{ "bomFormat": "CycloneDX", "specVersion": "1.7", "serialNumber": "urn:uuid:cef4348c-81f2-4376-8908-22e97729958a", "version": 1, "metadata": { "timestamp": "2026-09-10T01:15:18Z", "tools": { "components": [ { "group": "@cyclonedx", "name": "cdxgen", "version": "12.8.4", "purl": "pkg:npm/%40cyclonedx/cdxgen@12.8.4", "type": "application", "bom-ref": "pkg:npm/@cyclonedx/cdxgen@12.8.4", "publisher": "OWASP Foundation", "authors": [ { "name": "OWASP Foundation" } ] } ] }, "authors": [ { "name": "OWASP Foundation" } ], "lifecycles": [ { "phase": "pre-build" } ], "component": { "name": "python-analysis", "group": "@vercel", "version": "0.11.1", "purl": "pkg:npm/%40vercel/python-analysis@0.11.1", "bom-ref": "pkg:npm/@vercel/python-analysis@0.11.1", "properties": [ { "name": "cdx:npm:scripts", "value": "build, build:wasm, generate:schemas, test, vitest-run, vitest-unit, type-check" }, { "name": "cdx:npm:buildScripts", "value": "build, build:wasm" }, { "name": "cdx:license:category", "value": "Permissive" } ], "type": "application", "licenses": [ { "license": { "id": "Apache-2.0", "url": "https://opensource.org/licenses/Apache-2.0", "properties": [ { "name": "cdx:license:category", "value": "Permissive" }, { "name": "cdx:license:foss", "value": "true" }, { "name": "cdx:license:osiApproved", "value": "true" }, { "name": "cdx:license:fsfLibre", "value": "true" }, { "name": "cdx:license:deprecated", "value": "false" } ] } } ], "externalReferences": [ { "type": "website", "url": "https://vercel.com/docs/runtimes#official-runtimes/python" }, { "type": "vcs", "url": "https://github.com/vercel/vercel.git" } ] }, "properties": [ { "name": "cdx:bom:componentTypes", "value": "npm" }, { "name": "cdx:bom:componentNamespaces", "value": "@bytecodealliance\\n@renovatebot\\n@types" }, { "name": "cdx:bom:componentSrcFiles", "value": "node_modules/@bytecodealliance/jco-transpile/package.json\\nnode_modules/@bytecodealliance/preview2-shim/package.json\\nnode_modules/@renovatebot/pep440/package.json\\nnode_modules/@types/fs-extra/package.json\\nnode_modules/@types/js-yaml/package.json\\nnode_modules/@types/node/package.json\\nnode_modules/fs-extra/package.json\\nnode_modules/js-yaml/package.json\\nnode_modules/minimatch/package.json\\nnode_modules/smol-toml/package.json\\nnode_modules/ts-to-zod/package.json\\nnode_modules/vitest/package.json\\nnode_modules/zod/package.json" } ] }, "components": [ { "authors": [ { "name": "Colin McDonnell " } ], "group": "", "name": "zod", "version": "3.22.4", "description": "TypeScript-first schema declaration and validation library with static type inference", "scope": "required", "licenses": [ { "license": { "id": "MIT", "url": "https://opensource.org/licenses/MIT", "properties": [ { "name": "cdx:license:category", "value": "Permissive" }, { "name": "cdx:license:foss", "value": "true" }, { "name": "cdx:license:osiApproved", "value": "true" }, { "name": "cdx:license:fsfLibre", "value": "true" }, { "name": "cdx:license:deprecated", "value": "false" } ] } } ], "purl": "pkg:npm/zod@3.22.4", "externalReferences": [ { "type": "website", "url": "https://zod.dev" }, { "type": "vcs", "url": "https://github.com/colinhacks/zod" } ], "type": "library", "bom-ref": "pkg:npm/zod@3.22.4", "properties": [ { "name": "SrcFile", "value": "node_modules/zod/package.json" }, { "name": "ImportedModules", "value": "zod,zod/z" }, { "name": "cdx:license:category", "value": "Permissive" } ], "evidence": { "identity": [ { "field": "purl", "confidence": 0.7, "methods": [ { "technique": "manifest-analysis", "confidence": 0.7, "value": "node_modules/zod/package.json" } ], "concludedValue": "node_modules/zod/package.json" } ], "occurrences": [ { "location": "dist/index.js", "line": 519 }, { "location": "dist/index.js", "line": 520 }, { "location": "dist/index.js", "line": 521 }, { "location": "dist/index.js", "line": 522 }, { "location": "dist/index.js", "line": 523 }, { "location": "dist/index.js", "line": 524 }, { "location": "dist/index.js", "line": 525 }, { "location": "dist/index.js", "line": 526 }, { "location": "dist/index.js", "line": 527 }, { "location": "dist/index.js", "line": 528 }, { "location": "dist/index.js", "line": 529 }, { "location": "dist/index.js", "line": 531 }, { "location": "dist/index.js", "line": 532 }, { "location": "dist/index.js", "line": 535 }, { "location": "dist/index.js", "line": 536 }, { "location": "dist/index.js", "line": 537 }, { "location": "dist/index.js", "line": 