{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:e1cdf16a-b665-59d4-a288-d5537281cee4", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "@astrojs/upgrade", "purl": "pkg:npm/%40astrojs/upgrade@3.6.5-tuxcare.9", "type": "library", "bom-ref": "pkg:npm/%40astrojs/upgrade@3.6.5-tuxcare.9", "version": "3.6.5-tuxcare.9", "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2024-47885", "affects": [ { "ref": "pkg:npm/%40astrojs/upgrade@3.6.5-tuxcare.9" } ], "bom-ref": "urn:uuid:55e32ce6-59bd-5f31-a91a-943c1a6c034f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-47885 is fixed in version 3.6.5-tuxcare.9 of @astrojs/upgrade." } }, { "id": "CVE-2024-56140", "affects": [ { "ref": "pkg:npm/%40astrojs/upgrade@3.6.5-tuxcare.9" } ], "bom-ref": "urn:uuid:1bf07155-7d08-5fb2-b013-6c22a26d9653", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-56140 is fixed in version 3.6.5-tuxcare.9 of @astrojs/upgrade." } }, { "id": "CVE-2024-56159", "affects": [ { "ref": "pkg:npm/%40astrojs/upgrade@3.6.5-tuxcare.9" } ], "bom-ref": "urn:uuid:6a9ab83d-5ee4-551c-a2d5-ea039d346e92", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-56159 is fixed in version 3.6.5-tuxcare.9 of @astrojs/upgrade." } }, { "id": "CVE-2025-55303", "affects": [ { "ref": "pkg:npm/%40astrojs/upgrade@3.6.5-tuxcare.9" } ], "bom-ref": "urn:uuid:6a9db8f6-ec64-5e73-836a-5ef4b92b93ad", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-55303 is fixed in version 3.6.5-tuxcare.9 of @astrojs/upgrade." } }, { "id": "CVE-2025-61925", "affects": [ { "ref": "pkg:npm/%40astrojs/upgrade@3.6.5-tuxcare.9" } ], "bom-ref": "urn:uuid:6e3ba22e-a9cd-5447-a084-8b100f3546b8", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-61925 is fixed in version 3.6.5-tuxcare.9 of @astrojs/upgrade." } }, { "id": "CVE-2025-64525", "affects": [ { "ref": "pkg:npm/%40astrojs/upgrade@3.6.5-tuxcare.9" } ], "bom-ref": "urn:uuid:04bbec53-7a5e-5ef2-bc77-a834c19e4fb1", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-64525 is fixed in version 3.6.5-tuxcare.9 of @astrojs/upgrade." } }, { "id": "CVE-2025-64757", "affects": [ { "ref": "pkg:npm/%40astrojs/upgrade@3.6.5-tuxcare.9" } ], "bom-ref": "urn:uuid:50fe4299-bae3-52d2-98f7-482e584d2e89", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-64757 is fixed in version 3.6.5-tuxcare.9 of @astrojs/upgrade." } }, { "id": "CVE-2025-64764", "affects": [ { "ref": "pkg:npm/%40astrojs/upgrade@3.6.5-tuxcare.9" } ], "bom-ref": "urn:uuid:b5ae7ff6-79da-5fa3-8439-e6a200cb7de9", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-64764 is fixed in version 3.6.5-tuxcare.9 of @astrojs/upgrade." } }, { "id": "CVE-2025-64765", "affects": [ { "ref": "pkg:npm/%40astrojs/upgrade@3.6.5-tuxcare.9" } ], "bom-ref": "urn:uuid:ab0aa669-1188-54b8-a5ed-f40158bea1f0", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-64765 is fixed in version 3.6.5-tuxcare.9 of @astrojs/upgrade." } }, { "id": "CVE-2025-65019", "affects": [ { "ref": "pkg:npm/%40astrojs/upgrade@3.6.5-tuxcare.9" } ], "bom-ref": "urn:uuid:fe49be5f-9d03-575a-a8ee-02f2811ce981", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-65019 is fixed in version 3.6.5-tuxcare.9 of @astrojs/upgrade." } }, { "id": "CVE-2025-66202", "affects": [ { "ref": "pkg:npm/%40astrojs/upgrade@3.6.5-tuxcare.9" } ], "bom-ref": "urn:uuid:8ec4dc51-fd83-5b03-bb62-67d6fc388d3f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-66202 is fixed in version 3.6.5-tuxcare.9 of @astrojs/upgrade." } }, { "id": "CVE-2026-33769", "affects": [ { "ref": "pkg:npm/%40astrojs/upgrade@3.6.5-tuxcare.9" } ], "bom-ref": "urn:uuid:77d07d25-05c9-5cde-8737-44a0a591391a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-33769 is fixed in version 