{
  "bomFormat": "CycloneDX",
  "specVersion": "1.7",
  "serialNumber": "urn:uuid:7bc3a56a-8d49-4b7a-8048-65ca48d2ff25",
  "version": 1,
  "metadata": {
    "timestamp": "2026-09-21T18:30:35Z",
    "tools": {
      "components": [
        {
          "group": "@cyclonedx",
          "name": "cdxgen",
          "version": "12.8.4",
          "purl": "pkg:npm/%40cyclonedx/cdxgen@12.8.4",
          "type": "application",
          "bom-ref": "pkg:npm/@cyclonedx/cdxgen@12.8.4",
          "publisher": "OWASP Foundation",
          "authors": [
            {
              "name": "OWASP Foundation"
            }
          ]
        }
      ]
    },
    "authors": [
      {
        "name": "OWASP Foundation"
      }
    ],
    "lifecycles": [
      {
        "phase": "pre-build"
      }
    ],
    "component": {
      "name": "github",
      "group": "@actions",
      "version": "5.1.1",
      "description": "Actions github lib",
      "purl": "pkg:npm/%40actions/github@5.1.1",
      "bom-ref": "pkg:npm/@actions/github@5.1.1",
      "properties": [
        {
          "name": "cdx:npm:scripts",
          "value": "audit-moderate, test, build, format, format-check, tsc"
        },
        {
          "name": "cdx:npm:buildScripts",
          "value": "build"
        },
        {
          "name": "cdx:license:category",
          "value": "Permissive"
        }
      ],
      "type": "application",
      "licenses": [
        {
          "license": {
            "id": "MIT",
            "url": "https://opensource.org/licenses/MIT",
            "properties": [
              {
                "name": "cdx:license:category",
                "value": "Permissive"
              },
              {
                "name": "cdx:license:foss",
                "value": "true"
              },
              {
                "name": "cdx:license:osiApproved",
                "value": "true"
              },
              {
                "name": "cdx:license:fsfLibre",
                "value": "true"
              },
              {
                "name": "cdx:license:deprecated",
                "value": "false"
              }
            ]
          }
        }
      ],
      "externalReferences": [
        {
          "type": "vcs",
          "url": "https://github.com/actions/toolkit/tree/main/packages/github"
        },
        {
          "type": "vcs",
          "url": "git+https://github.com/actions/toolkit.git"
        }
      ]
    },
    "properties": [
      {
        "name": "cdx:bom:componentTypes",
        "value": "npm"
      },
      {
        "name": "cdx:bom:componentNamespaces",
        "value": "@octokit"
      },
      {
        "name": "cdx:bom:componentSrcFiles",
        "value": "package-lock.json"
      }
    ]
  },
  "components": [
    {
      "group": "@octokit",
      "name": "core",
      "version": "3.6.0",
      "scope": "required",
      "hashes": [
        {
          "alg": "SHA-512",
          "content": "ed12912ae038c538cc858f9e1b78ed85bde19590ac3b0837af3b5687be5773e4a10d639f0c301359b799a401c1351a66e13bfd5a004c3b2d731096171ba349ed"
        }
      ],
      "purl": "pkg:npm/%40octokit/core@3.6.0",
      "externalReferences": [
        {
          "type": "distribution",
          "url": "https://registry.npmjs.org/@octokit/core/-/core-3.6.0.tgz"
        }
      ],
      "type": "library",
      "bom-ref": "pkg:npm/@octokit/core@3.6.0",
      "properties": [
        {
          "name": "SrcFile",
          "value": "package-lock.json"
        },
        {
          "name": "ResolvedUrl",
          "value": "https://registry.npmjs.org/@octokit/core/-/core-3.6.0.tgz"
        },
        {
          "name": "ImportedModules",
          "value": "@octokit/core,Octokit,@octokit/core/Octokit,@octokit/core/dist-types/types,OctokitOptions,@octokit/core/dist-types/types/OctokitOptions,OctokitPlugin,@octokit/core/dist-types/types/OctokitPlugin"
        }
      ],
      "evidence": {
        "identity": [
          {
            "field": "purl",
            "confidence": 1,
            "methods": [
              {
                "technique": "manifest-analysis",
                "confidence": 1,
                "value": "package-lock.json"
              }
            ],
            "concludedValue": "package-lock.json"
          }
        ],
        "occurrences": [
          {
            "location": "lib/utils.js",
            "line": 26
          },
          {
            "location": "src/utils.ts",
            "line": 5
          },
          {
            "location": "src/utils.ts",
            "line": 20
          },
          {
            "location": "src/github.ts",
            "line": 5
          },
          {
            "location": "src/internal/utils.ts",
            "line": 3
          },
          {
            "location": "src/utils.ts",
            "line": 6
          }
        ]
      }
    },
    {
      "group": "@octokit",
      "name": "auth-token",
      "version": "2.4.5",
      "scope": "required",
      "hashes": [
        {
          "alg": "SHA-512",
          "content": "069198b0f809b74e4ceff2ffe45a04d4f8806ddc57159917ff790361cb2f775bfa5219671397bde9d4c3af47b35ff105c1c890c5fddc355d25a22a6c51153e58"
        }
      ],
      "purl": "pkg:npm/%40octokit/auth-token@2.4.5",
      "externalReferences": [
        {
          "type": "distribution",
          "url": "https://registry.npmjs.org/@octokit/auth-token/-/auth-token-2.4.5.tgz"
        }
      ],
      "type": "library",
      "bom-ref": "pkg:npm/@octokit/auth-token@2.4.5",
      "properties": [
        {
          "name": "SrcFile",
          "value": "package-lock.json"
        },
        {
          "name": "ResolvedUrl",
          "value": "https://registry.npmjs.org/@octokit/auth-token/-/auth-token-2.4.5.tgz"
        }
      ],
      "evidence": {
        "identity": [
          {
            "field": "purl",
            "confidence": 1,
            "methods": [
              {
                "technique": "manifest-analysis",
                "confidence": 1,
                "value": "package-lock.json"
              }
            ],
            "concludedValue": "package-lock.json"
          }
        ]
      }
    },
    {
      "group": "@octokit",
      "name": "types",
      "version": "6.34.0",
      "scope": "required",
      "hashes": [
        {
          "alg": "SHA-512",
          "content": "b35ccb0635a1744236cf06a84a0c8e168292975d3d09471504273b6e23c9dda01fe8b18b53ab330ef8b7d493d4edbc5f95ada5a9f8636db83fe437453713b01f"
        }
      ],
      "purl": "pkg:npm/%40octokit/types@6.34.0",
      "externalReferences": [
        {
          "type": "distribution",
          "url": "https://registry.npmjs.org/@octokit/types/-/types-6.34.0.tgz"
        }
      ],
      "type": "library",
      "bom-ref": "pkg:npm/@octokit/types@6.34.0",
      "properties": [
        {
          "name": "SrcFile",
          "value": "package-lock.json"
        },
        {
          "name": "ResolvedUrl",
          "value": "https://registry.npmjs.org/@octokit/types/-/types-6.34.0.tgz"