538 }, { "location": "dist/index.js", "line": 540 }, { "location": "dist/index.js", "line": 541 }, { "location": "dist/index.js", "line": 542 }, { "location": "dist/index.js", "line": 543 }, { "location": "dist/index.js", "line": 544 }, { "location": "dist/index.js", "line": 545 }, { "location": "dist/index.js", "line": 548 }, { "location": "dist/index.js", "line": 549 }, { "location": "dist/index.js", "line": 550 }, { "location": "dist/index.js", "line": 551 }, { "location": "dist/index.js", "line": 552 }, { "location": "dist/index.js", "line": 555 }, { "location": "dist/index.js", "line": 556 }, { "location": "dist/index.js", "line": 557 }, { "location": "dist/index.js", "line": 559 }, { "location": "dist/index.js", "line": 560 }, { "location": "dist/index.js", "line": 561 }, { "location": "dist/index.js", "line": 562 }, { "location": "dist/index.js", "line": 564 }, { "location": "dist/index.js", "line": 566 }, { "location": "dist/index.js", "line": 567 }, { "location": "dist/index.js", "line": 569 }, { "location": "dist/index.js", "line": 570 }, { "location": "dist/index.js", "line": 573 }, { "location": "dist/index.js", "line": 575 }, { "location": "dist/index.js", "line": 576 }, { "location": "dist/index.js", "line": 838 }, { "location": "dist/index.js", "line": 841 }, { "location": "dist/index.js", "line": 844 }, { "location": "dist/index.js", "line": 845 }, { "location": "dist/index.js", "line": 846 }, { "location": "dist/index.js", "line": 847 }, { "location": "dist/index.js", "line": 848 }, { "location": "dist/index.js", "line": 849 }, { "location": "dist/index.js", "line": 850 }, { "location": "dist/index.js", "line": 852 }, { "location": "dist/index.js", "line": 853 }, { "location": "dist/index.js", "line": 854 }, { "location": "dist/index.js", "line": 855 }, { "location": "dist/index.js", "line": 856 }, { "location": "dist/index.js", "line": 857 }, { "location": "dist/index.js", "line": 858 }, { "location": "dist/index.js", "line": 861 }, { "location": "dist/index.js", "line": 864 }, { "location": "dist/index.js", "line": 865 }, { "location": "dist/index.js", "line": 866 }, { "location": "dist/index.js", "line": 868 }, { "location": "dist/index.js", "line": 869 }, { "location": "dist/index.js", "line": 870 }, { "location": "dist/index.js", "line": 871 }, { "location": "dist/index.js", "line": 872 }, { "location": "dist/index.js", "line": 873 }, { "location": "dist/index.js", "line": 875 }, { "location": "dist/index.js", "line": 876 }, { "location": "dist/index.js", "line": 877 }, { "location": "dist/index.js", "line": 879 }, { "location": "dist/index.js", "line": 883 }, { "location": "dist/index.js", "line": 884 }, { "location": "dist/index.js", "line": 885 }, { "location": "dist/index.js", "line": 886 }, { "location": "dist/index.js", "line": 888 }, { "location": "dist/index.js", "line": 889 }, { "location": "dist/index.js", "line": 890 }, { "location": "dist/index.js", "line": 892 }, { "location": "dist/index.js", "line": 893 }, { "location": "dist/index.js", "line": 894 }, { "location": "dist/index.js", "line": 896 }, { "location": "dist/index.js", "line": 897 }, { "location": "dist/index.js", "line": 898 }, { "location": "dist/index.js", "line": 899 }, { "location": "dist/index.js", "line": 901 }, { "location": "dist/index.js", "line": 902 }, { "location": "dist/index.js", "line": 903 }, { "location": "dist/index.js", "line": 904 }, { "location": "dist/index.js", "line": 905 }, { "location": "dist/index.js", "line": 907 }, { "location": "dist/index.js", "line": 908 }, { "location": "dist/index.js", "line": 909 }, { "location": "dist/index.js", "line": 911 }, { "location": "dist/index.js", "line": 912 }, { "location": "dist/index.js", "line": 913 }, { "location": "dist/index.js", "line": 914 }, { "location": "dist/index.js", "line": 915 }, { "location": "dist/index.js", "line": 916 }, { "location": "dist/index.js", "line": 917 }, { "location": "dist/index.js", "line": 918 }, { "location": "dist/index.js", "line": 920 }, { "location": "dist/index.js", "line": 921 }, { "location": "dist/index.js", "line": 923 }, { "location": "dist/index.js", "line": 924 }, { "location": "dist/index.js", "line": 927 }, { "location": "dist/index.js", "line": 928 }, { "location": "dist/index.js", "line": 930 }, { "location": "dist/index.js", "line": 933 }, { "location": "dist/index.cjs", "line": 600 }, { "location": "dist/index.cjs", "line": 919 }, { "location": "dist/index.cjs", "line": 922 }, { "location": "dist/index.cjs", "line": 925 }, { "location": "src/manifest/pipfile/schema.ts", "line": 10 }, { "location": "src/manifest/pipfile/schema.zod.ts", "line": 2 }, { "location": "src/manifest/pipfile/schema.zod.ts", "line": 4 }, { "location": "src/manifest/pipfile/schema.zod.ts", "line": 5 }, { "location": "src/manifest/pipfile/schema.zod.ts", "line": 6 }, { "location": "src/manifest/pipfile/schema.zod.ts", "line": 7 }, { "location": "src/manifest/pipfile/schema.zod.ts", "line": 8 }, { "location": "src/manifest/pipfile/schema.zod.ts", "line": 9 }, { "location": "src/manifest/pipfile/schema.zod.ts", "line": 10 }, { "location": "src/manifest/pipfile/schema.zod.ts", "line": 11 }, { "location": "src/manifest/pipfile/schema.zod.ts", "line": 12 }, { "location": "src/manifest/pipfile/schema.zod.ts", "line": 13 }, { "location": "src/manifest/pipfile/schema.zod.ts", "line": 16 }, { "location": "src/manifest/pipfile/schema.zod.ts", "line": 17 }, { "location": "src/manifest/pipfile/schema.zod.ts", "line": 21 }, { "location": "src/manifest/pipfile/schema.zod.ts", "line": 22 }, { "location": "src/manifest/pipfile/schema.zod.ts", "line": 23 }, { "location": "src/manifest/pipfile/schema.zod.ts", "line": 24 }, { "location": "src/manifest/pipfile/schema.zod.ts", "line": 27 }, { "location": "src/manifest/pipfile/schema.zod.ts", "line": 29 }, { "location": "src/manifest/pipfile/schema.zod.ts", "line": 30 }, { "location": "src/manifest/pipfile/schema.zod.ts", "line": 31 }, { "location": "src/manifest/pipfile/schema.zod.ts", "line": 32 }, { "location": "src/manifest/pipfile/schema.zod.ts", "line": 33 }, { "location": "src/manifest/pipfile/schema.zod.ts", "line": 37 }, { "location": "src/manifest/pipfile/schema.zod.ts", "line": 38 }, { "location": "src/manifest/pipfile/schema.zod.ts", "line": 39 }, { "location": "src/manifest/pipfile/schema.zod.ts", "line": 40 }, { "location": "src/manifest/pipfile/schema.zod.ts", "line": 41 }, { "location": "src/manifest/pipfile/schema.zod.ts", "line": 45 }, { "location": "src/manifest/pipfile/schema.zod.ts", "line": 46 }, { "location": "src/manifest/pipfile/schema.zod.ts", "line": 48 }, { "location": "src/manifest/pipfile/schema.zod.ts", "line": 51 }, { "location": "src/manifest/pipfile/schema.zod.ts", "line": 52 }, { "location": "src/manifest/pipfile/schema.zod.ts", "line": 54 }, { "location": "src/manifest/pipfile/schema.zod.ts", "line": 55 }, { "location": "src/manifest/pipfile/schema.zod.ts", "line": 58 }, { "location": "src/manifest/pipfile/schema.zod.ts", "line": 61 }, { "location": "src/manifest/pipfile/schema.zod.ts", "line": 63 }, { "location": "src/manifest/pipfile/schema.zod.ts", "line": 65 }, { "location": "src/manifest/pipfile/schema.zod.ts", "line": 66 }, { "location": "src/manifest/pipfile/schema.zod.ts", "line": 70 }, { "location": "src/manifest/pipfile/schema.zod.ts", "line": 72 }, { "location": "src/manifest/pipfile/schema.zod.ts", "line": 73 }, { "location": "src/manifest/pyproject/schema.ts", "line": 10 }, { "location": "src/manifest/pyproject/schema.zod.ts", "line": 2 }, { "location": "src/manifest/pyproject/schema.zod.ts", "line": 6 }, { "location": "src/manifest/pyproject/schema.zod.ts", "line": 7 }, { "location": "src/manifest/pyproject/schema.zod.ts", "line": 8 }, { "location": "src/manifest/pyproject/schema.zod.ts", "line": 9 }, { "location": "src/manifest/pyproject/schema.zod.ts", "line": 12 }, { "location": "src/manifest/pyproject/schema.zod.ts", "line": 13 }, { "location": "src/manifest/pyproject/schema.zod.ts", "line": 14 }, { "location": "src/manifest/pyproject/schema.zod.ts", "line": 17 }, { "location": "src/manifest/pyproject/schema.zod.ts", "line": 18 }, { "location": "src/manifest/pyproject/schema.zod.ts", "line": 19 }, { "location": "src/manifest/pyproject/schema.zod.ts", "line": 22 }, { "location": "src/manifest/pyproject/schema.zod.ts", "line": 24 }, { "location": "src/manifest/pyproject/schema.zod.ts", "line": 25 }, { "location": "src/manifest/pyproject/schema.zod.ts", "line": 26 }, { "location": "src/manifest/pyproject/schema.zod.ts", "line": 29 }, { "location": "src/manifest/pyproject/schema.zod.ts", "line": 31 }, { "location": "src/manifest/pyproject/schema.zod.ts", "line": 32 }, { "location": "src/manifest/pyproject/schema.zod.ts", "line": 33 }, { "location": "src/manifest/pyproject/schema.zod.ts", "line": 34 }, { "location": "src/manifest/pyproject/schema.zod.ts", "line": 