{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:6a92131d-05ae-59ac-aad1-07da950dd24f",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "baseline-browser-mapping",
      "purl": "pkg:npm/baseline-browser-mapping@2.11.27",
      "type": "library",
      "bom-ref": "pkg:npm/baseline-browser-mapping@2.11.27",
      "version": "2.11.27",
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2026-45819",
      "affects": [
        {
          "ref": "pkg:npm/baseline-browser-mapping@2.11.27"
        }
      ],
      "bom-ref": "urn:uuid:0a8d3249-8a07-5e87-b3b1-0e97077b82de",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2026-45819 does not affect version 2.11.27 of baseline-browser-mapping. not_affected \u2014 The target version 2.11.27 is NOT vulnerable to CVE-2026-45819. The vulnerability (calling process.exit() instead of throwing errors on invalid input) was fixed in upstream version 2.11.0 by commit de733e2d8959559f7bb255d5927f3afcb6f31589, authored by upstream maintainer Tony Conway. The fix shipped in the upstream release before TuxCare onboarded this version. All library functions (getCompati...",
        "justification": "code_not_present"
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:npm/baseline-browser-mapping@2.11.27"
    }
  ]
}