        }
      ],
      "evidence": {
        "identity": [
          {
            "field": "purl",
            "confidence": 1,
            "methods": [
              {
                "technique": "manifest-analysis",
                "confidence": 1,
                "value": "package-lock.json"
              }
            ],
            "concludedValue": "package-lock.json"
          }
        ]
      }
    },
    {
      "group": "@octokit",
      "name": "openapi-types",
      "version": "11.2.0",
      "scope": "required",
      "hashes": [
        {
          "alg": "SHA-512",
          "content": "3c1b153bed792929469a223c400cdaaafb0d95996b0e5c8025872b5c10af554c42a7b5675e39303e81478231095f1dd617d040c2403a9df09403b8bdb0e0f328"
        }
      ],
      "purl": "pkg:npm/%40octokit/openapi-types@11.2.0",
      "externalReferences": [
        {
          "type": "distribution",
          "url": "https://registry.npmjs.org/@octokit/openapi-types/-/openapi-types-11.2.0.tgz"
        }
      ],
      "type": "library",
      "bom-ref": "pkg:npm/@octokit/openapi-types@11.2.0",
      "properties": [
        {
          "name": "SrcFile",
          "value": "package-lock.json"
        },
        {
          "name": "ResolvedUrl",
          "value": "https://registry.npmjs.org/@octokit/openapi-types/-/openapi-types-11.2.0.tgz"
        }
      ],
      "evidence": {
        "identity": [
          {
            "field": "purl",
            "confidence": 1,
            "methods": [
              {
                "technique": "manifest-analysis",
                "confidence": 1,
                "value": "package-lock.json"
              }
            ],
            "concludedValue": "package-lock.json"
          }
        ]
      }
    },
    {
      "group": "@octokit",
      "name": "graphql",
      "version": "4.6.1",
      "scope": "required",
      "hashes": [
        {
          "alg": "SHA-512",
          "content": "da5625bdfe184c38190935d35b8f8e5fef564cb16d11473a8469b8a8cd679598f3c63f9aae2ccce1a1d6cc15410b163d82587b188b34584ba24a06d5ceff1c98"
        }
      ],
      "purl": "pkg:npm/%40octokit/graphql@4.6.1",
      "externalReferences": [
        {
          "type": "distribution",
          "url": "https://registry.npmjs.org/@octokit/graphql/-/graphql-4.6.1.tgz"
        }
      ],
      "type": "library",
      "bom-ref": "pkg:npm/@octokit/graphql@4.6.1",
      "properties": [
        {
          "name": "SrcFile",
          "value": "package-lock.json"
        },
        {
          "name": "ResolvedUrl",
          "value": "https://registry.npmjs.org/@octokit/graphql/-/graphql-4.6.1.tgz"
        }
      ],
      "evidence": {
        "identity": [
          {
            "field": "purl",
            "confidence": 1,
            "methods": [
              {
                "technique": "manifest-analysis",
                "confidence": 1,
                "value": "package-lock.json"
              }
            ],
            "concludedValue": "package-lock.json"
          }
        ]
      }
    },
    {
      "group": "@octokit",
      "name": "request",
      "version": "5.6.3",
      "scope": "required",
      "hashes": [
        {
          "alg": "SHA-512",
          "content": "6c5265d08d4a55cf636137bdb5d186a4030fcb7d9d2c15d7a35752fd8c120932ffda777d5de1ec63ad7a444dc73d70d593e6be741bb3cb3e587655f07034ebd8"
        }
      ],
      "purl": "pkg:npm/%40octokit/request@5.6.3",
      "externalReferences": [
        {
          "type": "distribution",
          "url": "https://registry.npmjs.org/@octokit/request/-/request-5.6.3.tgz"
        }
      ],
      "type": "library",
      "bom-ref": "pkg:npm/@octokit/request@5.6.3",
      "properties": [
        {
          "name": "SrcFile",
          "value": "package-lock.json"
        },
        {
          "name": "ResolvedUrl",
          "value": "https://registry.npmjs.org/@octokit/request/-/request-5.6.3.tgz"
        }
      ],
      "evidence": {
        "identity": [
          {
            "field": "purl",
            "confidence": 1,
            "methods": [
              {
                "technique": "manifest-analysis",
                "confidence": 1,
                "value": "package-lock.json"
              }
            ],
            "concludedValue": "package-lock.json"
          }
        ]
      }
    },
    {
      "group": "@octokit",
      "name": "endpoint",
      "version": "6.0.11",
      "scope": "required",
      "hashes": [
        {
          "alg": "SHA-512",
          "content": "7d420fa71fa9672a0b5b8182b37c8c9e58f62dfa174d60d454f4c2e15dcc5042999b8f16f976297964990affaf605d59001526d82aa70d57f5b05b4862b8fb29"
        }
      ],
      "purl": "pkg:npm/%40octokit/endpoint@6.0.11",
      "externalReferences": [
        {
          "type": "distribution",
          "url": "https://registry.npmjs.org/@octokit/endpoint/-/endpoint-6.0.11.tgz"
        }
      ],
      "type": "library",
      "bom-ref": "pkg:npm/@octokit/endpoint@6.0.11",
      "properties": [
        {
          "name": "SrcFile",
          "value": "package-lock.json"
        },
        {
          "name": "ResolvedUrl",
          "value": "https://registry.npmjs.org/@octokit/endpoint/-/endpoint-6.0.11.tgz"
        }
      ],
      "evidence": {
        "identity": [
          {
            "field": "purl",
            "confidence": 1,
            "methods": [
              {
                "technique": "manifest-analysis",
                "confidence": 1,
                "value": "package-lock.json"
              }
            ],
            "concludedValue": "package-lock.json"
          }
        ]
      }
    },
    {
      "group": "",
      "name": "is-plain-object",
      "version": "5.0.0",
      "scope": "optional",
      "hashes": [
        {
          "alg": "SHA-512",
          "content": "5514b32a46cc9b98cc0e828b6e5b4090543942bed50e24c5197c581575e8c158f7f3b19e18d382b0e1fa32ccb4d12199dc5a7ce1bd4d69ad69b2a81c08810fe5"
        }
      ],
      "purl": "pkg:npm/is-plain-object@5.0.0",
      "externalReferences": [
        {
          "type": "distribution",
          "url": "https://registry.npmjs.org/is-plain-object/-/is-plain-object-5.0.0.tgz"
        }
      ],
      "type": "library",
      "bom-ref": "pkg:npm/is-plain-object@5.0.0",
      "properties": [
        {
          "name": "SrcFile",
          "value": "package-lock.json"
        },
        {
          "name": "ResolvedUrl",
          "value": "https://registry.npmjs.org/is-plain-object/-/is-plain-object-5.0.0.tgz"
        }
      ],
      "evidence": {
        "identity": [
          {
            "field": "purl",
            "confidence": 1,
            "methods": [
              {
                "technique": "manifest-analysis",
                "confidence": 1,
                "value": "package-lock.json"
              }
            ],
            "concludedValue": "package-lock.json"
          }
        ]
      }
    },
    {
      "group": "",
      "name": "universal-user-agent",
