{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:8aff26a3-1087-589f-8cbd-305def379197", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "@astrojs/upgrade", "purl": "pkg:npm/%40astrojs/upgrade@3.6.5-tuxcare.8", "type": "library", "bom-ref": "pkg:npm/%40astrojs/upgrade@3.6.5-tuxcare.8", "version": "3.6.5-tuxcare.8", "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2024-47885", "affects": [ { "ref": "pkg:npm/%40astrojs/upgrade@3.6.5-tuxcare.8" } ], "bom-ref": "urn:uuid:24a9f713-4327-5ed4-b500-9fbe1405f1c1", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-47885 is fixed in version 3.6.5-tuxcare.8 of @astrojs/upgrade." } }, { "id": "CVE-2024-56140", "affects": [ { "ref": "pkg:npm/%40astrojs/upgrade@3.6.5-tuxcare.8" } ], "bom-ref": "urn:uuid:12105c09-884c-5458-ae90-88c090e1b09f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-56140 is fixed in version 3.6.5-tuxcare.8 of @astrojs/upgrade." } }, { "id": "CVE-2024-56159", "affects": [ { "ref": "pkg:npm/%40astrojs/upgrade@3.6.5-tuxcare.8" } ], "bom-ref": "urn:uuid:c4569655-8d6a-5363-8129-6f0c340add6a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-56159 is fixed in version 3.6.5-tuxcare.8 of @astrojs/upgrade." } }, { "id": "CVE-2025-55303", "affects": [ { "ref": "pkg:npm/%40astrojs/upgrade@3.6.5-tuxcare.8" } ], "bom-ref": "urn:uuid:a07ac945-5160-5cbf-bd7d-8d16a148aa9d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-55303 is fixed in version 3.6.5-tuxcare.8 of @astrojs/upgrade." } }, { "id": "CVE-2025-61925", "affects": [ { "ref": "pkg:npm/%40astrojs/upgrade@3.6.5-tuxcare.8" } ], "bom-ref": "urn:uuid:451961b1-8284-585b-bf8b-da9bd96c8f26", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-61925 is fixed in version 3.6.5-tuxcare.8 of @astrojs/upgrade." } }, { "id": "CVE-2025-64525", "affects": [ { "ref": "pkg:npm/%40astrojs/upgrade@3.6.5-tuxcare.8" } ], "bom-ref": "urn:uuid:11a6c717-05f8-59fb-95c1-5b649d4fe872", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-64525 is fixed in version 3.6.5-tuxcare.8 of @astrojs/upgrade." } }, { "id": "CVE-2025-64757", "affects": [ { "ref": "pkg:npm/%40astrojs/upgrade@3.6.5-tuxcare.8" } ], "bom-ref": "urn:uuid:07d6f44c-dd78-5a19-a2f4-476dec8aadbc", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-64757 is fixed in version 3.6.5-tuxcare.8 of @astrojs/upgrade." } }, { "id": "CVE-2025-64764", "affects": [ { "ref": "pkg:npm/%40astrojs/upgrade@3.6.5-tuxcare.8" } ], "bom-ref": "urn:uuid:0273d54d-1a5c-508e-9a33-d94ee0c56fc7", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-64764 is fixed in version 3.6.5-tuxcare.8 of @astrojs/upgrade." } }, { "id": "CVE-2025-64765", "affects": [ { "ref": "pkg:npm/%40astrojs/upgrade@3.6.5-tuxcare.8" } ], "bom-ref": "urn:uuid:be6c3bf8-e404-544b-95b1-f94b711e03ed", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-64765 is fixed in version 3.6.5-tuxcare.8 of @astrojs/upgrade." } }, { "id": "CVE-2025-65019", "affects": [ { "ref": "pkg:npm/%40astrojs/upgrade@3.6.5-tuxcare.8" } ], "bom-ref": "urn:uuid:2439644b-9e11-56ef-b6a4-135aa4a774a2", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-65019 is fixed in version 3.6.5-tuxcare.8 of @astrojs/upgrade." } }, { "id": "CVE-2025-66202", "affects": [ { "ref": "pkg:npm/%40astrojs/upgrade@3.6.5-tuxcare.8" } ], "bom-ref": "urn:uuid:93ddc98b-4790-5142-b5c1-57ac7a6afa8a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-66202 is fixed in version 3.6.5-tuxcare.8 of @astrojs/upgrade." } }, { "id": "CVE-2026-33769", "affects": [ { "ref": "pkg:npm/%40astrojs/upgrade@3.6.5-tuxcare.8" } ], "bom-ref": "urn:uuid:d24d3fdb-6537-5b80-912c-5673afdade93", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-33769 is fixed in version 3.6.5-tuxcare.8 of @astrojs/upgrade." } }, { "id": "CVE-2026-41067", "affects": [ { "ref": "pkg:npm/%40astrojs/upgrade@3.6.5-tuxcare.8" } ], "bom-ref": "urn:uuid:210ae9a2-858e-5c00-822b-b5ce0fc8f90d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41067 is fixed in version 3.6.5-tuxcare.8 of @astrojs/upgrade." } }, { "id": "CVE-2026-45028", "affects": [ { "ref": "pkg:npm/%40astrojs/upgrade@3.6.5-tuxcare.8" } ], "bom-ref": "urn:uuid:f93a8d9b-75b2-54e8-924a-8f453412f80d", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-45028 does not affect version 3.6.5-tuxcare.8 of @astrojs/upgrade. not_affected \u2014 Astro version 3.6.5 is NOT AFFECTED by CVE-2026-45028. The vulnerability concerns server islands encryption (AES-GCM ciphertext replay between props and slots), but server islands functionality does not exist in version 3.6.5. The feature was introduced in later versions (~May 2025, v5.x/6.x), and the vulnerability was fixed in v6.1.10 (April 2026). Exhaustive search across 327 source files con...", "justification": "code_not_present" } }, { "id": "CVE-2026-50146", "affects": [ { "ref": "pkg:npm/%40astrojs/upgrade@3.6.5-tuxcare.8" } ], "bom-ref": "urn:uuid:df7e9ed4-8d1f-5ad8-9ac8-b6082e23d9af", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50146 is fixed in version 3.6.5-tuxcare.8 of @astrojs/upgrade." } }, { "id": "CVE-2026-54298", "affects": [ { "ref": "pkg:npm/%40astrojs/upgrade@3.6.5-tuxcare.8" } ], "bom-ref": "urn:uuid:0f5fcd84-6780-5914-9c11-e77681b34b93", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54298 is fixed in version 3.6.5-tuxcare.8 of @astrojs/upgrade." } }, { "id": "CVE-2026-54299", "affects": [ { "ref": "pkg:npm/%40astrojs/upgrade@3.6.5-tuxcare.8" } ], "bom-ref": "urn:uuid:094cb499-e63a-514a-bbed-a7e94ebf47fd", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54299 is fixed in version 3.6.5-tuxcare.8 of @astrojs/upgrade." } }, { "id": "CVE-2026-59728", "affects": [ { "ref": "pkg:npm/%40astrojs/upgrade@3.6.5-tuxcare.8" } ], "bom-ref": "urn:uuid:51ee6e63-abe6-5b77-8f2f-a807e9f4d660", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59728 is fixed in version 3.6.5-tuxcare.8 of @astrojs/upgrade." } }, { "id": "CVE-2026-59729", "affects": [ { "ref": "pkg:npm/%40astrojs/upgrade@3.6.5-tuxcare.8" } ], "bom-ref": "urn:uuid:f93af5a7-6166-5c6d-a901-53d977e90694", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59729 is fixed in version 3.6.5-tuxcare.8 of @astrojs/upgrade." } }, { "id": "CVE-2026-73422", "affects": [ { "ref": "pkg:npm/%40astrojs/upgrade@3.6.5-tuxcare.8" } ], "bom-ref": "urn:uuid:d3388520-2461-5c2f-ab78-276a4704e8d6", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-73422 is fixed in version 3.6.5-tuxcare.8 of @astrojs/upgrade." } }, { "id": "CVE-2026-84376", "affects": [ { "ref": "pkg:npm/%40astrojs/upgrade@3.6.5-tuxcare.8" } ], "bom-ref": "urn:uuid:e02d40b8-d622-5dd1-810e-128ec2b7d50c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-84376 affects version 3.6.5-tuxcare.8 of @astrojs/upgrade, and is fixed in 3.6.5-tuxcare.9." } }, { "id": "GHSA-26w7-cxv4-gfx2", "affects": [ { "ref": "pkg:npm/%40astrojs/upgrade@3.6.5-tuxcare.8" } ], "bom-ref": "urn:uuid:24a90c28-0b1d-59c8-9c67-6ec14b86eee0", "analysis": { "state": "exploitable", "detail": "Vulnerability GHSA-26w7-cxv4-gfx2 affects version 3.6.5-tuxcare.8 of @astrojs/upgrade, and is fixed in 3.6.5-tuxcare.9." } }, { "id": "GHSA-4g3v-8h47-v7g6", "affects": [ { "ref": "pkg:npm/%40astrojs/upgrade@3.6.5-tuxcare.8" } ], "bom-ref": "urn:uuid:874d1d6b-b605-59f0-9466-8da821261b8b", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-4g3v-8h47-v7g6 is fixed in version 3.6.5-tuxcare.8 of @astrojs/upgrade." } } ], "dependencies": [ { "ref": "pkg:npm/%40astrojs/upgrade@3.6.5-tuxcare.8" } ] }