{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:adc2baf1-bcb7-5d85-9679-b896a4616c4b",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "@ai-sdk/provider-utils",
      "purl": "pkg:npm/%40ai-sdk/provider-utils@5.0.30",
      "type": "library",
      "bom-ref": "pkg:npm/%40ai-sdk/provider-utils@5.0.30",
      "version": "5.0.30",
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2026-8769",
      "affects": [
        {
          "ref": "pkg:npm/%40ai-sdk/provider-utils@5.0.30"
        }
      ],
      "bom-ref": "urn:uuid:faef14d8-97bb-552b-b4e3-aff81fec4cff",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2026-8769 does not affect version 5.0.30 of @ai-sdk/provider-utils. not_affected \u2014 CVE-2026-8769 describes uncontrolled resource consumption in @ai-sdk/provider-utils versions before 3.0.28, 4.0.0-4.0.32, and 5.0.0. The target is version 5.0.30, which includes the upstream fix introduced in version 5.0.1 (commit 6a436e31d by Gregor Martynus, June 27, 2026). The three vulnerable functions (createJsonResponseHandler, createJsonErrorResponseHandler, createStatusCodeErrorResponse...",
        "justification": "code_not_present"
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:npm/%40ai-sdk/provider-utils@5.0.30"
    }
  ]
}