      "version": "6.0.0",
      "scope": "optional",
      "hashes": [
        {
          "alg": "SHA-512",
          "content": "8acc8d6b1df05e829aba53c36561d0a9b988c75936b5bf5f6f71860c14710ac71f615d8287b5b13c0ac1b05106f2cfec69fc174d3ec7e101a1688913a7de38ef"
        }
      ],
      "purl": "pkg:npm/universal-user-agent@6.0.0",
      "externalReferences": [
        {
          "type": "distribution",
          "url": "https://registry.npmjs.org/universal-user-agent/-/universal-user-agent-6.0.0.tgz"
        }
      ],
      "type": "library",
      "bom-ref": "pkg:npm/universal-user-agent@6.0.0",
      "properties": [
        {
          "name": "SrcFile",
          "value": "package-lock.json"
        },
        {
          "name": "ResolvedUrl",
          "value": "https://registry.npmjs.org/universal-user-agent/-/universal-user-agent-6.0.0.tgz"
        }
      ],
      "evidence": {
        "identity": [
          {
            "field": "purl",
            "confidence": 1,
            "methods": [
              {
                "technique": "manifest-analysis",
                "confidence": 1,
                "value": "package-lock.json"
              }
            ],
            "concludedValue": "package-lock.json"
          }
        ]
      }
    },
    {
      "group": "@octokit",
      "name": "request-error",
      "version": "2.1.0",
      "scope": "required",
      "hashes": [
        {
          "alg": "SHA-512",
          "content": "d5522f817c6cf561d28e272c470abc3e54762d1db1e83c2c240685833762d097c9a0648ef26608fdc1c943ef456cddb569af83ae034b9f039b9b27920bc466a6"
        }
      ],
      "purl": "pkg:npm/%40octokit/request-error@2.1.0",
      "externalReferences": [
        {
          "type": "distribution",
          "url": "https://registry.npmjs.org/@octokit/request-error/-/request-error-2.1.0.tgz"
        }
      ],
      "type": "library",
      "bom-ref": "pkg:npm/@octokit/request-error@2.1.0",
      "properties": [
        {
          "name": "SrcFile",
          "value": "package-lock.json"
        },
        {
          "name": "ResolvedUrl",
          "value": "https://registry.npmjs.org/@octokit/request-error/-/request-error-2.1.0.tgz"
        }
      ],
      "evidence": {
        "identity": [
          {
            "field": "purl",
            "confidence": 1,
            "methods": [
              {
                "technique": "manifest-analysis",
                "confidence": 1,
                "value": "package-lock.json"
              }
            ],
            "concludedValue": "package-lock.json"
          }
        ]
      }
    },
    {
      "group": "",
      "name": "deprecation",
      "version": "2.3.1",
      "scope": "optional",
      "hashes": [
        {
          "alg": "SHA-512",
          "content": "c661c8cb8177b1c295c0cb10e169d5692f1b1cec740e6570472c28b0a85a20b234cb030358fb414a4bb61cdc51bc5ee3b700d1b2813061049f6f18fc6fb46525"
        }
      ],
      "purl": "pkg:npm/deprecation@2.3.1",
      "externalReferences": [
        {
          "type": "distribution",
          "url": "https://registry.npmjs.org/deprecation/-/deprecation-2.3.1.tgz"
        }
      ],
      "type": "library",
      "bom-ref": "pkg:npm/deprecation@2.3.1",
      "properties": [
        {
          "name": "SrcFile",
          "value": "package-lock.json"
        },
        {
          "name": "ResolvedUrl",
          "value": "https://registry.npmjs.org/deprecation/-/deprecation-2.3.1.tgz"
        }
      ],
      "evidence": {
        "identity": [
          {
            "field": "purl",
            "confidence": 1,
            "methods": [
              {
                "technique": "manifest-analysis",
                "confidence": 1,
                "value": "package-lock.json"
              }
            ],
            "concludedValue": "package-lock.json"
          }
        ]
      }
    },
    {
      "group": "",
      "name": "once",
      "version": "1.4.0",
      "scope": "optional",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "583b1aa775961d4b113ac17d9c50baef9dd76bd1"
        }
      ],
      "purl": "pkg:npm/once@1.4.0",
      "externalReferences": [
        {
          "type": "distribution",
          "url": "https://registry.npmjs.org/once/-/once-1.4.0.tgz"
        }
      ],
      "type": "library",
      "bom-ref": "pkg:npm/once@1.4.0",
      "properties": [
        {
          "name": "SrcFile",
          "value": "package-lock.json"
        },
        {
          "name": "ResolvedUrl",
          "value": "https://registry.npmjs.org/once/-/once-1.4.0.tgz"
        }
      ],
      "evidence": {
        "identity": [
          {
            "field": "purl",
            "confidence": 1,
            "methods": [
              {
                "technique": "manifest-analysis",
                "confidence": 1,
                "value": "package-lock.json"
              }
            ],
            "concludedValue": "package-lock.json"
          }
        ]
      }
    },
    {
      "group": "",
      "name": "wrappy",
      "version": "1.0.2",
      "scope": "optional",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "b5243d8f3ec1aa35f1364605bc0d1036e30ab69f"
        }
      ],
      "purl": "pkg:npm/wrappy@1.0.2",
      "externalReferences": [
        {
          "type": "distribution",
          "url": "https://registry.npmjs.org/wrappy/-/wrappy-1.0.2.tgz"
        }
      ],
      "type": "library",
      "bom-ref": "pkg:npm/wrappy@1.0.2",
      "properties": [
        {
          "name": "SrcFile",
          "value": "package-lock.json"
        },
        {
          "name": "ResolvedUrl",
          "value": "https://registry.npmjs.org/wrappy/-/wrappy-1.0.2.tgz"
        }
      ],
      "evidence": {
        "identity": [
          {
            "field": "purl",
            "confidence": 1,
            "methods": [
              {
                "technique": "manifest-analysis",
                "confidence": 1,
                "value": "package-lock.json"
              }
            ],
            "concludedValue": "package-lock.json"
          }
        ]
      }
    },
    {
      "group": "",
      "name": "node-fetch",
      "version": "2.6.7",
      "scope": "optional",
      "hashes": [
        {
          "alg": "SHA-512",
          "content": "66330f1447d5c798fecb6c85df92b3c79b05ee40f3c6e0e3eb3887e0515b3a9f3bcca0d9371f321312486f4e4e185e0d96df481c520c064465e3555dbdc35d6d"
        }
      ],
      "purl": "pkg:npm/node-fetch@2.6.7",
      "externalReferences": [
        {
          "type": "distribution",
          "url": "https://registry.npmjs.org/node-fetch/-/node-fetch-2.6.7.tgz"
        }
      ],
      "type": "library",
      "bom-ref": "pkg:npm/node-fetch@2.6.7",
      "properties": [
        {
          "name": "SrcFile",
          "value": "package-lock.json"
        },
        {
          "name": "ResolvedUrl",
          "value": "https://registry.npmjs.org/node-fetch/-/node-fetch-2.6.7.tgz"
        }
      ],
      "evidence": {
        "identity": [
          {
