{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:ecac23d9-61b0-58de-8f20-35208e136baa",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "@graphql-tools/utils",
      "purl": "pkg:npm/%40graphql-tools/utils@8.0.2",
      "type": "library",
      "bom-ref": "pkg:npm/%40graphql-tools/utils@8.0.2",
      "version": "8.0.2",
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2026-104852",
      "affects": [
        {
          "ref": "pkg:npm/%40graphql-tools/utils@8.0.2"
        }
      ],
      "bom-ref": "urn:uuid:b9cd04ce-d058-5220-9a2f-9a2617bc9473",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2026-104852 does not affect version 8.0.2 of @graphql-tools/utils. not_affected \u2014 Not affected (Type A2). The mergeDeep in this target (@graphql-tools/utils 8.0.2) still uses `key in output`, which sees inherited keys. But it always writes into a freshly created output object and never mutates its inputs, and its isObject() excludes functions. The walk from `{}.constructor` to `Object` to `Function.prototype` therefore never writes to a shared built-in. In this repo, subgrap...",
        "justification": "code_not_reachable"
      }
    },
    {
      "id": "CVE-2026-114604",
      "affects": [
        {
          "ref": "pkg:npm/%40graphql-tools/utils@8.0.2"
        }
      ],
      "bom-ref": "urn:uuid:969c3e0f-fab4-53aa-9874-f3b8b1105d61",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2026-114604 does not affect version 8.0.2 of @graphql-tools/utils. not_affected \u2014 Not affected. The target is @graphql-tools/utils 8.0.2 (graphql-tools monorepo), which predates the vulnerable code. It has no mergeIncrementalResult.ts, no setObjectKeyPath, and no incremental-delivery (@defer/@stream) result merging, so the attacker-controlled path-walking sink does not exist.",
        "justification": "code_not_present"
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:npm/%40graphql-tools/utils@8.0.2"
    }
  ]
}