{ "bomFormat": "CycloneDX", "specVersion": "1.7", "serialNumber": "urn:uuid:412f52d5-466b-4f56-9a8d-ab63d8217050", "version": 1, "metadata": { "timestamp": "2026-07-30T19:14:06Z", "tools": { "components": [ { "group": "@cyclonedx", "name": "cdxgen", "version": "12.3.3", "purl": "pkg:npm/%40cyclonedx/cdxgen@12.3.3", "type": "application", "bom-ref": "pkg:npm/@cyclonedx/cdxgen@12.3.3", "publisher": "OWASP Foundation", "authors": [ { "name": "OWASP Foundation" } ] } ] }, "authors": [ { "name": "OWASP Foundation" } ], "lifecycles": [ { "phase": "pre-build" } ], "component": { "name": "provider", "group": "@hocuspocus", "version": "4.1.0", "description": "hocuspocus provider", "purl": "pkg:npm/%40hocuspocus/provider@4.1.0", "bom-ref": "pkg:npm/@hocuspocus/provider@4.1.0", "properties": [], "type": "application", "licenses": [ { "license": { "id": "MIT", "url": "https://opensource.org/licenses/MIT" } } ], "externalReferences": [ { "type": "website", "url": "https://hocuspocus.dev" }, { "type": "vcs", "url": "https://github.com/ueberdosis/hocuspocus" } ] }, "properties": [ { "name": "cdx:bom:componentTypes", "value": "npm" }, { "name": "cdx:bom:componentNamespaces", "value": "@hocuspocus\\n@lifeomic" }, { "name": "cdx:bom:componentSrcFiles", "value": "node_modules/@hocuspocus/common/package.json\\nnode_modules/@lifeomic/attempt/package.json\\nnode_modules/lib0/package.json\\nnode_modules/y-protocols/package.json\\nnode_modules/yjs/package.json" } ] }, "components": [ { "authors": [ { "name": "Kevin Jahns" } ], "group": "", "name": "yjs", "version": "13.6.29", "description": "Shared Editing Library", "scope": "required", "licenses": [ { "license": { "id": "MIT", "url": "https://opensource.org/licenses/MIT" } } ], "purl": "pkg:npm/yjs@13.6.29", "externalReferences": [ { "type": "website", "url": "https://docs.yjs.dev" }, { "type": "vcs", "url": "https://github.com/yjs/yjs.git" } ], "type": "library", "bom-ref": "pkg:npm/yjs@13.6.29", "properties": [ { "name": "SrcFile", "value": "node_modules/yjs/package.json" }, { "name": "ImportedModules", "value": "yjs" } ], "evidence": { "identity": [ { "field": "purl", "confidence": 0.7, "methods": [ { "technique": "manifest-analysis", "confidence": 0.7, "value": "node_modules/yjs/package.json" } ], "concludedValue": "node_modules/yjs/package.json" } ], "occurrences": [ { "location": "dist/hocuspocus-provider.esm.js#4" }, { "location": "dist/hocuspocus-provider.cjs#32" }, { "location": "src/HocuspocusProvider.ts#3" }, { "location": "src/types.ts#3" } ] } }, { "authors": [ { "name": "Kevin Jahns " } ], "group": "", "name": "y-protocols", "version": "1.0.7", "description": "Yjs encoding protocols", "scope": "required", "licenses": [ { "license": { "id": "MIT", "url": "https://opensource.org/licenses/MIT" } } ], "purl": "pkg:npm/y-protocols@1.0.7", "externalReferences": [ { "type": "vcs", "url": "https://github.com/yjs/y-protocols#readme" }, { "type": "vcs", "url": "git+https://github.com/yjs/y-protocols.git" } ], "type": "library", "bom-ref": "pkg:npm/y-protocols@1.0.7", "properties": [ { "name": "SrcFile", "value": "node_modules/y-protocols/package.json" }, { "name": "ImportedModules", "value": "y-protocols/awareness,Awareness,y-protocols/awareness/Awareness,encodeAwarenessUpdate,y-protocols/awareness/encodeAwarenessUpdate,removeAwarenessStates,y-protocols/awareness/removeAwarenessStates,y-protocols/sync,messageYjsSyncStep2,y-protocols/sync/messageYjsSyncStep2,readSyncMessage,y-protocols/sync/readSyncMessage,writeUpdate,y-protocols/sync/writeUpdate" } ], "evidence": { "identity": [ { "field": "purl", "confidence": 0.7, "methods": [ { "technique": "manifest-analysis", "confidence": 