/provider-utils@3.0.37"
    }
  ]
}