{"$schema":"http://cyclonedx.org/schema/bom-1.7.schema.json","bomFormat":"CycloneDX","specVersion":"1.7","serialNumber":"urn:uuid:70334157-94a6-42a6-9cbd-261f374d6c83","version":1,"metadata":{"timestamp":"2026-10-15T10:08:01+09:00","tools":{"components":[{"type":"application","author":"anchore","name":"syft","version":"1.54.1"}]},"component":{"bom-ref":"b4d2582450168e49","type":"file","name":"~/projects/sca-benchmark-wt/refresh-latest/fixtures/bun-lock"}},"components":[{"bom-ref":"pkg:npm/debug@4.3.4?package-id=ef7c34ade30d964a","type":"library","name":"debug","version":"4.3.4","cpe":"cpe:2.3:a:debug_project:debug:4.3.4:*:*:*:*:node.js:*:*","purl":"pkg:npm/debug@4.3.4","properties":[{"name":"syft:package:foundBy","value":"javascript-lock-cataloger"},{"name":"syft:package:language","value":"javascript"},{"name":"syft:package:type","value":"npm"},{"name":"syft:package:metadataType","value":"javascript-bun-lock-entry"},{"name":"syft:location:0:path","value":"/bun.lock"}]},{"bom-ref":"pkg:npm/ms@2.1.2?package-id=441d1f1850a5c422","type":"library","name":"ms","version":"2.1.2","cpe":"cpe:2.3:a:vercel:ms:2.1.2:*:*:*:*:node.js:*:*","purl":"pkg:npm/ms@2.1.2","properties":[{"name":"syft:package:foundBy","value":"javascript-lock-cataloger"},{"name":"syft:package:language","value":"javascript"},{"name":"syft:package:type","value":"npm"},{"name":"syft:package:metadataType","value":"javascript-bun-lock-entry"},{"name":"syft:location:0:path","value":"/bun.lock"}]},{"bom-ref":"7bd9ba38660beecd","type":"file","name":"~/projects/sca-benchmark-wt/refresh-latest/fixtures/bun-lock/bun.lock","hashes":[{"alg":"SHA-1","content":"4c4a276ff291804a1b10aa50c045e69c611e6e93"},{"alg":"SHA-256","content":"48df22189625b1c08c476fb0edc9ac6876edaba988b94b9f11736865e06f9255"}]}],"dependencies":[{"ref":"pkg:npm/debug@4.3.4?package-id=ef7c34ade30d964a","dependsOn":["pkg:npm/ms@2.1.2?package-id=441d1f1850a5c422"]}]}