36 }, { "location": "src/manifest/pyproject/schema.zod.ts", "line": 37 }, { "location": "src/manifest/pyproject/schema.zod.ts", "line": 38 }, { "location": "src/manifest/pyproject/schema.zod.ts", "line": 40 }, { "location": "src/manifest/pyproject/schema.zod.ts", "line": 41 }, { "location": "src/manifest/pyproject/schema.zod.ts", "line": 42 }, { "location": "src/manifest/pyproject/schema.zod.ts", "line": 43 }, { "location": "src/manifest/pyproject/schema.zod.ts", "line": 44 }, { "location": "src/manifest/pyproject/schema.zod.ts", "line": 45 }, { "location": "src/manifest/pyproject/schema.zod.ts", "line": 46 }, { "location": "src/manifest/pyproject/schema.zod.ts", "line": 47 }, { "location": "src/manifest/pyproject/schema.zod.ts", "line": 50 }, { "location": "src/manifest/pyproject/schema.zod.ts", "line": 51 }, { "location": "src/manifest/pyproject/schema.zod.ts", "line": 54 }, { "location": "src/manifest/pyproject/schema.zod.ts", "line": 55 }, { "location": "src/manifest/pyproject/schema.zod.ts", "line": 59 }, { "location": "src/manifest/pyproject/schema.zod.ts", "line": 60 }, { "location": "src/manifest/pyproject/schema.zod.ts", "line": 63 }, { "location": "src/manifest/pyproject/schema.zod.ts", "line": 67 }, { "location": "src/manifest/requirement/schema.ts", "line": 10 }, { "location": "src/manifest/requirement/schema.zod.ts", "line": 2 }, { "location": "src/manifest/requirement/schema.zod.ts", "line": 4 }, { "location": "src/manifest/requirement/schema.zod.ts", "line": 5 }, { "location": "src/manifest/requirement/schema.zod.ts", "line": 6 }, { "location": "src/manifest/requirement/schema.zod.ts", "line": 7 }, { "location": "src/manifest/requirement/schema.zod.ts", "line": 8 }, { "location": "src/manifest/requirement/schema.zod.ts", "line": 9 }, { "location": "src/manifest/requirement/schema.zod.ts", "line": 12 }, { "location": "src/manifest/requirement/schema.zod.ts", "line": 13 }, { "location": "src/manifest/requirement/schema.zod.ts", "line": 14 }, { "location": "src/manifest/requirement/schema.zod.ts", "line": 15 }, { "location": "src/manifest/requirement/schema.zod.ts", "line": 16 }, { "location": "src/manifest/requirement/schema.zod.ts", "line": 17 }, { "location": "src/manifest/requirement/schema.zod.ts", "line": 18 }, { "location": "src/manifest/requirement/schema.zod.ts", "line": 22 }, { "location": "src/manifest/uv-config/schema.ts", "line": 10 }, { "location": "src/manifest/uv-config/schema.zod.ts", "line": 2 }, { "location": "src/manifest/uv-config/schema.zod.ts", "line": 6 }, { "location": "src/manifest/uv-config/schema.zod.ts", "line": 7 }, { "location": "src/manifest/uv-config/schema.zod.ts", "line": 8 }, { "location": "src/manifest/uv-config/schema.zod.ts", "line": 11 }, { "location": "src/manifest/uv-config/schema.zod.ts", "line": 12 }, { "location": "src/manifest/uv-config/schema.zod.ts", "line": 13 }, { "location": "src/manifest/uv-config/schema.zod.ts", "line": 14 }, { "location": "src/manifest/uv-config/schema.zod.ts", "line": 15 }, { "location": "src/manifest/uv-config/schema.zod.ts", "line": 16 }, { "location": "src/manifest/uv-config/schema.zod.ts", "line": 19 }, { "location": "src/manifest/uv-config/schema.zod.ts", "line": 20 }, { "location": "src/manifest/uv-config/schema.zod.ts", "line": 21 }, { "location": "src/manifest/uv-config/schema.zod.ts", "line": 23 }, { "location": "src/manifest/uv-config/schema.zod.ts", "line": 25 } ] }, "tags": [ "validation" ] }, { "authors": [ { "name": "Anthony Fu " } ], "group": "", "name": "vitest", "version": "2.1.4", "description": "Next generation testing framework powered by Vite", "scope": "optional", "licenses": [ { "license": { "id": "MIT", "url": "https://opensource.org/licenses/MIT", "properties": [ { "name": "cdx:license:category", "value": "Permissive" }, { "name": "cdx:license:foss", "value": "true" }, { "name": "cdx:license:osiApproved", "value": "true" }, { "name": "cdx:license:fsfLibre", "value": "true" }, { "name": "cdx:license:deprecated", "value": "false" } ] } } ], "purl": "pkg:npm/vitest@2.1.4", "externalReferences": [ { "type": "vcs", "url": "https://github.com/vitest-dev/vitest#readme" }, { "type": "vcs", "url": "git+https://github.com/vitest-dev/vitest.git" } ], "type": "framework", "bom-ref": "pkg:npm/vitest@2.1.4", "properties": [ { "name": "SrcFile", "value": "node_modules/vitest/package.json" }, { "name": "cdx:license:category", "value": "Permissive" } ], "evidence": { "identity": [ { "field": "purl", "confidence": 0.7, "methods": [ { "technique": "manifest-analysis", "confidence": 0.7, "value": "node_modules/vitest/package.json" } ], "concludedValue": "node_modules/vitest/package.json" } ] }, "tags": [ "framework" ] }, { "authors": [ { "name": "Fabien Bernard @fabien0102" } ], "group": "", "name": "ts-to-zod", "version": "3.15.0", "description": "Generate zod schemas from typescript types/interfaces", "scope": "optional", "licenses": [ { "license": { "id": "MIT", "url": "https://opensource.org/licenses/MIT", "properties": [ { "name": "cdx:license:category", "value": "Permissive" }, { "name": "cdx:license:foss", "value": "true" }, { "name": "cdx:license:osiApproved", "value": "true" }, { "name": "cdx:license:fsfLibre", "value": "true" }, { "name": "cdx:license:deprecated", "value": "false" } ] } } ], "purl": "pkg:npm/ts-to-zod@3.15.0", "externalReferences": [ { "type": "vcs", "url": "https://github.com/fabien0102/ts-to-zod" } ], "type": "library", "bom-ref": "pkg:npm/ts-to-zod@3.15.0", "properties": [ { "name": "SrcFile", "value": "node_modules/ts-to-zod/package.json" }, { "name": "cdx:license:category", "value": "Permissive" } ], "evidence": { "identity": [ { "field": "purl", "confidence": 0.7, "methods": [ { "technique": "manifest-analysis", "confidence": 0.7, "value": "node_modules/ts-to-zod/package.json" } ], "concludedValue": "node_modules/ts-to-zod/package.json" } ] } }, { "authors": [ { "name": "Cynthia " } ], "group": "", "name": "smol-toml", "version": "1.5.2", "description": "A small, fast, and correct TOML parser/serializer", "scope": "required", "licenses": [ { "license": { "id": "BSD-3-Clause", "url": "https://opensource.org/licenses/BSD-3-Clause", "properties": [ { "name": "cdx:license:category", "value": "Permissive" }, { "name": "cdx:license:foss", "value": "true" }, { "name": "cdx:license:osiApproved", "value": "true" }, { "name": "cdx:license:fsfLibre", "value": "true" }, { "name": "cdx:license:deprecated", "value": "false" } ] } } ], "purl": "pkg:npm/smol-toml@1.5.2", "type": "library", "bom-ref": "pkg:npm/smol-toml@1.5.2", "properties": [ { "name": "SrcFile", "value": "node_modules/smol-toml/package.json" }, { "name": "ImportedModules", "value": "smol-toml" }, { "name": "cdx:license:category", "value": "Permissive" } ], "evidence": { "identity": [ { "field": "purl", "confidence": 0.7, "methods": [ { "technique": "manifest-analysis", "confidence": 0.7, "value": "node_modules/smol-toml/package.json" } ], "concludedValue": "node_modules/smol-toml/package.json" } ], "occurrences": [ { "location": "dist/index.js", "line": 373 }, { "location": "dist/index.js", "line": 444 }, { "location": "dist/index.js", "line": 1911 }, { "location": "dist/index.js", "line": 1913 }, { "location": "dist/index.js", "line": 1934 }, { "location": "dist/index.js", "line": 1938 }, { "location": "dist/index.cjs", "line": 457 }, { "location": "dist/index.cjs", "line": 1992 }, { "location": "dist/index.cjs", "line": 2015 }, { "location": "src/manifest/serialize.ts", "line": 1 }, { "location": "src/manifest/serialize.ts", "line": 8 }, { "location": "src/manifest/uv-lock-parser.ts", "line": 2 }, { "location": "src/manifest/uv-lock-parser.ts", "line": 66 } ] } }, { "authors": [ { "name": "Isaac Z. Schlueter (http://blog.izs.me)" } ], "group": "", "name": "minimatch", "version": "10.1.1", "description": "a glob matcher in javascript", "scope": "required", "licenses": [ { "license": { "id": "BlueOak-1.0.0", "url": "https://opensource.org/licenses/BlueOak-1.0.0", "properties": [ { "name": "cdx:license:category", "value": "Permissive" }, { "name": "cdx:license:foss", "value": "true" }, { "name": "cdx:license:osiApproved", "value": "true" }, { "name": "cdx:license:fsfLibre", "value": "false" }, { "name": "cdx:license:deprecated", "value": "false" } ] } } ], "purl": "pkg:npm/minimatch@10.1.1", "type": "library", "bom-ref": "pkg:npm/minimatch@10.1.1", "properties": [ { "name": "SrcFile", "value": "node_modules/minimatch/package.json" }, { "name": "ImportedModules", "value": "minimatch,match,minimatch/match" }, { "name": "cdx:license:category", "value": "Permissive" } ], "evidence": { "identity": [ { "field": "purl", "confidence": 0.7, "methods": [ { "technique": "manifest-analysis", "confidence": 0.7, "value": "node_modules/minimatch/package.json" } ], "concludedValue": "node_modules/minimatch/package.json" } ], "occurrences": [ { "location": "dist/index.js", "line": 