{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:cd52cda2-2b01-5e63-9097-6f14160059df",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "@ai-sdk/provider-utils",
      "purl": "pkg:npm/%40ai-sdk/provider-utils@5.0.34",
      "type": "library",
      "bom-ref": "pkg:npm/%40ai-sdk/provider-utils@5.0.34",
      "version": "5.0.34",
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2026-8769",
      "affects": [
        {
          "ref": "pkg:npm/%40ai-sdk/provider-utils@5.0.34"
        }
      ],
      "bom-ref": "urn:uuid:49aca062-206d-554b-9e2e-a1059a8fdaf0",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2026-8769 does not affect version 5.0.34 of @ai-sdk/provider-utils. not_affected \u2014 CVE-2026-8769 describes uncontrolled resource consumption in @ai-sdk/provider-utils where three response handler functions read response bodies without size limits, allowing attackers to cause excessive memory consumption. Target version 5.0.34 is NOT AFFECTED because the fix was already present in the upstream release at version 5.0.1 (shipped June 27, 2026), before TuxCare onboarded this code...",
        "justification": "code_not_present"
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:npm/%40ai-sdk/provider-utils@5.0.34"
    }
  ]
}