0.7, "value": "node_modules/y-protocols/package.json" } ], "concludedValue": "node_modules/y-protocols/package.json" } ], "occurrences": [ { "location": "dist/hocuspocus-provider.esm.js#2" }, { "location": "dist/hocuspocus-provider.esm.js#3" }, { "location": "dist/hocuspocus-provider.cjs#30" }, { "location": "src/HocuspocusProvider.ts#2" }, { "location": "src/MessageReceiver.ts#3" }, { "location": "src/OutgoingMessages/AwarenessMessage.ts#2" }, { "location": "src/types.ts#2" }, { "location": "dist/hocuspocus-provider.esm.js#10" }, { "location": "dist/hocuspocus-provider.esm.js#11" }, { "location": "dist/hocuspocus-provider.cjs#40" }, { "location": "src/MessageReceiver.ts#4" }, { "location": "src/OutgoingMessages/SyncStepOneMessage.ts#2" }, { "location": "src/OutgoingMessages/SyncStepTwoMessage.ts#2" }, { "location": "src/OutgoingMessages/UpdateMessage.ts#2" } ] } }, { "authors": [ { "name": "Kevin Jahns " } ], "group": "", "name": "lib0", "version": "0.2.117", "scope": "required", "licenses": [ { "license": { "id": "MIT", "url": "https://opensource.org/licenses/MIT" } } ], "purl": "pkg:npm/lib0@0.2.117", "externalReferences": [ { "type": "vcs", "url": "https://github.com/dmonad/lib0#readme" }, { "type": "vcs", "url": "git+https://github.com/dmonad/lib0.git" } ], "type": "library", "bom-ref": "pkg:npm/lib0@0.2.117", "properties": [ { "name": "SrcFile", "value": "node_modules/lib0/package.json" }, { "name": "ImportedModules", "value": "lib0/decoding,createDecoder,lib0/decoding/createDecoder,peekVarString,lib0/decoding/peekVarString,readVarInt,lib0/decoding/readVarInt,readVarString,lib0/decoding/readVarString,readVarUint,lib0/decoding/readVarUint,readVarUint8Array,lib0/decoding/readVarUint8Array,Decoder,lib0/decoding/Decoder,lib0/encoding,createEncoder,lib0/encoding/createEncoder,length,lib0/encoding/length,toUint8Array,lib0/encoding/toUint8Array,writeVarString,lib0/encoding/writeVarString,writeVarUint,lib0/encoding/writeVarUint,writeVarUint8Array,lib0/encoding/writeVarUint8Array,lib0/time,Encoder,lib0/encoding/Encoder" } ], "evidence": { "identity": [ { "field": "purl", "confidence": 0.7, "methods": [ { "technique": "manifest-analysis", "confidence": 0.7, "value": "node_modules/lib0/package.json" } ], "concludedValue": "node_modules/lib0/package.json" } ], "occurrences": [ { "location": "dist/hocuspocus-provider.esm.js#6" }, { "location": "dist/hocuspocus-provider.cjs#35" }, { "location": "src/HocuspocusProviderWebsocket.ts#3" }, { "location": "src/IncomingMessage.ts#1" }, { "location": "src/IncomingMessage.ts#8" }, { "location": "src/MessageReceiver.ts#2" }, { "location": "dist/hocuspocus-provider.esm.js#7" }, { "location": "dist/hocuspocus-provider.esm.js#8" }, { "location": "dist/hocuspocus-provider.esm.js#9" }, { "location": "dist/hocuspocus-provider.cjs#36" }, { "location": "dist/hocuspocus-provider.cjs#38" }, { "location": "src/HocuspocusProviderWebsocket.ts#4" }, { "location": "src/HocuspocusProviderWebsocket.ts#5" }, { "location": "src/IncomingMessage.ts#9" }, { "location": "src/IncomingMessage.ts#16" }, { "location": "src/MessageSender.ts#1" }, { "location": "src/MessageSender.ts#2" }, { "location": "src/OutgoingMessage.ts#1" }, { "location": "src/OutgoingMessage.ts#2" }, { "location": "src/OutgoingMessages/AuthenticationMessage.ts#1" }, { "location": "src/OutgoingMessages/AwarenessMessage.ts#1" }, { "location": "src/OutgoingMessages/CloseMessage.ts#1" }, { "location": "src/OutgoingMessages/QueryAwarenessMessage.ts#1" }, { "location": "src/OutgoingMessages/StatelessMessage.ts#1" }, { "location": "src/OutgoingMessages/SyncStepOneMessage.ts#1" }, { "location": "src/OutgoingMessages/SyncStepTwoMessage.ts#1" }, { "location": "src/OutgoingMessages/UpdateMessage.ts#1" }, { "location": "src/types.ts#1" } ] } }, { "group": "@lifeomic", "name": "attempt", "version": "3.1.0", "description": "Library