{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:1293f6d3-feca-554b-b72e-12b414da958b",
  "version": 1,
  "metadata": {
    "tools": [
      {
        "name": "tuxcare-vex-generator",
        "version": "1.0.0"
      }
    ]
  },
  "components": [
    {
      "bom-ref": "pkg:npm/semver@7.3.8-tuxcare.6",
      "type": "library",
      "name": "semver",
      "version": "7.3.8-tuxcare.6",
      "purl": "pkg:npm/semver@7.3.8-tuxcare.6"
    }
  ],
  "vulnerabilities": [
    {
      "bom-ref": "urn:uuid:d655510c-edd2-5946-b74b-56576c26efac",
      "id": "CVE-2022-25883",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2022-25883 does not affect version 7.3.8-tuxcare.6 of semver. already_fixed \u2014 Target repository (semver 7.3.8) has been patched for CVE-2022-25883 with the Phase 1 fix (commit 4120c5f from January 2026). The fix includes whitespace normalization and bounded whitespace quantifiers in regex patterns, which blocks the primary ReDoS attack vector. While the target lacks the Phase 2 enhancement (bounded numeric and build identifier quantifiers from upstream commit abdd93d), t..."
      },
      "affects": [
        {
          "ref": "pkg:npm/semver@7.3.8-tuxcare.6"
        }
      ]
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:npm/semver@7.3.8-tuxcare.6"
    }
  ]
}