368 }, { "location": "dist/index.js", "line": 1655 }, { "location": "dist/index.js", "line": 1657 }, { "location": "dist/index.cjs", "line": 452 }, { "location": "src/manifest/package.ts", "line": 3 }, { "location": "src/manifest/package.ts", "line": 408 }, { "location": "src/manifest/package.ts", "line": 411 } ] } }, { "authors": [ { "name": "Vladimir Zapparov " } ], "group": "", "name": "js-yaml", "version": "4.1.1", "description": "YAML 1.2 parser and serializer", "scope": "required", "licenses": [ { "license": { "id": "MIT", "url": "https://opensource.org/licenses/MIT", "properties": [ { "name": "cdx:license:category", "value": "Permissive" }, { "name": "cdx:license:foss", "value": "true" }, { "name": "cdx:license:osiApproved", "value": "true" }, { "name": "cdx:license:fsfLibre", "value": "true" }, { "name": "cdx:license:deprecated", "value": "false" } ] } } ], "purl": "pkg:npm/js-yaml@4.1.1", "type": "library", "bom-ref": "pkg:npm/js-yaml@4.1.1", "properties": [ { "name": "SrcFile", "value": "node_modules/js-yaml/package.json" }, { "name": "ImportedModules", "value": "js-yaml" }, { "name": "cdx:license:category", "value": "Permissive" } ], "evidence": { "identity": [ { "field": "purl", "confidence": 0.7, "methods": [ { "technique": "manifest-analysis", "confidence": 0.7, "value": "node_modules/js-yaml/package.json" } ], "concludedValue": "node_modules/js-yaml/package.json" } ], "occurrences": [ { "location": "dist/index.js", "line": 372 }, { "location": "dist/index.js", "line": 446 }, { "location": "dist/index.cjs", "line": 456 } ] } }, { "authors": [ { "name": "JP Richardson " } ], "group": "", "name": "fs-extra", "version": "11.1.1", "description": "fs-extra contains methods that aren't included in the vanilla Node.js fs package. Such as recursive mkdir, copy, and remove.", "scope": "required", "licenses": [ { "license": { "id": "MIT", "url": "https://opensource.org/licenses/MIT", "properties": [ { "name": "cdx:license:category", "value": "Permissive" }, { "name": "cdx:license:foss", "value": "true" }, { "name": "cdx:license:osiApproved", "value": "true" }, { "name": "cdx:license:fsfLibre", "value": "true" }, { "name": "cdx:license:deprecated", "value": "false" } ] } } ], "purl": "pkg:npm/fs-extra@11.1.1", "externalReferences": [ { "type": "vcs", "url": "https://github.com/jprichardson/node-fs-extra" }, { "type": "vcs", "url": "https://github.com/jprichardson/node-fs-extra" } ], "type": "library", "bom-ref": "pkg:npm/fs-extra@11.1.1", "properties": [ { "name": "SrcFile", "value": "node_modules/fs-extra/package.json" }, { "name": "ImportedModules", "value": "fs-extra,readFile,fs-extra/readFile" }, { "name": "cdx:license:category", "value": "Permissive" } ], "evidence": { "identity": [ { "field": "purl", "confidence": 0.7, "methods": [ { "technique": "manifest-analysis", "confidence": 0.7, "value": "node_modules/fs-extra/package.json" } ], "concludedValue": "node_modules/fs-extra/package.json" } ], "occurrences": [ { "location": "dist/index.js", "line": 377 }, { "location": "dist/index.js", "line": 407 }, { "location": "dist/index.cjs", "line": 461 }, { "location": "src/util/fs.ts", "line": 3 }, { "location": "src/util/fs.ts", "line": 17 } ] } }, { "group": "@types", "name": "node", "version": "20.11.0", "description": "TypeScript definitions for node", "scope": "excluded", "licenses": [ { "license": { "id": "MIT", "url": "https://opensource.org/licenses/MIT", "properties": [ { "name": "cdx:license:category", "value": "Permissive" }, { "name": "cdx:license:foss", "value": "true" }, { "name": "cdx:license:osiApproved", "value": "true" }, { "name": "cdx:license:fsfLibre", "value": "true" }, { "name": "cdx:license:deprecated", "value": "false" } ] } } ], "purl": "pkg:npm/%40types/node@20.11.0", "externalReferences": [ { "type": "vcs", "url": "https://github.com/DefinitelyTyped/DefinitelyTyped/tree/master/types/node" }, { "type": "vcs", "url": "https://github.com/DefinitelyTyped/DefinitelyTyped.git" } ], "type": "library", "bom-ref": "pkg:npm/@types/node@20.11.0", "properties": [ { "name": "SrcFile", "value": "node_modules/@types/node/package.json" }, { "name": "cdx:license:category", "value": "Permissive" } ], "evidence": { "identity": [ { "field": "purl", "confidence": 0.7, "methods": [ { "technique": "manifest-analysis", "confidence": 0.7, "value": "node_modules/@types/node/package.json" } ], "concludedValue": "node_modules/@types/node/package.json" } ] } }, { "group": "@types", "name": "js-yaml", "version": "4.0.9", "description": "TypeScript