            "field": "purl",
            "confidence": 1,
            "methods": [
              {
                "technique": "manifest-analysis",
                "confidence": 1,
                "value": "package-lock.json"
              }
            ],
            "concludedValue": "package-lock.json"
          }
        ]
      }
    },
    {
      "group": "",
      "name": "whatwg-url",
      "version": "5.0.0",
      "scope": "optional",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "966454e8765462e37644d3626f6742ce8b70965d"
        }
      ],
      "purl": "pkg:npm/whatwg-url@5.0.0",
      "externalReferences": [
        {
          "type": "distribution",
          "url": "https://registry.npmjs.org/whatwg-url/-/whatwg-url-5.0.0.tgz"
        }
      ],
      "type": "library",
      "bom-ref": "pkg:npm/whatwg-url@5.0.0",
      "properties": [
        {
          "name": "SrcFile",
          "value": "package-lock.json"
        },
        {
          "name": "ResolvedUrl",
          "value": "https://registry.npmjs.org/whatwg-url/-/whatwg-url-5.0.0.tgz"
        }
      ],
      "evidence": {
        "identity": [
          {
            "field": "purl",
            "confidence": 1,
            "methods": [
              {
                "technique": "manifest-analysis",
                "confidence": 1,
                "value": "package-lock.json"
              }
            ],
            "concludedValue": "package-lock.json"
          }
        ]
      }
    },
    {
      "group": "",
      "name": "tr46",
      "version": "0.0.3",
      "scope": "optional",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "8184fd347dac9cdc185992f3a6622e14b9d9ab6a"
        }
      ],
      "purl": "pkg:npm/tr46@0.0.3",
      "externalReferences": [
        {
          "type": "distribution",
          "url": "https://registry.npmjs.org/tr46/-/tr46-0.0.3.tgz"
        }
      ],
      "type": "library",
      "bom-ref": "pkg:npm/tr46@0.0.3",
      "properties": [
        {
          "name": "SrcFile",
          "value": "package-lock.json"
        },
        {
          "name": "ResolvedUrl",
          "value": "https://registry.npmjs.org/tr46/-/tr46-0.0.3.tgz"
        }
      ],
      "evidence": {
        "identity": [
          {
            "field": "purl",
            "confidence": 1,
            "methods": [
              {
                "technique": "manifest-analysis",
                "confidence": 1,
                "value": "package-lock.json"
              }
            ],
            "concludedValue": "package-lock.json"
          }
        ]
      }
    },
    {
      "group": "",
      "name": "webidl-conversions",
      "version": "3.0.1",
      "scope": "optional",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "24534275e2a7bc6be7bc86611cc16ae0a5654871"
        }
      ],
      "purl": "pkg:npm/webidl-conversions@3.0.1",
      "externalReferences": [
        {
          "type": "distribution",
          "url": "https://registry.npmjs.org/webidl-conversions/-/webidl-conversions-3.0.1.tgz"
        }
      ],
      "type": "library",
      "bom-ref": "pkg:npm/webidl-conversions@3.0.1",
      "properties": [
        {
          "name": "SrcFile",
          "value": "package-lock.json"
        },
        {
          "name": "ResolvedUrl",
          "value": "https://registry.npmjs.org/webidl-conversions/-/webidl-conversions-3.0.1.tgz"
        }
      ],
      "evidence": {
        "identity": [
          {
            "field": "purl",
            "confidence": 1,
            "methods": [
              {
                "technique": "manifest-analysis",
                "confidence": 1,
                "value": "package-lock.json"
              }
            ],
            "concludedValue": "package-lock.json"
          }
        ]
      }
    },
    {
      "group": "",
      "name": "before-after-hook",
      "version": "2.2.1",
      "scope": "optional",
      "hashes": [
        {
          "alg": "SHA-512",
          "content": "ffa14ac524d6a0975bb0b0c5f2d7488da462157884e941ec10713738f23f7303d4442562d6e90fd2098b9fb5d6122164e537304238d8e4f5ac53e8feb605e09b"
        }
      ],
      "purl": "pkg:npm/before-after-hook@2.2.1",
      "externalReferences": [
        {
          "type": "distribution",
          "url": "https://registry.npmjs.org/before-after-hook/-/before-after-hook-2.2.1.tgz"
        }
      ],
      "type": "library",
      "bom-ref": "pkg:npm/before-after-hook@2.2.1",
      "properties": [
        {
          "name": "SrcFile",
          "value": "package-lock.json"
        },
        {
          "name": "ResolvedUrl",
          "value": "https://registry.npmjs.org/before-after-hook/-/before-after-hook-2.2.1.tgz"
        }
      ],
      "evidence": {
        "identity": [
          {
            "field": "purl",
            "confidence": 1,
            "methods": [
              {
                "technique": "manifest-analysis",
                "confidence": 1,
                "value": "package-lock.json"
              }
            ],
            "concludedValue": "package-lock.json"
          }
        ]
      }
    },
    {
      "group": "@octokit",
      "name": "plugin-paginate-rest",
      "version": "2.17.0",
      "scope": "required",
      "hashes": [
        {
          "alg": "SHA-512",
          "content": "b7331badb9da9b632de0086ec821efa51912d2867932fc307103d81ad32fe2d51ae649331b9f12541d1f72c2ee94e6507919ce81d9195a44548b2065874064cb"
        }
      ],
      "purl": "pkg:npm/%40octokit/plugin-paginate-rest@2.17.0",
      "externalReferences": [
        {
          "type": "distribution",
          "url": "https://registry.npmjs.org/@octokit/plugin-paginate-rest/-/plugin-paginate-rest-2.17.0.tgz"
        }
      ],
      "type": "library",
      "bom-ref": "pkg:npm/@octokit/plugin-paginate-rest@2.17.0",
      "properties": [
        {
          "name": "SrcFile",
          "value": "package-lock.json"
        },
        {
          "name": "ResolvedUrl",
          "value": "https://registry.npmjs.org/@octokit/plugin-paginate-rest/-/plugin-paginate-rest-2.17.0.tgz"
        },
        {
          "name": "ImportedModules",
          "value": "@octokit/plugin-paginate-rest,paginateRest,@octokit/plugin-paginate-rest/paginateRest"
        }
      ],
      "evidence": {
        "identity": [
          {
            "field": "purl",
            "confidence": 1,
            "methods": [
              {
                "technique": "manifest-analysis",
                "confidence": 1,
                "value": "package-lock.json"
              }
            ],
            "concludedValue": "package-lock.json"
          }
        ],
        "occurrences": [
          {
            "location": "lib/utils.js",
            "line": 28
          },
          {
            "location": "src/utils.ts",
            "line": 8
          }
        ]
      }
    },
    {
      "group": "@octokit",
      "name": "plugin-rest-endpoint-methods",
      "version": "5.13.0",
      "scope": "required",
      "hashes": [
