{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:4a594e54-ce7e-5495-b26a-706ca6a0a4b1",
  "version": 1,
  "metadata": {
    "tools": [
      {
        "name": "tuxcare-vex-generator",
        "version": "1.0.0"
      }
    ]
  },
  "components": [
    {
      "bom-ref": "pkg:npm/%40astrojs/upgrade@4.16.19-tuxcare.2",
      "type": "library",
      "name": "@astrojs/upgrade",
      "version": "4.16.19-tuxcare.2",
      "purl": "pkg:npm/%40astrojs/upgrade@4.16.19-tuxcare.2"
    }
  ],
  "vulnerabilities": [
    {
      "bom-ref": "urn:uuid:145ea1a2-ae59-57ba-b704-76c405e50c03",
      "id": "AIKIDO-2025-10879",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability AIKIDO-2025-10879 is fixed in version 4.16.19-tuxcare.2 of @astrojs/upgrade."
      },
      "affects": [
        {
          "ref": "pkg:npm/%40astrojs/upgrade@4.16.19-tuxcare.2"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:6acd2c30-9cab-5b65-87c7-b2c27c8faf7b",
      "id": "CVE-2025-55303",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2025-55303 affects version 4.16.19-tuxcare.2 of @astrojs/upgrade."
      },
      "affects": [
        {
          "ref": "pkg:npm/%40astrojs/upgrade@4.16.19-tuxcare.2"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:7a80066e-542b-5183-8ff8-9efbea82e258",
      "id": "CVE-2025-61925",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2025-61925 is fixed in version 4.16.19-tuxcare.2 of @astrojs/upgrade."
      },
      "affects": [
        {
          "ref": "pkg:npm/%40astrojs/upgrade@4.16.19-tuxcare.2"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:6a741c06-131c-5245-bcae-04d273c82d46",
      "id": "CVE-2025-64525",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2025-64525 is fixed in version 4.16.19-tuxcare.2 of @astrojs/upgrade."
      },
      "affects": [
        {
          "ref": "pkg:npm/%40astrojs/upgrade@4.16.19-tuxcare.2"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:032bf0a3-53c6-5977-930e-ab0f98a63eb6",
      "id": "CVE-2025-64757",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2025-64757 is fixed in version 4.16.19-tuxcare.2 of @astrojs/upgrade."
      },
      "affects": [
        {
          "ref": "pkg:npm/%40astrojs/upgrade@4.16.19-tuxcare.2"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:a544ed73-0732-5e34-8198-7c2a60a90403",
      "id": "CVE-2025-64764",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2025-64764 is fixed in version 4.16.19-tuxcare.2 of @astrojs/upgrade."
      },
      "affects": [
        {
          "ref": "pkg:npm/%40astrojs/upgrade@4.16.19-tuxcare.2"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:c21aa421-8d77-5393-b3bd-062b998f30e4",
      "id": "CVE-2025-64765",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2025-64765 is fixed in version 4.16.19-tuxcare.2 of @astrojs/upgrade."
      },
      "affects": [
        {
          "ref": "pkg:npm/%40astrojs/upgrade@4.16.19-tuxcare.2"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:5781643c-15d6-5f38-871e-335b2847badc",
      "id": "CVE-2025-65019",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2025-65019 is fixed in version 4.16.19-tuxcare.2 of @astrojs/upgrade."
      },
      "affects": [
        {
          "ref": "pkg:npm/%40astrojs/upgrade@4.16.19-tuxcare.2"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:1e6ebc65-7e71-5fcb-b9e1-3b064bf9c0ca",
      "id": "CVE-2025-66202",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2025-66202 is fixed in version 4.16.19-tuxcare.2 of @astrojs/upgrade."
      },
      "affects": [
        {
          "ref": "pkg:npm/%40astrojs/upgrade@4.16.19-tuxcare.2"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:7196ef3d-4b03-558e-ac20-c3958b15d055",
      "id": "CVE-2026-33490",
      "analysis": {
        "state": "false_positive",
        "detail": "Vulnerability CVE-2026-33490 is a false positive for @astrojs/upgrade 4.16.19-tuxcare.2. false_positive \u2014 CVE-2026-33490 concerns H3 (a minimal HTTP framework), but the target repository is Astro (a website build tool). H3 is not present in this repository - no vendored code, no dependency, no imports. The only 'h3' references found are HTML heading components (<h3> tags), unrelated to the H3 framework."
