{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:25145452-8f2f-566a-9ee7-1aca0c39da03", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "@astrojs/upgrade", "purl": "pkg:npm/%40astrojs/upgrade@3.6.5-tuxcare.10", "type": "library", "bom-ref": "pkg:npm/%40astrojs/upgrade@3.6.5-tuxcare.10", "version": "3.6.5-tuxcare.10", "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2024-47885", "affects": [ { "ref": "pkg:npm/%40astrojs/upgrade@3.6.5-tuxcare.10" } ], "bom-ref": "urn:uuid:a2819f08-9cd9-5710-91a0-907ea200530f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-47885 is fixed in version 3.6.5-tuxcare.10 of @astrojs/upgrade." } }, { "id": "CVE-2024-56140", "affects": [ { "ref": "pkg:npm/%40astrojs/upgrade@3.6.5-tuxcare.10" } ], "bom-ref": "urn:uuid:558378d8-5e9f-59ca-8e7f-142a2004b801", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-56140 is fixed in version 3.6.5-tuxcare.10 of @astrojs/upgrade." } }, { "id": "CVE-2024-56159", "affects": [ { "ref": "pkg:npm/%40astrojs/upgrade@3.6.5-tuxcare.10" } ], "bom-ref": "urn:uuid:480c841f-5b21-5c07-83e0-9ef4e8ed29d7", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-56159 is fixed in version 3.6.5-tuxcare.10 of @astrojs/upgrade." } }, { "id": "CVE-2025-55303", "affects": [ { "ref": "pkg:npm/%40astrojs/upgrade@3.6.5-tuxcare.10" } ], "bom-ref": "urn:uuid:d5388add-45c6-5980-96d5-b5f800098920", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-55303 is fixed in version 3.6.5-tuxcare.10 of @astrojs/upgrade." } }, { "id": "CVE-2025-61925", "affects": [ { "ref": "pkg:npm/%40astrojs/upgrade@3.6.5-tuxcare.10" } ], "bom-ref": "urn:uuid:b744a240-659f-52d0-ad9f-bfeb605d81e0", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-61925 is fixed in version 3.6.5-tuxcare.10 of @astrojs/upgrade." } }, { "id": "CVE-2025-64525", "affects": [ { "ref": "pkg:npm/%40astrojs/upgrade@3.6.5-tuxcare.10" } ], "bom-ref": "urn:uuid:6d613e09-4035-5652-9e6e-c9d2cd09f249", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-64525 is fixed in version 3.6.5-tuxcare.10 of @astrojs/upgrade." } }, { "id": "CVE-2025-64757", "affects": [ { "ref": "pkg:npm/%40astrojs/upgrade@3.6.5-tuxcare.10" } ], "bom-ref": "urn:uuid:1cdb2448-534f-5432-9b30-c163f9568b82", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-64757 is fixed in version 3.6.5-tuxcare.10 of @astrojs/upgrade." } }, { "id": "CVE-2025-64764", "affects": [ { "ref": "pkg:npm/%40astrojs/upgrade@3.6.5-tuxcare.10" } ], "bom-ref": "urn:uuid:dd6bb6d3-ecc5-57c5-a127-9850fc40dbd2", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-64764 is fixed in version 3.6.5-tuxcare.10 of @astrojs/upgrade." } }, { "id": "CVE-2025-64765", "affects": [ { "ref": "pkg:npm/%40astrojs/upgrade@3.6.5-tuxcare.10" } ], "bom-ref": "urn:uuid:3138fb54-80aa-5fbf-8aa4-03ca83283f40", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-64765 is fixed in version 3.6.5-tuxcare.10 of @astrojs/upgrade." } }, { "id": "CVE-2025-65019", "affects": [ { "ref": "pkg:npm/%40astrojs/upgrade@3.6.5-tuxcare.10" } ], "bom-ref": "urn:uuid:25817233-2946-52d0-a02f-2be57a8423e2", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-65019 is fixed in version 3.6.5-tuxcare.10 of @astrojs/upgrade." } }, { "id": "CVE-2025-66202", "affects": [ { "ref": "pkg:npm/%40astrojs/upgrade@3.6.5-tuxcare.10" } ], "bom-ref": "urn:uuid:3ea708bf-6f5b-556c-8444-3ed79ae97116", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-66202 is fixed in version 3.6.5-tuxcare.10 of @astrojs/upgrade." } }, { "id": "CVE-2026-33769", "affects": [ { "ref": "pkg:npm/%40astrojs/upgrade@3.6.5-tuxcare.10" } ], "bom-ref": "urn:uuid:f616d48f-e96a-55e3-be3f-96d72f31b716", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-33769 is fixed in version 