        {
          "alg": "SHA-512",
          "content": "b898cc4e437529a38880db543ccb485c33a3c7a746632b1d205860039db1e3149a7500b3ddbff325ec6f2130d5a403677ca3d6ffe134c643af2e7b6a318a6f88"
        }
      ],
      "purl": "pkg:npm/%40octokit/plugin-rest-endpoint-methods@5.13.0",
      "externalReferences": [
        {
          "type": "distribution",
          "url": "https://registry.npmjs.org/@octokit/plugin-rest-endpoint-methods/-/plugin-rest-endpoint-methods-5.13.0.tgz"
        }
      ],
      "type": "library",
      "bom-ref": "pkg:npm/@octokit/plugin-rest-endpoint-methods@5.13.0",
      "properties": [
        {
          "name": "SrcFile",
          "value": "package-lock.json"
        },
        {
          "name": "ResolvedUrl",
          "value": "https://registry.npmjs.org/@octokit/plugin-rest-endpoint-methods/-/plugin-rest-endpoint-methods-5.13.0.tgz"
        },
        {
          "name": "ImportedModules",
          "value": "@octokit/plugin-rest-endpoint-methods,restEndpointMethods,@octokit/plugin-rest-endpoint-methods/restEndpointMethods"
        }
      ],
      "evidence": {
        "identity": [
          {
            "field": "purl",
            "confidence": 1,
            "methods": [
              {
                "technique": "manifest-analysis",
                "confidence": 1,
                "value": "package-lock.json"
              }
            ],
            "concludedValue": "package-lock.json"
          }
        ],
        "occurrences": [
          {
            "location": "lib/utils.js",
            "line": 27
          },
          {
            "location": "src/utils.ts",
            "line": 7
          }
        ]
      }
    },
    {
      "group": "",
      "name": "proxy",
      "version": "1.0.2",
      "scope": "optional",
      "hashes": [
        {
          "alg": "SHA-512",
          "content": "28d69cdae7964698db521efb38014f66e35d7c4a8dca79bd0c3e311d3d7809c706a56f30299c0490dd328e56fb5fd1bd67d179e4dd10fb5cfe59f80087061dcd"
        }
      ],
      "purl": "pkg:npm/proxy@1.0.2",
      "externalReferences": [
        {
          "type": "distribution",
          "url": "https://registry.npmjs.org/proxy/-/proxy-1.0.2.tgz"
        }
      ],
      "type": "library",
      "bom-ref": "pkg:npm/proxy@1.0.2",
      "properties": [
        {
          "name": "SrcFile",
          "value": "package-lock.json"
        },
        {
          "name": "cdx:npm:package:development",
          "value": "true"
        },
        {
          "name": "ResolvedUrl",
          "value": "https://registry.npmjs.org/proxy/-/proxy-1.0.2.tgz"
        },
        {
          "name": "cdx:npm:binPaths",
          "value": "/app/packages/github/node_modules/.bin/proxy"
        },
        {
          "name": "cdx:npm:bin",
          "value": "proxy"
        },
        {
          "name": "cdx:npm:has_binary",
          "value": "true"
        }
      ],
      "evidence": {
        "identity": [
          {
            "field": "purl",
            "confidence": 1,
            "methods": [
              {
                "technique": "manifest-analysis",
                "confidence": 1,
                "value": "package-lock.json"
              }
            ],
            "concludedValue": "package-lock.json"
          }
        ]
      }
    },
    {
      "group": "",
      "name": "args",
      "version": "5.0.1",
      "scope": "optional",
      "hashes": [
        {
          "alg": "SHA-512",
          "content": "d64aa614216c3df7dabd0146b7c3b125d21c113b62f7d93249150f3293a16868cbea64499fc1c55353b1298e5b32a7d9294c1341cd6666402398661a54e1c5b5"
        }
      ],
      "purl": "pkg:npm/args@5.0.1",
      "externalReferences": [
        {
          "type": "distribution",
          "url": "https://registry.npmjs.org/args/-/args-5.0.1.tgz"
        }
      ],
      "type": "library",
      "bom-ref": "pkg:npm/args@5.0.1",
      "properties": [
        {
          "name": "SrcFile",
          "value": "package-lock.json"
        },
        {
          "name": "cdx:npm:package:development",
          "value": "true"
        },
        {
          "name": "ResolvedUrl",
          "value": "https://registry.npmjs.org/args/-/args-5.0.1.tgz"
        }
      ],
      "evidence": {
        "identity": [
          {
            "field": "purl",
            "confidence": 1,
            "methods": [
              {
                "technique": "manifest-analysis",
                "confidence": 1,
                "value": "package-lock.json"
              }
            ],
            "concludedValue": "package-lock.json"
          }
        ]
      }
    },
    {
      "group": "",
      "name": "camelcase",
      "version": "5.0.0",
      "scope": "optional",
      "hashes": [
        {
          "alg": "SHA-512",
          "content": "7daab066a9d6c5bc67f85d5ddfdf7281e6a640dcb794fa7f1fd1faacdaea621e054950ad718fb772e6f533103ca3d983779e6633c02086ebbf92ec9803a553b0"
        }
      ],
      "purl": "pkg:npm/camelcase@5.0.0",
      "externalReferences": [
        {
          "type": "distribution",
          "url": "https://registry.npmjs.org/camelcase/-/camelcase-5.0.0.tgz"
        }
      ],
      "type": "library",
      "bom-ref": "pkg:npm/camelcase@5.0.0",
      "properties": [
        {
          "name": "SrcFile",
          "value": "package-lock.json"
        },
        {
          "name": "cdx:npm:package:development",
          "value": "true"
        },
        {
          "name": "ResolvedUrl",
          "value": "https://registry.npmjs.org/camelcase/-/camelcase-5.0.0.tgz"
        }
      ],
      "evidence": {
        "identity": [
          {
            "field": "purl",
            "confidence": 1,
            "methods": [
              {
                "technique": "manifest-analysis",
                "confidence": 1,
                "value": "package-lock.json"
              }
            ],
            "concludedValue": "package-lock.json"
          }
        ]
      }
    },
    {
      "group": "",
      "name": "chalk",
      "version": "2.4.2",
      "scope": "optional",
      "hashes": [
        {
          "alg": "SHA-512",
          "content": "32d8be7fd96924d730178b5657cfcead34ed1758198be7fc16a97201da2eada95c156150585dbe3600874a18e409bf881412eaf5bb99c04d71724414e29792b9"
        }
      ],
      "purl": "pkg:npm/chalk@2.4.2",
      "externalReferences": [
        {
          "type": "distribution",
          "url": "https://registry.npmjs.org/chalk/-/chalk-2.4.2.tgz"
        }
      ],
      "type": "library",
      "bom-ref": "pkg:npm/chalk@2.4.2",
      "properties": [
        {
          "name": "SrcFile",
          "value": "package-lock.json"
        },
        {
          "name": "cdx:npm:package:development",
          "value": "true"
        },
        {
          "name": "ResolvedUrl",
          "value": "https://registry.npmjs.org/chalk/-/chalk-2.4.2.tgz"
        }
      ],
      "evidence": {
        "identity": [
          {
            "field": "purl",
            "confidence": 1,