3.6.5-tuxcare.9 of @astrojs/upgrade." } }, { "id": "CVE-2026-41067", "affects": [ { "ref": "pkg:npm/%40astrojs/upgrade@3.6.5-tuxcare.9" } ], "bom-ref": "urn:uuid:fdcd18de-ef11-5680-917c-0732d2bcf82e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41067 is fixed in version 3.6.5-tuxcare.9 of @astrojs/upgrade." } }, { "id": "CVE-2026-45028", "affects": [ { "ref": "pkg:npm/%40astrojs/upgrade@3.6.5-tuxcare.9" } ], "bom-ref": "urn:uuid:df93008d-a9eb-515d-bcc6-452e1f92738f", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-45028 does not affect version 3.6.5-tuxcare.9 of @astrojs/upgrade. not_affected \u2014 Astro version 3.6.5 is NOT AFFECTED by CVE-2026-45028. The vulnerability concerns server islands encryption (AES-GCM ciphertext replay between props and slots), but server islands functionality does not exist in version 3.6.5. The feature was introduced in later versions (~May 2025, v5.x/6.x), and the vulnerability was fixed in v6.1.10 (April 2026). Exhaustive search across 327 source files con...", "justification": "code_not_present" } }, { "id": "CVE-2026-50146", "affects": [ { "ref": "pkg:npm/%40astrojs/upgrade@3.6.5-tuxcare.9" } ], "bom-ref": "urn:uuid:2afbd948-8e59-53cc-ab30-965087e250db", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50146 is fixed in version 3.6.5-tuxcare.9 of @astrojs/upgrade." } }, { "id": "CVE-2026-54298", "affects": [ { "ref": "pkg:npm/%40astrojs/upgrade@3.6.5-tuxcare.9" } ], "bom-ref": "urn:uuid:13262907-fa98-547e-9346-07e6f1d919f4", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54298 is fixed in version 3.6.5-tuxcare.9 of @astrojs/upgrade." } }, { "id": "CVE-2026-54299", "affects": [ { "ref": "pkg:npm/%40astrojs/upgrade@3.6.5-tuxcare.9" } ], "bom-ref": "urn:uuid:cd84d6bd-ddcf-596a-a4d9-6e5d71cee946", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54299 is fixed in version 3.6.5-tuxcare.9 of @astrojs/upgrade." } }, { "id": "CVE-2026-59728", "affects": [ { "ref": "pkg:npm/%40astrojs/upgrade@3.6.5-tuxcare.9" } ], "bom-ref": "urn:uuid:8565335d-050c-54d6-98fa-2147d2c86adf", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59728 is fixed in version 3.6.5-tuxcare.9 of @astrojs/upgrade." } }, { "id": "CVE-2026-59729", "affects": [ { "ref": "pkg:npm/%40astrojs/upgrade@3.6.5-tuxcare.9" } ], "bom-ref": "urn:uuid:2d62558e-7b8f-5bb5-9ea5-72bf53de6c92", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59729 is fixed in version 3.6.5-tuxcare.9 of @astrojs/upgrade." } }, { "id": "CVE-2026-73422", "affects": [ { "ref": "pkg:npm/%40astrojs/upgrade@3.6.5-tuxcare.9" } ], "bom-ref": "urn:uuid:df595e41-0a52-5ce6-8973-ef86e8447ed5", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-73422 is fixed in version 3.6.5-tuxcare.9 of @astrojs/upgrade." } }, { "id": "CVE-2026-84376", "affects": [ { "ref": "pkg:npm/%40astrojs/upgrade@3.6.5-tuxcare.9" } ], "bom-ref": "urn:uuid:6f99a4af-5f54-571a-b5ad-f4272ca0fbcf", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-84376 is fixed in version 3.6.5-tuxcare.9 of @astrojs/upgrade." } }, { "id": "GHSA-26w7-cxv4-gfx2", "affects": [ { "ref": "pkg:npm/%40astrojs/upgrade@3.6.5-tuxcare.9" } ], "bom-ref": "urn:uuid:251e4651-5129-508b-93dd-9622416fe8c5", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-26w7-cxv4-gfx2 is fixed in version 3.6.5-tuxcare.9 of @astrojs/upgrade." } }, { "id": "GHSA-4g3v-8h47-v7g6", "affects": [ { "ref": "pkg:npm/%40astrojs/upgrade@3.6.5-tuxcare.9" } ], "bom-ref": "urn:uuid:fc992c74-73ca-5c48-8ba3-05794f13f80d", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-4g3v-8h47-v7g6 is fixed in version 3.6.5-tuxcare.9 of @astrojs/upgrade." } } ], "dependencies": [ { "ref": "pkg:npm/%40astrojs/upgrade@3.6.5-tuxcare.9" } ] }