{ "bomFormat": "CycloneDX", "specVersion": "1.7", "serialNumber": "urn:uuid:8aa9b47c-c460-4478-8956-db4aa5d8b0b3", "version": 1, "metadata": { "timestamp": "2026-10-08T07:21:07Z", "tools": { "components": [ { "group": "@cyclonedx", "name": "cdxgen", "version": "12.8.5", "purl": "pkg:npm/%40cyclonedx/cdxgen@12.8.5", "type": "application", "bom-ref": "pkg:npm/@cyclonedx/cdxgen@12.8.5", "publisher": "OWASP Foundation", "authors": [ { "name": "OWASP Foundation" } ] } ] }, "authors": [ { "name": "OWASP Foundation" } ], "lifecycles": [ { "phase": "pre-build" } ], "component": { "name": "core", "group": "@opentelemetry", "version": "1.17.0-tuxcare.1", "description": "OpenTelemetry Core provides constants and utilities shared by all OpenTelemetry SDK packages.", "purl": "pkg:npm/%40opentelemetry/core@1.17.0-tuxcare.1", "bom-ref": "pkg:npm/@opentelemetry/core@1.17.0-tuxcare.1", "author": "OpenTelemetry Authors", "properties": [ { "name": "cdx:npm:scripts", "value": "prepublishOnly, compile, clean, test, test:browser, tdd, tdd:node, tdd:browser, codecov, codecov:browser, lint, lint:fix, version, watch, precompile, prewatch, peer-api-check" }, { "name": "cdx:npm:buildScripts", "value": "compile, watch" }, { "name": "cdx:license:category", "value": "Permissive" } ], "type": "application", "licenses": [ { "license": { "id": "Apache-2.0", "url": "https://opensource.org/licenses/Apache-2.0", "properties": [ { "name": "cdx:license:category", "value": "Permissive" }, { "name": "cdx:license:foss", "value": "true" }, { "name": "cdx:license:osiApproved", "value": "true" }, { "name": "cdx:license:fsfLibre", "value": "true" }, { "name": "cdx:license:deprecated", "value": "false" } ] } } ], "externalReferences": [ { "type": "vcs", "url": "https://github.com/open-telemetry/opentelemetry-js/tree/main/packages/opentelemetry-core" } ] }, "properties": [ { "name": "cdx:bom:componentTypes", "value": "npm" }, { "name": "cdx:bom:componentNamespaces", "value": "@opentelemetry" }, { "name": "cdx:bom:componentSrcFiles", "value": "node_modules/@opentelemetry/api/package.json\\nnode_modules/@opentelemetry/semantic-conventions/package.json" } ] }, "components": [ { "authors": [ { "name": "OpenTelemetry Authors" } ], "group": "@opentelemetry", "name": "semantic-conventions", "version": "1.17.0", "description": "OpenTelemetry semantic conventions", "scope": "required", "licenses": [ { "license": { "id": "Apache-2.0", "url": "https://opensource.org/licenses/Apache-2.0", "properties": [ { "name": "cdx:license:category", "value": "Permissive" }, { "name": "cdx:license:foss", "value": "true" }, { "name": "cdx:license:osiApproved", "value": "true" }, { "name": "cdx:license:fsfLibre", "value": "true" }, { "name": "cdx:license:deprecated", "value": "false" } ] } } ], "purl": "pkg:npm/%40opentelemetry/semantic-conventions@1.17.0", "externalReferences": [ { "type": "vcs", "url": "https://github.com/open-telemetry/opentelemetry-js/tree/main/packages/opentelemetry-semantic-conventions" } ], "type": "library", "bom-ref": "pkg:npm/@opentelemetry/semantic-conventions@1.17.0", "properties": [ { "name": "SrcFile", "value": "node_modules/@opentelemetry/semantic-conventions/package.json" }, { "name": "ImportedModules", "value": "@opentelemetry/semantic-conventions,TelemetrySdkLanguageValues,@opentelemetry/semantic-conventions/TelemetrySdkLanguageValues,SemanticResourceAttributes,@opentelemetry/semantic-conventions/SemanticResourceAttributes" }, { "name": "cdx:license:category", "value": "Permissive" } ], "evidence": { "identity": [ { "field": "purl", "confidence": 0.7, "methods": [ { "technique": "manifest-analysis", "confidence": 0.7, "value": "node_modules/@opentelemetry/semantic-conventions/package.json" } ], "concludedValue": "node_modules/@opentelemetry/semantic-conventions/package.json" } ], "occurrences": [ { "location": "build/esm/platform/browser/sdk-info.js", "line": 18 }, { "location": "build/esm/platform/node/sdk-info.js", "line": 18 }, { "location": "build/esnext/platform/browser/sdk-info.js", "line": 17 }, { "location": "build/esnext/platform/node/sdk-info.js", "line": 17 }, { "location": "build/src/platform/browser/sdk-info.js", "line": 20 }, { "location": "build/src/platform/node/sdk-info.js", "line": 20 }, { "location": "src/platform/browser/sdk-info.ts", "line": 21 }, { "location": "src/platform/node/sdk-info.ts", "line": 21 } ] } }, { "authors": [ { "name": "OpenTelemetry Authors" } ], "group": "@opentelemetry", "name": "api", "version": "1.6.0", "description": "Public API for OpenTelemetry", "scope": "required", "licenses": [ { "license": { "id": "Apache-2.0", "url": "https://opensource.org/licenses/Apache-2.0", "properties": [ { "name": "cdx:license:category", "value": "Permissive" }, { "name": "cdx:license:foss", "value": "true" }, { "name": "cdx:license:osiApproved", "value": "true" }, { "name": "cdx:license:fsfLibre", "value": "true" }, { "name": "cdx:license:deprecated", "value": "false" } ] } } ], "purl": "pkg:npm/%40opentelemetry/api@1.6.0", "externalReferences": [ { "type": "vcs", "url": "https://github.com/open-telemetry/opentelemetry-js/tree/main/api" } ], "type": "library", "bom-ref": "pkg:npm/@opentelemetry/api@1.6.0", "properties": [ { "name": "SrcFile", "value": "node_modules/@opentelemetry/api/package.json" }, { "name": "ImportedModules", "value": "@opentelemetry/api,propagation,@opentelemetry/api/propagation,baggageEntryMetadataFromString,@opentelemetry/api/baggageEntryMetadataFromString,diag,@opentelemetry/api/diag,context,@opentelemetry/api/context,isSpanContextValid,@opentelemetry/api/isSpanContextValid,trace,@opentelemetry/api/trace,TraceFlags,@opentelemetry/api/TraceFlags,createContextKey,@opentelemetry/api/createContextKey,SamplingDecision,@opentelemetry/api/SamplingDecision,isValidTraceId,@opentelemetry/api/isValidTraceId,DiagLogLevel,@opentelemetry/api/DiagLogLevel,BaggageEntry,@opentelemetry/api/BaggageEntry,Context,@opentelemetry/api/Context,TextMapGetter,@opentelemetry/api/TextMapGetter,TextMapPropagator,@opentelemetry/api/TextMapPropagator,TextMapSetter,@opentelemetry/api/TextMapSetter,Baggage,@opentelemetry/api/Baggage,BaggageEntryMetadata,@opentelemetry/api/BaggageEntryMetadata,SpanAttributeValue,@opentelemetry/api/SpanAttributeValue,SpanAttributes,@opentelemetry/api/SpanAttributes,Exception,@opentelemetry/api/Exception,SpanContext,@opentelemetry/api/SpanContext,Span,@opentelemetry/api/Span,Sampler,@opentelemetry/api/Sampler,SamplingResult,@opentelemetry/api/SamplingResult,Link,@opentelemetry/api/Link,SpanKind,@opentelemetry/api/SpanKind" }, { "name": "cdx:license:category", "value": "Permissive" } ], "evidence": { "identity": [ { "field": "purl", "confidence": 0.7, "methods": [ { "technique": "manifest-analysis", "confidence": 0.7, "value": "node_modules/@opentelemetry/api/package.json" } ], "concludedValue": "node_modules/@opentelemetry/api/package.json" } ], "occurrences": [ { "location": "build/esm/baggage/propagation/W3CBaggagePropagator.js", "line": 32 }, { "location": "build/esm/baggage/propagation/W3CBaggagePropagator.js", "line": 46 }, { "location": "build/esm/baggage/propagation/W3CBaggagePropagator.js", "line": 79 }, { "location": "build/esm/baggage/utils.js", "line": 32 }, { "location": "build/esm/baggage/utils.js", "line": 66 }, { "location": "build/esm/common/attributes.js", "line": 43 }, { "location": "build/esm/common/attributes.js", "line": 54 }, { "location": "build/esm/common/attributes.js", "line": 58 }, { "location": "build/esm/common/logging-error-handler.js", "line": 16 }, { "location": "build/esm/common/logging-error-handler.js", "line": 23 }, { "location": "build/esm/internal/exporter.js", "line": 16 }, { "location": "build/esm/internal/exporter.js", "line": 25 }, { "location": "build/esm/propagation/composite.js", "line": 27 }, { "location": "build/esm/propagation/composite.js", "line": 