{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:893fb0d6-8da2-5827-b29a-86d4da5ae143",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "@ai-sdk/provider-utils",
      "purl": "pkg:npm/%40ai-sdk/provider-utils@4.0.57",
      "type": "library",
      "bom-ref": "pkg:npm/%40ai-sdk/provider-utils@4.0.57",
      "version": "4.0.57",
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2026-8769",
      "affects": [
        {
          "ref": "pkg:npm/%40ai-sdk/provider-utils@4.0.57"
        }
      ],
      "bom-ref": "urn:uuid:c5ba2959-7fde-52d6-866c-69b5a8ac6a5b",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2026-8769 does not affect version 4.0.57 of @ai-sdk/provider-utils. not_affected \u2014 CVE-2026-8769 describes uncontrolled resource consumption in @ai-sdk/provider-utils versions before 3.0.28, from 4.0.0 before 4.0.33, and from 5.0.0 before 5.0.1, where createJsonResponseHandler, createJsonErrorResponseHandler, and createStatusCodeErrorResponseHandler read response bodies without size limits. The target version 4.0.57 is not affected because the upstream fix (commit 4024a3af6d ...",
        "justification": "code_not_present"
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:npm/%40ai-sdk/provider-utils@4.0.57"
    }
  ]
}