definitions for js-yaml", "scope": "required", "licenses": [ { "license": { "id": "MIT", "url": "https://opensource.org/licenses/MIT", "properties": [ { "name": "cdx:license:category", "value": "Permissive" }, { "name": "cdx:license:foss", "value": "true" }, { "name": "cdx:license:osiApproved", "value": "true" }, { "name": "cdx:license:fsfLibre", "value": "true" }, { "name": "cdx:license:deprecated", "value": "false" } ] } } ], "purl": "pkg:npm/%40types/js-yaml@4.0.9", "externalReferences": [ { "type": "vcs", "url": "https://github.com/DefinitelyTyped/DefinitelyTyped/tree/master/types/js-yaml" }, { "type": "vcs", "url": "https://github.com/DefinitelyTyped/DefinitelyTyped.git" } ], "type": "library", "bom-ref": "pkg:npm/@types/js-yaml@4.0.9", "properties": [ { "name": "SrcFile", "value": "node_modules/@types/js-yaml/package.json" }, { "name": "cdx:license:category", "value": "Permissive" } ], "evidence": { "identity": [ { "field": "purl", "confidence": 0.7, "methods": [ { "technique": "manifest-analysis", "confidence": 0.7, "value": "node_modules/@types/js-yaml/package.json" } ], "concludedValue": "node_modules/@types/js-yaml/package.json" } ] } }, { "group": "@types", "name": "fs-extra", "version": "11.0.4", "description": "TypeScript definitions for fs-extra", "scope": "required", "licenses": [ { "license": { "id": "MIT", "url": "https://opensource.org/licenses/MIT", "properties": [ { "name": "cdx:license:category", "value": "Permissive" }, { "name": "cdx:license:foss", "value": "true" }, { "name": "cdx:license:osiApproved", "value": "true" }, { "name": "cdx:license:fsfLibre", "value": "true" }, { "name": "cdx:license:deprecated", "value": "false" } ] } } ], "purl": "pkg:npm/%40types/fs-extra@11.0.4", "externalReferences": [ { "type": "vcs", "url": "https://github.com/DefinitelyTyped/DefinitelyTyped/tree/master/types/fs-extra" }, { "type": "vcs", "url": "https://github.com/DefinitelyTyped/DefinitelyTyped.git" } ], "type": "library", "bom-ref": "pkg:npm/@types/fs-extra@11.0.4", "properties": [ { "name": "SrcFile", "value": "node_modules/@types/fs-extra/package.json" }, { "name": "cdx:license:category", "value": "Permissive" } ], "evidence": { "identity": [ { "field": "purl", "confidence": 0.7, "methods": [ { "technique": "manifest-analysis", "confidence": 0.7, "value": "node_modules/@types/fs-extra/package.json" } ], "concludedValue": "node_modules/@types/fs-extra/package.json" } ] } }, { "authors": [ { "name": "Ayoub Kaanich" } ], "group": "@renovatebot", "name": "pep440", "version": "4.2.1", "description": "PEP440 implementation in JavaScript", "scope": "required", "licenses": [ { "license": { "id": "Apache-2.0", "url": "https://opensource.org/licenses/Apache-2.0", "properties": [ { "name": "cdx:license:category", "value": "Permissive" }, { "name": "cdx:license:foss", "value": "true" }, { "name": "cdx:license:osiApproved", "value": "true" }, { "name": "cdx:license:fsfLibre", "value": "true" }, { "name": "cdx:license:deprecated", "value": "false" } ] } } ], "purl": "pkg:npm/%40renovatebot/pep440@4.2.1", "externalReferences": [ { "type": "vcs", "url": "https://github.com/renovatebot/pep440#readme" }, { "type": "vcs", "url": "https://github.com/renovatebot/pep440.git" } ], "type": "library", "bom-ref": "pkg:npm/@renovatebot/pep440@4.2.1", "properties": [ { "name": "SrcFile", "value": "node_modules/@renovatebot/pep440/package.json" }, { "name": "ExportedModules", "value": "@renovatebot/pep440,@renovatebot/pep440/lib/specifier,Pep440Version,@renovatebot/pep440/Pep440Version,Pep440Constraint,@renovatebot/pep440/Pep440Constraint,parsePep440Constraint,@renovatebot/pep440/lib/specifier/parsePep440Constraint,pep440Satisfies,@renovatebot/pep440/lib/specifier/pep440Satisfies" }, { "name": "ImportedModules", "value": "@renovatebot/pep440/lib/version,stringify,@renovatebot/pep440/lib/version/stringify,@renovatebot/pep440,parse,@renovatebot/pep440/parse,Pep440Version,@renovatebot/pep440/Pep440Version,Pep440Constraint,@renovatebot/pep440/Pep440Constraint,@renovatebot/pep440/lib/specifier,@renovatebot/pep440/lib/specifier/parse,satisfies,@renovatebot/pep440/lib/specifier/satisfies" }, { "name": "cdx:license:category", "value": "Permissive" } ], "evidence": { "identity": [ { "field": "purl", "confidence": 0.7, "methods": [ { "technique": "manifest-analysis", "confidence": 