3.6.5-tuxcare.10 of @astrojs/upgrade." } }, { "id": "CVE-2026-41067", "affects": [ { "ref": "pkg:npm/%40astrojs/upgrade@3.6.5-tuxcare.10" } ], "bom-ref": "urn:uuid:9a01456a-0efe-5143-bd34-d6fa0d8af7b6", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41067 is fixed in version 3.6.5-tuxcare.10 of @astrojs/upgrade." } }, { "id": "CVE-2026-45028", "affects": [ { "ref": "pkg:npm/%40astrojs/upgrade@3.6.5-tuxcare.10" } ], "bom-ref": "urn:uuid:d9f10706-36f8-5c75-9f0b-540d4f98355c", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-45028 does not affect version 3.6.5-tuxcare.10 of @astrojs/upgrade. not_affected \u2014 Astro version 3.6.5 is NOT AFFECTED by CVE-2026-45028. The vulnerability concerns server islands encryption (AES-GCM ciphertext replay between props and slots), but server islands functionality does not exist in version 3.6.5. The feature was introduced in later versions (~May 2025, v5.x/6.x), and the vulnerability was fixed in v6.1.10 (April 2026). Exhaustive search across 327 source files con...", "justification": "code_not_present" } }, { "id": "CVE-2026-50146", "affects": [ { "ref": "pkg:npm/%40astrojs/upgrade@3.6.5-tuxcare.10" } ], "bom-ref": "urn:uuid:e1b73fc2-51da-54b3-bdc2-ab90540a159d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50146 is fixed in version 3.6.5-tuxcare.10 of @astrojs/upgrade." } }, { "id": "CVE-2026-54298", "affects": [ { "ref": "pkg:npm/%40astrojs/upgrade@3.6.5-tuxcare.10" } ], "bom-ref": "urn:uuid:04b762ee-5e4d-5045-a350-5b6e8d3839f9", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54298 is fixed in version 3.6.5-tuxcare.10 of @astrojs/upgrade." } }, { "id": "CVE-2026-54299", "affects": [ { "ref": "pkg:npm/%40astrojs/upgrade@3.6.5-tuxcare.10" } ], "bom-ref": "urn:uuid:7de3fff2-398d-525e-99a4-dadd3b203165", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54299 is fixed in version 3.6.5-tuxcare.10 of @astrojs/upgrade." } }, { "id": "CVE-2026-59728", "affects": [ { "ref": "pkg:npm/%40astrojs/upgrade@3.6.5-tuxcare.10" } ], "bom-ref": "urn:uuid:a02218e2-8702-5fcd-8455-6445bbbcc804", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59728 is fixed in version 3.6.5-tuxcare.10 of @astrojs/upgrade." } }, { "id": "CVE-2026-59729", "affects": [ { "ref": "pkg:npm/%40astrojs/upgrade@3.6.5-tuxcare.10" } ], "bom-ref": "urn:uuid:2173ab2c-2e94-5b23-8a14-41db97e1a3ad", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59729 is fixed in version 3.6.5-tuxcare.10 of @astrojs/upgrade." } }, { "id": "CVE-2026-73422", "affects": [ { "ref": "pkg:npm/%40astrojs/upgrade@3.6.5-tuxcare.10" } ], "bom-ref": "urn:uuid:234587fd-368a-527e-becc-c66b87cc4b7b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-73422 is fixed in version 3.6.5-tuxcare.10 of @astrojs/upgrade." } }, { "id": "CVE-2026-84376", "affects": [ { "ref": "pkg:npm/%40astrojs/upgrade@3.6.5-tuxcare.10" } ], "bom-ref": "urn:uuid:a25bc1f5-c3f7-5d0d-b659-0220966eee17", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-84376 is fixed in version 3.6.5-tuxcare.10 of @astrojs/upgrade." } }, { "id": "GHSA-26w7-cxv4-gfx2", "affects": [ { "ref": "pkg:npm/%40astrojs/upgrade@3.6.5-tuxcare.10" } ], "bom-ref": "urn:uuid:b34db678-0c8d-597b-b690-ae73cf781fc3", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-26w7-cxv4-gfx2 is fixed in version 3.6.5-tuxcare.10 of @astrojs/upgrade." } }, { "id": "GHSA-4g3v-8h47-v7g6", "affects": [ { "ref": "pkg:npm/%40astrojs/upgrade@3.6.5-tuxcare.10" } ], "bom-ref": "urn:uuid:653e1847-f7aa-5fd2-bb24-3a873660d971", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-4g3v-8h47-v7g6 is fixed in version 3.6.5-tuxcare.10 of @astrojs/upgrade." } } ], "dependencies": [ { "ref": "pkg:npm/%40astrojs/upgrade@3.6.5-tuxcare.10" } ] }