62 }, { "location": "build/esm/propagation/composite.js", "line": 89 }, { "location": "build/esm/trace/W3CTraceContextPropagator.js", "line": 16 }, { "location": "build/esm/trace/W3CTraceContextPropagator.js", "line": 62 }, { "location": "build/esm/trace/W3CTraceContextPropagator.js", "line": 65 }, { "location": "build/esm/trace/W3CTraceContextPropagator.js", "line": 95 }, { "location": "build/esm/trace/rpc-metadata.js", "line": 16 }, { "location": "build/esm/trace/rpc-metadata.js", "line": 17 }, { "location": "build/esm/trace/sampler/AlwaysOffSampler.js", "line": 16 }, { "location": "build/esm/trace/sampler/AlwaysOnSampler.js", "line": 16 }, { "location": "build/esm/trace/sampler/ParentBasedSampler.js", "line": 16 }, { "location": "build/esm/trace/sampler/ParentBasedSampler.js", "line": 43 }, { "location": "build/esm/trace/sampler/ParentBasedSampler.js", "line": 44 }, { "location": "build/esm/trace/sampler/TraceIdRatioBasedSampler.js", "line": 16 }, { "location": "build/esm/trace/sampler/TraceIdRatioBasedSampler.js", "line": 30 }, { "location": "build/esm/trace/suppress-tracing.js", "line": 16 }, { "location": "build/esm/trace/suppress-tracing.js", "line": 17 }, { "location": "build/esm/utils/environment.js", "line": 16 }, { "location": "build/esnext/baggage/propagation/W3CBaggagePropagator.js", "line": 16 }, { "location": "build/esnext/baggage/propagation/W3CBaggagePropagator.js", "line": 28 }, { "location": "build/esnext/baggage/propagation/W3CBaggagePropagator.js", "line": 60 }, { "location": "build/esnext/baggage/utils.js", "line": 16 }, { "location": "build/esnext/baggage/utils.js", "line": 49 }, { "location": "build/esnext/common/attributes.js", "line": 16 }, { "location": "build/esnext/common/attributes.js", "line": 24 }, { "location": "build/esnext/common/attributes.js", "line": 28 }, { "location": "build/esnext/common/logging-error-handler.js", "line": 16 }, { "location": "build/esnext/common/logging-error-handler.js", "line": 23 }, { "location": "build/esnext/internal/exporter.js", "line": 16 }, { "location": "build/esnext/internal/exporter.js", "line": 25 }, { "location": "build/esnext/propagation/composite.js", "line": 16 }, { "location": "build/esnext/propagation/composite.js", "line": 47 }, { "location": "build/esnext/propagation/composite.js", "line": 66 }, { "location": "build/esnext/trace/W3CTraceContextPropagator.js", "line": 16 }, { "location": "build/esnext/trace/W3CTraceContextPropagator.js", "line": 60 }, { "location": "build/esnext/trace/W3CTraceContextPropagator.js", "line": 63 }, { "location": "build/esnext/trace/W3CTraceContextPropagator.js", "line": 93 }, { "location": "build/esnext/trace/rpc-metadata.js", "line": 16 }, { "location": "build/esnext/trace/rpc-metadata.js", "line": 17 }, { "location": "build/esnext/trace/sampler/AlwaysOffSampler.js", "line": 16 }, { "location": "build/esnext/trace/sampler/AlwaysOnSampler.js", "line": 16 }, { "location": "build/esnext/trace/sampler/ParentBasedSampler.js", "line": 16 }, { "location": "build/esnext/trace/sampler/ParentBasedSampler.js", "line": 43 }, { "location": "build/esnext/trace/sampler/ParentBasedSampler.js", "line": 44 }, { "location": "build/esnext/trace/sampler/TraceIdRatioBasedSampler.js", "line": 16 }, { "location": "build/esnext/trace/sampler/TraceIdRatioBasedSampler.js", "line": 29 }, { "location": "build/esnext/trace/suppress-tracing.js", "line": 16 }, { "location": "build/esnext/trace/suppress-tracing.js", "line": 17 }, { "location": "build/esnext/utils/environment.js", "line": 16 }, { "location": "build/src/baggage/propagation/W3CBaggagePropagator.js", "line": 19 }, { "location": "build/src/baggage/utils.js", "line": 19 }, { "location": "build/src/common/attributes.js", "line": 19 }, { "location": "build/src/common/logging-error-handler.js", "line": 19 }, { "location": "build/src/internal/exporter.js", "line": 19 }, { "location": "build/src/propagation/composite.js", "line": 19 }, { "location": "build/src/trace/W3CTraceContextPropagator.js", "line": 19 }, { "location": "build/src/trace/rpc-metadata.js", "line": 19 }, { "location": "build/src/trace/sampler/AlwaysOffSampler.js", "line": 19 }, { "location": "build/src/trace/sampler/AlwaysOnSampler.js", "line": 19 }, { "location": "build/src/trace/sampler/ParentBasedSampler.js", "line": 19 }, { "location": "build/src/trace/sampler/TraceIdRatioBasedSampler.js", "line": 19 }, { "location": "build/src/trace/suppress-tracing.js", "line": 19 }, { "location": "build/src/utils/environment.js", "line": 19 }, { "location": "src/baggage/propagation/W3CBaggagePropagator.ts", "line": 24 }, { "location": "src/baggage/propagation/W3CBaggagePropagator.ts", "line": 46 }, { "location": "src/baggage/propagation/W3CBaggagePropagator.ts", "line": 91 }, { "location": "src/baggage/utils.ts", "line": 21 }, { "location": "src/baggage/utils.ts", "line": 77 }, { "location": "src/common/attributes.ts", "line": 17 }, { "location": "src/common/attributes.ts", "line": 28 }, { "location": "src/common/attributes.ts", "line": 32 }, { "location": "src/common/global-error-handler.ts", "line": 17 }, { "location": "src/common/logging-error-handler.ts", "line": 17 }, { "location": "src/common/logging-error-handler.ts", "line": 26 }, { "location": "src/common/time.ts", "line": 17 }, { "location": "src/common/types.ts", "line": 17 }, { "location": "src/internal/exporter.ts", "line": 17 }, { "location": "src/internal/exporter.ts", "line": 35 }, { "location": "src/propagation/composite.ts", "line": 23 }, { "location": "src/propagation/composite.ts", "line": 72 }, { "location": "src/propagation/composite.ts", "line": 93 }, { "location": "src/trace/TraceState.ts", "line": 17 }, { "location": "src/trace/W3CTraceContextPropagator.ts", "line": 26 }, { "location": "src/trace/W3CTraceContextPropagator.ts", "line": 76 }, { "location": "src/trace/W3CTraceContextPropagator.ts", "line": 80 }, { "location": "src/trace/W3CTraceContextPropagator.ts", "line": 121 }, { "location": "src/trace/rpc-metadata.ts", "line": 17 }, { "location": "src/trace/rpc-metadata.ts", "line": 19 }, { "location": "src/trace/sampler/AlwaysOffSampler.ts", "line": 17 }, { "location": "src/trace/sampler/AlwaysOnSampler.ts", "line": 17 }, { "location": "src/trace/sampler/ParentBasedSampler.ts", "line": 27 }, { "location": "src/trace/sampler/ParentBasedSampler.ts", "line": 72 }, { "location": "src/trace/sampler/ParentBasedSampler.ts", "line": 74 }, { "location": "src/trace/sampler/TraceIdRatioBasedSampler.ts", "line": 22 }, { "location": "src/trace/sampler/TraceIdRatioBasedSampler.ts", "line": 39 }, { "location": "src/trace/suppress-tracing.ts", "line": 17 }, { "location": "src/trace/suppress-tracing.ts", "line": 19 }, { "location": "src/utils/environment.ts", "line": 17 } ] }, "tags": [ "api" ] } ], "dependencies": [], "annotations": [ { "bom-ref": "metadata-annotations", "subjects": [ "pkg:npm/@opentelemetry/core@1.17.0-tuxcare.1" ], "annotator": { "component": { "group": "@cyclonedx", "name": "cdxgen", "version": "12.8.5", "purl": "pkg:npm/%40cyclonedx/cdxgen@12.8.5", "type": "application", "bom-ref": "pkg:npm/@cyclonedx/cdxgen@12.8.5", "publisher": "OWASP Foundation", "authors": [ { "name": "OWASP Foundation" } ] } }, "timestamp": "2026-10-08T07:21:07Z", "text": "This Software Bill-of-Materials (SBOM) document was created on Thursday, October 8, 2026 with cdxgen. The data was captured during the pre-build lifecycle phase without building the application. The document describes an application named 'core' with version '1.17.0-tuxcare.1'. The package type in this SBOM is npm with a single purl namespace '@opentelemetry' described under components. The components were identified from the source files: node_modules/@opentelemetry/api/package.json, node_modules/@opentelemetry/semantic-conventions/package.json." } ] }