that can be used to retry functions that return promise", "scope": "required", "licenses": [ { "license": { "id": "MIT", "url": "https://opensource.org/licenses/MIT" } } ], "purl": "pkg:npm/%40lifeomic/attempt@3.1.0", "externalReferences": [ { "type": "vcs", "url": "https://github.com/lifeomic/attempt#readme" }, { "type": "vcs", "url": "https://github.com/lifeomic/attempt.git" } ], "type": "library", "bom-ref": "pkg:npm/@lifeomic/attempt@3.1.0", "properties": [ { "name": "SrcFile", "value": "node_modules/@lifeomic/attempt/package.json" }, { "name": "ImportedModules", "value": "@lifeomic/attempt,retry,@lifeomic/attempt/retry" } ], "evidence": { "identity": [ { "field": "purl", "confidence": 0.7, "methods": [ { "technique": "manifest-analysis", "confidence": 0.7, "value": "node_modules/@lifeomic/attempt/package.json" } ], "concludedValue": "node_modules/@lifeomic/attempt/package.json" } ], "occurrences": [ { "location": "dist/hocuspocus-provider.esm.js#5" }, { "location": "dist/hocuspocus-provider.cjs#34" }, { "location": "src/HocuspocusProviderWebsocket.ts#2" } ] } }, { "group": "@hocuspocus", "name": "common", "version": "4.1.0", "description": "shared code for multiple Hocuspocus packages", "scope": "required", "licenses": [ { "license": { "id": "MIT", "url": "https://opensource.org/licenses/MIT" } } ], "purl": "pkg:npm/%40hocuspocus/common@4.1.0", "externalReferences": [ { "type": "website", "url": "https://hocuspocus.dev" }, { "type": "vcs", "url": "https://github.com/ueberdosis/hocuspocus" } ], "type": "library", "bom-ref": "pkg:npm/@hocuspocus/common@4.1.0", "properties": [ { "name": "SrcFile", "value": "node_modules/@hocuspocus/common/package.json" }, { "name": "ImportedModules", "value": "@hocuspocus/common,WsReadyStates,@hocuspocus/common/WsReadyStates,awarenessStatesToArray,@hocuspocus/common/awarenessStatesToArray,makeRoutingKey,@hocuspocus/common/makeRoutingKey,parseRoutingKey,@hocuspocus/common/parseRoutingKey,readAuthMessage,@hocuspocus/common/readAuthMessage,writeAuthentication,@hocuspocus/common/writeAuthentication,CloseEvent,@hocuspocus/common/CloseEvent" } ], "evidence": { "identity": [ { "field": "purl", "confidence": 0.7, "methods": [ { "technique": "manifest-analysis", "confidence": 0.7, "value": "node_modules/@hocuspocus/common/package.json" } ], "concludedValue": "node_modules/@hocuspocus/common/package.json" } ], "occurrences": [ { "location": "dist/hocuspocus-provider.esm.js#1" }, { "location": "dist/hocuspocus-provider.cjs#29" }, { "location": "src/HocuspocusProvider.ts#1" }, { "location": "src/HocuspocusProviderWebsocket.ts#1" }, { "location": "src/MessageReceiver.ts#1" }, { "location": "src/OutgoingMessages/AuthenticationMessage.ts#2" }, { "location": "src/types.ts#4" } ] } } ], "dependencies": [], "annotations": [ { "bom-ref": "metadata-annotations", "subjects": [ "pkg:npm/@hocuspocus/provider@4.1.0" ], "annotator": { "component": { "group": "@cyclonedx", "name": "cdxgen", "version": "12.3.3", "purl": "pkg:npm/%40cyclonedx/cdxgen@12.3.3", "type": "application", "bom-ref": "pkg:npm/@cyclonedx/cdxgen@12.3.3", "publisher": "OWASP Foundation", "authors": [ { "name": "OWASP Foundation" } ] } }, "timestamp": "2026-07-30T19:14:06Z", "text": "This Software Bill-of-Materials (SBOM) document was created on Thursday, July 30, 2026 with cdxgen. The data was captured during the pre-build lifecycle phase without building the application. The document describes an application named 'provider' with version '4.1.0'. The package type in this SBOM is npm with 2 purl namespaces described under components. The components were identified from 5 source files." } ] }