0.7, "value": "node_modules/@renovatebot/pep440/package.json" } ], "concludedValue": "node_modules/@renovatebot/pep440/package.json" } ], "occurrences": [ { "location": "dist/index.js", "line": 497 }, { "location": "dist/index.js", "line": 513 }, { "location": "dist/index.cjs", "line": 581 }, { "location": "src/manifest/pep440.ts", "line": 4 }, { "location": "src/manifest/pep440.ts", "line": 26 }, { "location": "dist/index.js", "line": 498 }, { "location": "dist/index.js", "line": 1329 }, { "location": "dist/index.js", "line": 1334 }, { "location": "dist/index.cjs", "line": 582 }, { "location": "src/manifest/pep440.ts", "line": 3 }, { "location": "src/manifest/pep440.ts", "line": 6 }, { "location": "src/manifest/pep440.ts", "line": 7 }, { "location": "src/manifest/python-specifiers.ts", "line": 10 }, { "location": "dist/index.js", "line": 502 }, { "location": "dist/index.js", "line": 1345 }, { "location": "dist/index.js", "line": 1604 }, { "location": "dist/index.js", "line": 1617 }, { "location": "dist/index.js", "line": 2258 }, { "location": "dist/index.cjs", "line": 583 }, { "location": "src/manifest/pep440.ts", "line": 11 } ] } }, { "authors": [ { "name": "Guy Bedford" }, { "name": " Eduardo Rodrigues<16357187+eduardomourar@users.noreply.github.com>" } ], "group": "@bytecodealliance", "name": "preview2-shim", "version": "0.17.6", "description": "WASI Preview2 shim for JS environments", "scope": "required", "licenses": [ { "expression": "Apache-2.0 WITH LLVM-exception" } ], "purl": "pkg:npm/%40bytecodealliance/preview2-shim@0.17.6", "externalReferences": [ { "type": "vcs", "url": "https://github.com/bytecodealliance/jco#readme" }, { "type": "vcs", "url": "git+https://github.com/bytecodealliance/jco.git" } ], "type": "library", "bom-ref": "pkg:npm/@bytecodealliance/preview2-shim@0.17.6", "properties": [ { "name": "SrcFile", "value": "node_modules/@bytecodealliance/preview2-shim/package.json" } ], "evidence": { "identity": [ { "field": "purl", "confidence": 0.7, "methods": [ { "technique": "manifest-analysis", "confidence": 0.7, "value": "node_modules/@bytecodealliance/preview2-shim/package.json" } ], "concludedValue": "node_modules/@bytecodealliance/preview2-shim/package.json" } ] } }, { "group": "@bytecodealliance", "name": "jco-transpile", "version": "0.1.1", "description": "WebAssembly Component transpilation functionality for Jco", "scope": "required", "licenses": [ { "expression": "Apache-2.0 WITH LLVM-exception" } ], "purl": "pkg:npm/%40bytecodealliance/jco-transpile@0.1.1", "externalReferences": [ { "type": "vcs", "url": "https://github.com/bytecodealliance/jco#readme" }, { "type": "vcs", "url": "git+https://github.com/bytecodealliance/jco.git" } ], "type": "library", "bom-ref": "pkg:npm/@bytecodealliance/jco-transpile@0.1.1", "properties": [ { "name": "SrcFile", "value": "node_modules/@bytecodealliance/jco-transpile/package.json" }, { "name": "ImportedModules", "value": "@bytecodealliance/jco-transpile,transpile,@bytecodealliance/jco-transpile/transpile,writeFiles,@bytecodealliance/jco-transpile/writeFiles" } ], "evidence": { "identity": [ { "field": "purl", "confidence": 0.7, "methods": [ { "technique": "manifest-analysis", "confidence": 0.7, "value": "node_modules/@bytecodealliance/jco-transpile/package.json" } ], "concludedValue": "node_modules/@bytecodealliance/jco-transpile/package.json" } ], "occurrences": [ { "location": "scripts/build-wasm.mjs", "line": 4 }, { "location": "scripts/build-wasm.mjs", "line": 100 }, { "location": "scripts/build-wasm.mjs", "line": 107 } ] } } ], "dependencies": [], "annotations": [ { "bom-ref": "metadata-annotations", "subjects": [ "pkg:npm/@vercel/python-analysis@0.11.1" ], "annotator": { "component": { "group": "@cyclonedx", "name": "cdxgen", "version": "12.8.4", "purl": "pkg:npm/%40cyclonedx/cdxgen@12.8.4", "type": "application", "bom-ref": "pkg:npm/@cyclonedx/cdxgen@12.8.4", "publisher": "OWASP Foundation", "authors": [ { "name": "OWASP Foundation" } ] } }, "timestamp": "2026-09-10T01:15:18Z", "text": "This Software Bill-of-Materials (SBOM) document was created on Thursday, September 10, 2026 with cdxgen. The data was captured during the pre-build lifecycle phase without building the application. The document describes an application named 'python-analysis' with version '0.11.1'. The package type in this SBOM is npm with 3 purl namespaces described under components. The components were identified from 13 source files." } ] }