            "methods": [
              {
                "technique": "manifest-analysis",
                "confidence": 1,
                "value": "package-lock.json"
              }
            ],
            "concludedValue": "package-lock.json"
          }
        ]
      }
    },
    {
      "group": "",
      "name": "ansi-styles",
      "version": "3.2.1",
      "scope": "optional",
      "hashes": [
        {
          "alg": "SHA-512",
          "content": "553d1923a91945d4e1f18c89c3748c6d89bfbbe36a7ec03112958ed0f7fdb2af3f7bde16c713a93cac7d151d459720ad3950cd390fbc9ed96a17189173eaf9a8"
        }
      ],
      "purl": "pkg:npm/ansi-styles@3.2.1",
      "externalReferences": [
        {
          "type": "distribution",
          "url": "https://registry.npmjs.org/ansi-styles/-/ansi-styles-3.2.1.tgz"
        }
      ],
      "type": "library",
      "bom-ref": "pkg:npm/ansi-styles@3.2.1",
      "properties": [
        {
          "name": "SrcFile",
          "value": "package-lock.json"
        },
        {
          "name": "cdx:npm:package:development",
          "value": "true"
        },
        {
          "name": "ResolvedUrl",
          "value": "https://registry.npmjs.org/ansi-styles/-/ansi-styles-3.2.1.tgz"
        }
      ],
      "evidence": {
        "identity": [
          {
            "field": "purl",
            "confidence": 1,
            "methods": [
              {
                "technique": "manifest-analysis",
                "confidence": 1,
                "value": "package-lock.json"
              }
            ],
            "concludedValue": "package-lock.json"
          }
        ]
      }
    },
    {
      "group": "",
      "name": "color-convert",
      "version": "1.9.3",
      "scope": "optional",
      "hashes": [
        {
          "alg": "SHA-512",
          "content": "41f014b5dfaf15d02d150702f020b262dd5f616c52a8088ad9c483eb30c1f0dddca6c10102f471a7dcce1a0e86fd21c7258013f3cfdacff22e0c600bb0d55b1a"
        }
      ],
      "purl": "pkg:npm/color-convert@1.9.3",
      "externalReferences": [
        {
          "type": "distribution",
          "url": "https://registry.npmjs.org/color-convert/-/color-convert-1.9.3.tgz"
        }
      ],
      "type": "library",
      "bom-ref": "pkg:npm/color-convert@1.9.3",
      "properties": [
        {
          "name": "SrcFile",
          "value": "package-lock.json"
        },
        {
          "name": "cdx:npm:package:development",
          "value": "true"
        },
        {
          "name": "ResolvedUrl",
          "value": "https://registry.npmjs.org/color-convert/-/color-convert-1.9.3.tgz"
        }
      ],
      "evidence": {
        "identity": [
          {
            "field": "purl",
            "confidence": 1,
            "methods": [
              {
                "technique": "manifest-analysis",
                "confidence": 1,
                "value": "package-lock.json"
              }
            ],
            "concludedValue": "package-lock.json"
          }
        ]
      }
    },
    {
      "group": "",
      "name": "color-name",
      "version": "1.1.3",
      "scope": "optional",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "a7d0558bd89c42f795dd42328f740831ca53bc25"
        }
      ],
      "purl": "pkg:npm/color-name@1.1.3",
      "externalReferences": [
        {
          "type": "distribution",
          "url": "https://registry.npmjs.org/color-name/-/color-name-1.1.3.tgz"
        }
      ],
      "type": "library",
      "bom-ref": "pkg:npm/color-name@1.1.3",
      "properties": [
        {
          "name": "SrcFile",
          "value": "package-lock.json"
        },
        {
          "name": "cdx:npm:package:development",
          "value": "true"
        },
        {
          "name": "ResolvedUrl",
          "value": "https://registry.npmjs.org/color-name/-/color-name-1.1.3.tgz"
        }
      ],
      "evidence": {
        "identity": [
          {
            "field": "purl",
            "confidence": 1,
            "methods": [
              {
                "technique": "manifest-analysis",
                "confidence": 1,
                "value": "package-lock.json"
              }
            ],
            "concludedValue": "package-lock.json"
          }
        ]
      }
    },
    {
      "group": "",
      "name": "escape-string-regexp",
      "version": "1.0.5",
      "scope": "optional",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "1b61c0562190a8dff6ae3bb2cf0200ca130b86d4"
        }
      ],
      "purl": "pkg:npm/escape-string-regexp@1.0.5",
      "externalReferences": [
        {
          "type": "distribution",
          "url": "https://registry.npmjs.org/escape-string-regexp/-/escape-string-regexp-1.0.5.tgz"
        }
      ],
      "type": "library",
      "bom-ref": "pkg:npm/escape-string-regexp@1.0.5",
      "properties": [
        {
          "name": "SrcFile",
          "value": "package-lock.json"
        },
        {
          "name": "cdx:npm:package:development",
          "value": "true"
        },
        {
          "name": "ResolvedUrl",
          "value": "https://registry.npmjs.org/escape-string-regexp/-/escape-string-regexp-1.0.5.tgz"
        }
      ],
      "evidence": {
        "identity": [
          {
            "field": "purl",
            "confidence": 1,
            "methods": [
              {
                "technique": "manifest-analysis",
                "confidence": 1,
                "value": "package-lock.json"
              }
            ],
            "concludedValue": "package-lock.json"
          }
        ]
      }
    },
    {
      "group": "",
      "name": "supports-color",
      "version": "5.5.0",
      "scope": "optional",
      "hashes": [
        {
          "alg": "SHA-512",
          "content": "423563c1d5c8b78d3c308880a825f8a142ac814d84a801b3b363e9926e1a4186e39be644584716e127c5353af8b8c35999ad1ecb87f99602eb901d1a5f440ca3"
        }
      ],
      "purl": "pkg:npm/supports-color@5.5.0",
      "externalReferences": [
        {
          "type": "distribution",
          "url": "https://registry.npmjs.org/supports-color/-/supports-color-5.5.0.tgz"
        }
      ],
      "type": "library",
      "bom-ref": "pkg:npm/supports-color@5.5.0",
      "properties": [
        {
          "name": "SrcFile",
          "value": "package-lock.json"
        },
        {
          "name": "cdx:npm:package:development",
          "value": "true"
        },
        {
          "name": "ResolvedUrl",
          "value": "https://registry.npmjs.org/supports-color/-/supports-color-5.5.0.tgz"
        }
      ],
      "evidence": {
        "identity": [
          {
            "field": "purl",
            "confidence": 1,
            "methods": [
              {
                "technique": "manifest-analysis",
                "confidence": 1,
                "value": "package-lock.json"
              }
            ],
            "concludedValue": "package-lock.json"
          }
        ]
      }
    },
    {
      "group": "",
      "name": "has-flag",
