{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:32bc6c8c-ed2d-5333-a2ce-36dbfcd4b77b",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "@graphql-tools/utils",
      "purl": "pkg:npm/%40graphql-tools/utils@8.8.0-tuxcare.1",
      "type": "library",
      "bom-ref": "pkg:npm/%40graphql-tools/utils@8.8.0-tuxcare.1",
      "version": "8.8.0-tuxcare.1",
      "pedigree": {
        "ancestors": [
          {
            "name": "@graphql-tools/utils",
            "purl": "pkg:npm/%40graphql-tools/utils@8.8.0",
            "type": "library",
            "version": "8.8.0"
          }
        ]
      },
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2026-104852",
      "affects": [
        {
          "ref": "pkg:npm/%40graphql-tools/utils@8.8.0-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:08524290-2791-52f1-aa20-a4651e2c4abe",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-104852 is fixed in version 8.8.0-tuxcare.1 of @graphql-tools/utils."
      }
    },
    {
      "id": "CVE-2026-114604",
      "affects": [
        {
          "ref": "pkg:npm/%40graphql-tools/utils@8.8.0-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:999502ba-aa02-5864-b4e5-c716b2f03cec",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2026-114604 does not affect version 8.8.0-tuxcare.1 of @graphql-tools/utils. not_affected \u2014 The target @graphql-tools/utils version 8.8.0 does not contain the vulnerable code. The mergeIncrementalResult function and its helper setObjectKeyPath, which contain the prototype pollution vulnerability, do not exist in this version. The vulnerability was introduced in version 10.10.1 by commit fbb58b51c (\"remove dset dependency\") and fixed in version 12.0.2. Version 8.8.0 predates the introd...",
        "justification": "code_not_present"
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:npm/%40graphql-tools/utils@8.8.0-tuxcare.1"
    }
  ]
}