      },
      "affects": [
        {
          "ref": "pkg:npm/%40astrojs/upgrade@4.16.19-tuxcare.2"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:a74b0014-caf3-5c15-9a81-944e65916e4f",
      "id": "CVE-2026-33769",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-33769 is fixed in version 4.16.19-tuxcare.2 of @astrojs/upgrade."
      },
      "affects": [
        {
          "ref": "pkg:npm/%40astrojs/upgrade@4.16.19-tuxcare.2"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:a15b33d8-c543-53d3-baa2-3aad1e06389d",
      "id": "CVE-2026-41067",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-41067 is fixed in version 4.16.19-tuxcare.2 of @astrojs/upgrade."
      },
      "affects": [
        {
          "ref": "pkg:npm/%40astrojs/upgrade@4.16.19-tuxcare.2"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:0628afbe-1d44-573d-8c9c-3478cdedf868",
      "id": "CVE-2026-45028",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-45028 affects version 4.16.19-tuxcare.2 of @astrojs/upgrade."
      },
      "affects": [
        {
          "ref": "pkg:npm/%40astrojs/upgrade@4.16.19-tuxcare.2"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:fc0c8361-d0e5-5c01-bd14-c51792cac817",
      "id": "CVE-2026-50146",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-50146 is fixed in version 4.16.19-tuxcare.2 of @astrojs/upgrade."
      },
      "affects": [
        {
          "ref": "pkg:npm/%40astrojs/upgrade@4.16.19-tuxcare.2"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:7d9e5934-1525-5f0d-8eed-bd574fb6d5a2",
      "id": "CVE-2026-54298",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-54298 is fixed in version 4.16.19-tuxcare.2 of @astrojs/upgrade."
      },
      "affects": [
        {
          "ref": "pkg:npm/%40astrojs/upgrade@4.16.19-tuxcare.2"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:1ac1f4bb-0f2e-53a8-98d0-9d6e87dd3f08",
      "id": "CVE-2026-54299",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2026-54299 does not affect version 4.16.19-tuxcare.2 of @astrojs/upgrade. already_fixed \u2014 The target repository has already fixed this vulnerability via CVE-2026-25545 / AIKIDO-2025-10879 (May 7, 2026), which addresses the identical SSRF issue. The fix removes the prerendered error page fetching feature entirely, replacing it with direct SSR rendering. This is a more aggressive mitigation than the upstream's host validation approach."
      },
      "affects": [
        {
          "ref": "pkg:npm/%40astrojs/upgrade@4.16.19-tuxcare.2"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:4a9e2430-7377-5bc4-8e14-c50e3f3de523",
      "id": "CVE-2026-59727",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-59727 affects version 4.16.19-tuxcare.2 of @astrojs/upgrade."
      },
      "affects": [
        {
          "ref": "pkg:npm/%40astrojs/upgrade@4.16.19-tuxcare.2"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:aa585b28-e380-5203-9afb-78cb1e6ac774",
      "id": "CVE-2026-59729",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-59729 affects version 4.16.19-tuxcare.2 of @astrojs/upgrade."
      },
      "affects": [
        {
          "ref": "pkg:npm/%40astrojs/upgrade@4.16.19-tuxcare.2"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:bb8ee0e4-77e5-5c44-9189-88ad5d89ef97",
      "id": "GHSA-4g3v-8h47-v7g6",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability GHSA-4g3v-8h47-v7g6 affects version 4.16.19-tuxcare.2 of @astrojs/upgrade."
      },
      "affects": [
        {
          "ref": "pkg:npm/%40astrojs/upgrade@4.16.19-tuxcare.2"
        }
      ]
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:npm/%40astrojs/upgrade@4.16.19-tuxcare.2"
    }
  ]
}