      "version": "3.0.0",
      "scope": "optional",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "b5d454dc2199ae225699f3467e5a07f3b955bafd"
        }
      ],
      "purl": "pkg:npm/has-flag@3.0.0",
      "externalReferences": [
        {
          "type": "distribution",
          "url": "https://registry.npmjs.org/has-flag/-/has-flag-3.0.0.tgz"
        }
      ],
      "type": "library",
      "bom-ref": "pkg:npm/has-flag@3.0.0",
      "properties": [
        {
          "name": "SrcFile",
          "value": "package-lock.json"
        },
        {
          "name": "cdx:npm:package:development",
          "value": "true"
        },
        {
          "name": "ResolvedUrl",
          "value": "https://registry.npmjs.org/has-flag/-/has-flag-3.0.0.tgz"
        }
      ],
      "evidence": {
        "identity": [
          {
            "field": "purl",
            "confidence": 1,
            "methods": [
              {
                "technique": "manifest-analysis",
                "confidence": 1,
                "value": "package-lock.json"
              }
            ],
            "concludedValue": "package-lock.json"
          }
        ]
      }
    },
    {
      "group": "",
      "name": "leven",
      "version": "2.1.0",
      "scope": "optional",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "c2e7a9f772094dee9d34202ae8acce4687875580"
        }
      ],
      "purl": "pkg:npm/leven@2.1.0",
      "externalReferences": [
        {
          "type": "distribution",
          "url": "https://registry.npmjs.org/leven/-/leven-2.1.0.tgz"
        }
      ],
      "type": "library",
      "bom-ref": "pkg:npm/leven@2.1.0",
      "properties": [
        {
          "name": "SrcFile",
          "value": "package-lock.json"
        },
        {
          "name": "cdx:npm:package:development",
          "value": "true"
        },
        {
          "name": "ResolvedUrl",
          "value": "https://registry.npmjs.org/leven/-/leven-2.1.0.tgz"
        }
      ],
      "evidence": {
        "identity": [
          {
            "field": "purl",
            "confidence": 1,
            "methods": [
              {
                "technique": "manifest-analysis",
                "confidence": 1,
                "value": "package-lock.json"
              }
            ],
            "concludedValue": "package-lock.json"
          }
        ]
      }
    },
    {
      "group": "",
      "name": "mri",
      "version": "1.1.4",
      "scope": "optional",
      "hashes": [
        {
          "alg": "SHA-512",
          "content": "eb2ec88c63e6f00ce5be852bc006b0d6d2e7501b9d692dfbe76bdc77c26dae9186427fab5c87badcb1551e6fd8330b6a02e87e2c93c215d94b60f58cd67627eb"
        }
      ],
      "purl": "pkg:npm/mri@1.1.4",
      "externalReferences": [
        {
          "type": "distribution",
          "url": "https://registry.npmjs.org/mri/-/mri-1.1.4.tgz"
        }
      ],
      "type": "library",
      "bom-ref": "pkg:npm/mri@1.1.4",
      "properties": [
        {
          "name": "SrcFile",
          "value": "package-lock.json"
        },
        {
          "name": "cdx:npm:package:development",
          "value": "true"
        },
        {
          "name": "ResolvedUrl",
          "value": "https://registry.npmjs.org/mri/-/mri-1.1.4.tgz"
        }
      ],
      "evidence": {
        "identity": [
          {
            "field": "purl",
            "confidence": 1,
            "methods": [
              {
                "technique": "manifest-analysis",
                "confidence": 1,
                "value": "package-lock.json"
              }
            ],
            "concludedValue": "package-lock.json"
          }
        ]
      }
    },
    {
      "group": "",
      "name": "basic-auth-parser",
      "version": "0.0.2",
      "scope": "optional",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "ce9e71a77f23c1279eecd2659b2a46244c156e41"
        }
      ],
      "purl": "pkg:npm/basic-auth-parser@0.0.2",
      "externalReferences": [
        {
          "type": "distribution",
          "url": "https://registry.npmjs.org/basic-auth-parser/-/basic-auth-parser-0.0.2.tgz"
        }
      ],
      "type": "library",
      "bom-ref": "pkg:npm/basic-auth-parser@0.0.2",
      "properties": [
        {
          "name": "SrcFile",
          "value": "package-lock.json"
        },
        {
          "name": "cdx:npm:package:development",
          "value": "true"
        },
        {
          "name": "ResolvedUrl",
          "value": "https://registry.npmjs.org/basic-auth-parser/-/basic-auth-parser-0.0.2.tgz"
        }
      ],
      "evidence": {
        "identity": [
          {
            "field": "purl",
            "confidence": 1,
            "methods": [
              {
                "technique": "manifest-analysis",
                "confidence": 1,
                "value": "package-lock.json"
              }
            ],
            "concludedValue": "package-lock.json"
          }
        ]
      },
      "tags": [
        "parse"
      ]
    },
    {
      "group": "",
      "name": "debug",
      "version": "4.1.1",
      "scope": "optional",
      "hashes": [
        {
          "alg": "SHA-512",
          "content": "a58008cde468f09e8a3c4689d1558e8793f391bc3f45eb6ecde84633b411457e617b87cf1f1dab74a301db9e9e8490a45fe5d1426d7a7992ea2cd4bc45265767"
        }
      ],
      "purl": "pkg:npm/debug@4.1.1",
      "externalReferences": [
        {
          "type": "distribution",
          "url": "https://registry.npmjs.org/debug/-/debug-4.1.1.tgz"
        }
      ],
      "type": "library",
      "bom-ref": "pkg:npm/debug@4.1.1",
      "properties": [
        {
          "name": "SrcFile",
          "value": "package-lock.json"
        },
        {
          "name": "cdx:npm:package:development",
          "value": "true"
        },
        {
          "name": "ResolvedUrl",
          "value": "https://registry.npmjs.org/debug/-/debug-4.1.1.tgz"
        },
        {
          "name": "cdx:npm:deprecated",
          "value": "Debug versions >=3.2.0 <3.2.7 || >=4 <4.3.1 have a low-severity ReDos regression when used in a Node.js environment. It is recommended you upgrade to 3.2.7 or 4.3.1. (https://github.com/visionmedia/debug/issues/797)"
        }
      ],
      "evidence": {
        "identity": [
          {
            "field": "purl",
            "confidence": 1,
            "methods": [
              {
                "technique": "manifest-analysis",
                "confidence": 1,
                "value": "package-lock.json"
              }
            ],
            "concludedValue": "package-lock.json"
          }
        ]
      }
    },
    {
      "group": "",
      "name": "ms",
      "version": "2.1.2",
      "scope": "optional",
      "hashes": [
        {
          "alg": "SHA-512",
          "content": "b0690fc7e56332d980e8c5f6ee80381411442c50996784b85ea7863970afebcb53fa36f7be4fd1c9a2963f43d32b25ad98b48cd1bf9a7544c4bdbb353c4687db"
        }
      ],
      "purl": "pkg:npm/ms@2.1.2",
