{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:90d0edb9-2dbf-575e-a70e-09204b9772bc",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "@ai-sdk/provider-utils",
      "purl": "pkg:npm/%40ai-sdk/provider-utils@5.0.29",
      "type": "library",
      "bom-ref": "pkg:npm/%40ai-sdk/provider-utils@5.0.29",
      "version": "5.0.29",
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2026-8769",
      "affects": [
        {
          "ref": "pkg:npm/%40ai-sdk/provider-utils@5.0.29"
        }
      ],
      "bom-ref": "urn:uuid:a30dc0cb-f1ce-5811-bb73-4f86e2f5297c",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2026-8769 does not affect version 5.0.29 of @ai-sdk/provider-utils. not_affected \u2014 Target version 5.0.29 is NOT vulnerable. The uncontrolled resource consumption vulnerability (CVE-2026-8769) affecting response handlers in versions before 5.0.1 was fixed by upstream commit 6a436e31d2 on June 27, 2026. This fix integrated size limits (2 GiB default) into all three vulnerable functions (createJsonResponseHandler, createJsonErrorResponseHandler, createStatusCodeErrorResponseHand...",
        "justification": "code_not_present"
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:npm/%40ai-sdk/provider-utils@5.0.29"
    }
  ]
}