{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:626037d5-fa2b-5cad-a934-9b14edbf9f70",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "@ai-sdk/provider-utils",
      "purl": "pkg:npm/%40ai-sdk/provider-utils@4.0.51",
      "type": "library",
      "bom-ref": "pkg:npm/%40ai-sdk/provider-utils@4.0.51",
      "version": "4.0.51",
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2026-8769",
      "affects": [
        {
          "ref": "pkg:npm/%40ai-sdk/provider-utils@4.0.51"
        }
      ],
      "bom-ref": "urn:uuid:87be0798-6a9c-5659-a9bd-ee8a5dc57866",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2026-8769 does not affect version 4.0.51 of @ai-sdk/provider-utils. not_affected \u2014 Target version 4.0.51 is NOT AFFECTED by CVE-2026-8769. The vulnerability (uncontrolled resource consumption via unbounded response body reads) was fixed in upstream version 4.0.33, and version 4.0.51 includes this fix. All three vulnerable functions (createJsonResponseHandler, createJsonErrorResponseHandler, createStatusCodeErrorResponseHandler) now use readResponseWithSizeLimit with a 2 GiB d...",
        "justification": "code_not_present"
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:npm/%40ai-sdk/provider-utils@4.0.51"
    }
  ]
}