      "externalReferences": [
        {
          "type": "distribution",
          "url": "https://registry.npmjs.org/ms/-/ms-2.1.2.tgz"
        }
      ],
      "type": "library",
      "bom-ref": "pkg:npm/ms@2.1.2",
      "properties": [
        {
          "name": "SrcFile",
          "value": "package-lock.json"
        },
        {
          "name": "cdx:npm:package:development",
          "value": "true"
        },
        {
          "name": "ResolvedUrl",
          "value": "https://registry.npmjs.org/ms/-/ms-2.1.2.tgz"
        }
      ],
      "evidence": {
        "identity": [
          {
            "field": "purl",
            "confidence": 1,
            "methods": [
              {
                "technique": "manifest-analysis",
                "confidence": 1,
                "value": "package-lock.json"
              }
            ],
            "concludedValue": "package-lock.json"
          }
        ]
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:npm/@octokit/openapi-types@11.2.0",
      "dependsOn": []
    },
    {
      "ref": "pkg:npm/@octokit/types@6.34.0",
      "dependsOn": [
        "pkg:npm/@octokit/openapi-types@11.2.0"
      ]
    },
    {
      "ref": "pkg:npm/@octokit/auth-token@2.4.5",
      "dependsOn": [
        "pkg:npm/@octokit/types@6.34.0"
      ]
    },
    {
      "ref": "pkg:npm/is-plain-object@5.0.0",
      "dependsOn": []
    },
    {
      "ref": "pkg:npm/universal-user-agent@6.0.0",
      "dependsOn": []
    },
    {
      "ref": "pkg:npm/@octokit/endpoint@6.0.11",
      "dependsOn": [
        "pkg:npm/@octokit/types@6.34.0",
        "pkg:npm/is-plain-object@5.0.0",
        "pkg:npm/universal-user-agent@6.0.0"
      ]
    },
    {
      "ref": "pkg:npm/deprecation@2.3.1",
      "dependsOn": []
    },
    {
      "ref": "pkg:npm/wrappy@1.0.2",
      "dependsOn": []
    },
    {
      "ref": "pkg:npm/once@1.4.0",
      "dependsOn": [
        "pkg:npm/wrappy@1.0.2"
      ]
    },
    {
      "ref": "pkg:npm/@octokit/request-error@2.1.0",
      "dependsOn": [
        "pkg:npm/@octokit/types@6.34.0",
        "pkg:npm/deprecation@2.3.1",
        "pkg:npm/once@1.4.0"
      ]
    },
    {
      "ref": "pkg:npm/tr46@0.0.3",
      "dependsOn": []
    },
    {
      "ref": "pkg:npm/webidl-conversions@3.0.1",
      "dependsOn": []
    },
    {
      "ref": "pkg:npm/whatwg-url@5.0.0",
      "dependsOn": [
        "pkg:npm/tr46@0.0.3",
        "pkg:npm/webidl-conversions@3.0.1"
      ]
    },
    {
      "ref": "pkg:npm/node-fetch@2.6.7",
      "dependsOn": [
        "pkg:npm/whatwg-url@5.0.0"
      ]
    },
    {
      "ref": "pkg:npm/@octokit/request@5.6.3",
      "dependsOn": [
        "pkg:npm/@octokit/endpoint@6.0.11",
        "pkg:npm/@octokit/request-error@2.1.0",
        "pkg:npm/@octokit/types@6.34.0",
        "pkg:npm/is-plain-object@5.0.0",
        "pkg:npm/node-fetch@2.6.7",
        "pkg:npm/universal-user-agent@6.0.0"
      ]
    },
    {
      "ref": "pkg:npm/@octokit/graphql@4.6.1",
      "dependsOn": [
        "pkg:npm/@octokit/request@5.6.3",
        "pkg:npm/@octokit/types@6.34.0",
        "pkg:npm/universal-user-agent@6.0.0"
      ]
    },
    {
      "ref": "pkg:npm/before-after-hook@2.2.1",
      "dependsOn": []
    },
    {
      "ref": "pkg:npm/@octokit/core@3.6.0",
      "dependsOn": [
        "pkg:npm/@octokit/auth-token@2.4.5",
        "pkg:npm/@octokit/graphql@4.6.1",
        "pkg:npm/@octokit/request-error@2.1.0",
        "pkg:npm/@octokit/request@5.6.3",
        "pkg:npm/@octokit/types@6.34.0",
        "pkg:npm/before-after-hook@2.2.1",
        "pkg:npm/universal-user-agent@6.0.0"
      ]
    },
    {
      "ref": "pkg:npm/@octokit/plugin-paginate-rest@2.17.0",
      "dependsOn": [
        "pkg:npm/@octokit/core@3.6.0",
        "pkg:npm/@octokit/types@6.34.0"
      ]
    },
    {
      "ref": "pkg:npm/@octokit/plugin-rest-endpoint-methods@5.13.0",
      "dependsOn": [
        "pkg:npm/@octokit/core@3.6.0",
        "pkg:npm/@octokit/types@6.34.0",
        "pkg:npm/deprecation@2.3.1"
      ]
    },
    {
      "ref": "pkg:npm/camelcase@5.0.0",
      "dependsOn": []
    },
    {
      "ref": "pkg:npm/color-name@1.1.3",
      "dependsOn": []
    },
    {
      "ref": "pkg:npm/color-convert@1.9.3",
      "dependsOn": [
        "pkg:npm/color-name@1.1.3"
      ]
    },
    {
      "ref": "pkg:npm/ansi-styles@3.2.1",
      "dependsOn": [
        "pkg:npm/color-convert@1.9.3"
      ]
    },
    {
      "ref": "pkg:npm/escape-string-regexp@1.0.5",
      "dependsOn": []
    },
    {
      "ref": "pkg:npm/has-flag@3.0.0",
      "dependsOn": []
    },
    {
      "ref": "pkg:npm/supports-color@5.5.0",
      "dependsOn": [
        "pkg:npm/has-flag@3.0.0"
      ]
    },
    {
      "ref": "pkg:npm/chalk@2.4.2",
      "dependsOn": [
        "pkg:npm/ansi-styles@3.2.1",
        "pkg:npm/escape-string-regexp@1.0.5",
        "pkg:npm/supports-color@5.5.0"
      ]
    },
    {
      "ref": "pkg:npm/leven@2.1.0",
      "dependsOn": []
    },
    {
      "ref": "pkg:npm/mri@1.1.4",
      "dependsOn": []
    },
    {
      "ref": "pkg:npm/args@5.0.1",
      "dependsOn": [
        "pkg:npm/camelcase@5.0.0",
        "pkg:npm/chalk@2.4.2",
        "pkg:npm/leven@2.1.0",
        "pkg:npm/mri@1.1.4"
      ]
    },
    {
      "ref": "pkg:npm/basic-auth-parser@0.0.2",
      "dependsOn": []
    },
    {
      "ref": "pkg:npm/ms@2.1.2",
      "dependsOn": []
    },
    {
      "ref": "pkg:npm/debug@4.1.1",
      "dependsOn": [
        "pkg:npm/ms@2.1.2"
      ]
    },
    {
      "ref": "pkg:npm/proxy@1.0.2",
      "dependsOn": [
        "pkg:npm/args@5.0.1",
        "pkg:npm/basic-auth-parser@0.0.2",
        "pkg:npm/debug@4.1.1"
      ]
    },
    {
      "ref": "pkg:npm/@actions/github@5.1.1",
      "dependsOn": [
        "pkg:npm/@octokit/core@3.6.0",
        "pkg:npm/@octokit/plugin-paginate-rest@2.17.0",
        "pkg:npm/@octokit/plugin-rest-endpoint-methods@5.13.0",
        "pkg:npm/proxy@1.0.2"
      ]
    }
  ],
  "annotations": [
    {
      "bom-ref": "metadata-annotations",
      "subjects": [
        "pkg:npm/@actions/github@5.1.1"
      ],
      "annotator": {
        "component": {
          "group": "@cyclonedx",
          "name": "cdxgen",
          "version": "12.8.4",
          "purl": "pkg:npm/%40cyclonedx/cdxgen@12.8.4",
          "type": "application",
          "bom-ref": "pkg:npm/@cyclonedx/cdxgen@12.8.4",
          "publisher": "OWASP Foundation",
          "authors": [
            {
              "name": "OWASP Foundation"
            }
          ]
        }
      },
      "timestamp": "2026-09-21T18:30:35Z",
      "text": "This Software Bill-of-Materials (SBOM) document was created on Monday, September 21, 2026 with cdxgen. The data was captured during the pre-build lifecycle phase without building the application. The document describes an application named 'github' with version '5.1.1'. The package type in this SBOM is npm with a single purl namespace '@octokit' described under components. The components were identified from the source files: package-lock.json."
    }
  ]
}