{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:2b358342-ea6f-591c-901e-5b51fc189ead",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "@ai-sdk/provider-utils",
      "purl": "pkg:npm/%40ai-sdk/provider-utils@5.0.46",
      "type": "library",
      "bom-ref": "pkg:npm/%40ai-sdk/provider-utils@5.0.46",
      "version": "5.0.46",
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2026-8769",
      "affects": [
        {
          "ref": "pkg:npm/%40ai-sdk/provider-utils@5.0.46"
        }
      ],
      "bom-ref": "urn:uuid:3c6f9f5c-84ac-512f-84bb-c41eb6215bdd",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2026-8769 does not affect version 5.0.46 of @ai-sdk/provider-utils. not_affected \u2014 The vulnerability described in CVE-2026-8769 (uncontrolled resource consumption in JSON response handlers) is not present in @ai-sdk/provider-utils version 5.0.46. The upstream fix (commit 6a436e31d by Gregor Martynus, June 27, 2026) was already included in the release that TuxCare onboarded. All three affected functions (createJsonResponseHandler, createJsonErrorResponseHandler, createStatusCo...",
        "justification": "code_not_present"
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:npm/%40ai-sdk/provider-utils@5.0.46"
    }
  ]
}