{ "bomFormat": "CycloneDX", "specVersion": "1.7", "serialNumber": "urn:uuid:2b7b0320-6af4-4b8e-909b-d382d08b2060", "version": 1, "metadata": { "timestamp": "2026-10-24T23:03:42Z", "tools": { "components": [ { "group": "@cyclonedx", "name": "cdxgen", "version": "12.9.0", "purl": "pkg:npm/%40cyclonedx/cdxgen@12.9.0", "type": "application", "bom-ref": "pkg:npm/@cyclonedx/cdxgen@12.9.0", "publisher": "OWASP Foundation", "authors": [ { "name": "OWASP Foundation" } ] } ] }, "authors": [ { "name": "OWASP Foundation" } ], "lifecycles": [ { "phase": "pre-build" } ], "component": { "name": "fhir-router", "group": "@medplum", "version": "3.3.1-tuxcare.3", "description": "Medplum FHIR Router", "purl": "pkg:npm/%40medplum/fhir-router@3.3.1-tuxcare.3", "bom-ref": "pkg:npm/@medplum/fhir-router@3.3.1-tuxcare.3", "author": "Medplum ", "properties": [ { "name": "cdx:npm:scripts", "value": "api-extractor, build, clean, lint, test" }, { "name": "cdx:npm:buildScripts", "value": "build" }, { "name": "cdx:license:category", "value": "Permissive" } ], "type": "application", "licenses": [ { "license": { "id": "Apache-2.0", "url": "https://opensource.org/licenses/Apache-2.0", "properties": [ { "name": "cdx:license:category", "value": "Permissive" }, { "name": "cdx:license:foss", "value": "true" }, { "name": "cdx:license:osiApproved", "value": "true" }, { "name": "cdx:license:fsfLibre", "value": "true" }, { "name": "cdx:license:deprecated", "value": "false" } ] } } ], "externalReferences": [ { "type": "website", "url": "https://www.medplum.com/" }, { "type": "vcs", "url": "git+https://github.com/medplum/medplum.git" } ] }, "properties": [ { "name": "cdx:bom:componentTypes", "value": "npm" }, { "name": "cdx:bom:componentNamespaces", "value": "@medplum" }, { "name": "cdx:bom:componentSrcFiles", "value": "package-lock.json" } ] }, "components": [ { "group": "@medplum", "name": "core", "version": "3.3.1", "scope": "required", "hashes": [ { "alg": "SHA-512", "content": "3f25e96d4f6a4e2473ca71bb42e126905c10a055c6d5b6e8f9019f084651291bf5d383974e7063e576d4ca8774f13b39a6fedbb037e1c71f1b9b6ba5bdfee21b" } ], "licenses": [ { "license": { "id": "Apache-2.0", "url": "https://opensource.org/licenses/Apache-2.0", "properties": [ { "name": "cdx:license:category", "value": "Permissive" }, { "name": "cdx:license:foss", "value": "true" }, { "name": "cdx:license:osiApproved", "value": "true" }, { "name": "cdx:license:fsfLibre", "value": "true" }, { "name": "cdx:license:deprecated", "value": "false" } ] } } ], "purl": "pkg:npm/%40medplum/core@3.3.1", "externalReferences": [ { "type": "distribution", "url": "https://registry.npmjs.org/@medplum/core/-/core-3.3.1.tgz" } ], "type": "library", "bom-ref": "pkg:npm/@medplum/core@3.3.1", "properties": [ { "name": "SrcFile", "value": "package-lock.json" }, { "name": "ResolvedUrl", "value": "https://registry.npmjs.org/@medplum/core/-/core-3.3.1.tgz" }, { "name": "ImportedModules", "value": "@medplum/core,EventTarget,@medplum/core/EventTarget,OperationOutcomeError,@medplum/core/OperationOutcomeError,allOk,@medplum/core/allOk,badRequest,@medplum/core/badRequest,created,@medplum/core/created,normalizeOperationOutcome,@medplum/core/normalizeOperationOutcome,notFound,@medplum/core/notFound,parseSearchRequest,@medplum/core/parseSearchRequest,singularize,@medplum/core/singularize,getReferenceString,@medplum/core/getReferenceString,getStatus,@medplum/core/getStatus,isOk,@medplum/core/isOk,ContentType,@medplum/core/ContentType,deepClone,@medplum/core/deepClone,DEFAULT_SEARCH_COUNT,@medplum/core/DEFAULT_SEARCH_COUNT,forbidden,@medplum/core/forbidden,getResourceTypes,@medplum/core/getResourceTypes,LRUCache,@medplum/core/LRUCache,Operator,@medplum/core/Operator,evalFhirPath,@medplum/core/evalFhirPath,generateId,@medplum/core/generateId,globalSchema,@medplum/core/globalSchema,matchesSearchRequest,@medplum/core/matchesSearchRequest,multipleMatches,@medplum/core/multipleMatches,preconditionFailed,@medplum/core/preconditionFailed,stringify,@medplum/core/stringify,capitalize,@medplum/core/capitalize,getDataType,@medplum/core/getDataType,isResourceType,@medplum/core/isResourceType,DEFAULT_MAX_SEARCH_COUNT,@medplum/core/DEFAULT_MAX_SEARCH_COUNT,getSearchParameters,@medplum/core/getSearchParameters,evalFhirPathTyped,@medplum/core/evalFhirPathTyped,isLowerCase,@medplum/core/isLowerCase,isReference,@medplum/core/isReference,isResourceTypeSchema,@medplum/core/isResourceTypeSchema,toJsBoolean,@medplum/core/toJsBoolean,toTypedValue,@medplum/core/toTypedValue,tryGetDataType,@medplum/core/tryGetDataType,Event,@medplum/core/Event,Logger,@medplum/core/Logger,InternalSchemaElement,@medplum/core/InternalSchemaElement,Filter,@medplum/core/Filter,SearchRequest,@medplum/core/SearchRequest,SortRule,@medplum/core/SortRule" }, { "name": "cdx:license:category", "value": "Permissive" } ], "evidence": { "identity": [ { "field": "purl", "confidence": 1, "methods": [ { "technique": "manifest-analysis", "confidence": 1, "value": "package-lock.json" } ], "concludedValue": "package-lock.json" } ], "occurrences": [ { "location": "dist/cjs/index.cjs", "line": 1 }, { "location": "dist/cjs/index.cjs", "line": 53 }, { "location": "dist/cjs/index.cjs", "line": 54 }, { "location": "dist/esm/index.mjs", "line": 1 }, { "location": "dist/esm/index.mjs", "line": 53 }, { "location": "dist/esm/index.mjs", "line": 54 }, { "location": "src/batch.ts", "line": 11 }, { "location": "src/batch.ts", "line": 89 }, { "location": "src/batch.ts", "line": 100 }, { "location": "src/batch.ts", "line": 103 }, { "location": "src/batch.ts", "line": 121 }, { "location": "src/batch.ts", "line": 150 }, { "location": "src/batch.ts", "line": 167 }, { "location": "src/batch.ts", "line": 214 }, { "location": "src/batch.ts", "line": 234 }, { "location": "src/batch.ts", "line": 275 }, { "location": "src/batch.ts", "line": 278 }, { "location": "src/batch.ts", "line": 283 }, { "location": "src/batch.ts", "line": 301 }, { "location": "src/batch.ts", "line": 316 }, { "location": "src/batch.ts", "line": 320 }, { "location": "src/batch.ts", "line": 325 }, { "location": "src/batch.ts", "line": 331 }, { "location": "src/batch.ts", "line": 335 }, { "location": "src/batch.ts", "line": 364 }, { "location": "src/batch.ts", "line": 388 }, { "location": "src/batch.ts", "line": 421 }, { "location": "src/batch.ts", "line": 472 }, { "location": "src/batch.ts", "line": 487 }, { "location": "src/batch.ts", "line": 491 }, { "location": "src/batch.ts", "line": 502 }, { "location": "src/batch.ts", "line": 578 }, { "location": "src/batch.ts", "line": 579 }, { "location": "src/fhirrouter.ts", "line": 11 }, { "location": "src/fhirrouter.ts", "line": 73 }, { "location": "src/fhirrouter.ts", "line": 90 }, { "location": "src/fhirrouter.ts", "line": 103 }, { "location": "src/fhirrouter.ts", "line": 105 }, { "location": "src/fhirrouter.ts", "line": 122 }, { "location": "src/fhirrouter.ts", "line": 151 }, { "location": "src/fhirrouter.ts", "line": 152 }, { "location": "src/fhirrouter.ts", "line": 169 }, { "location": "src/fhirrouter.ts", "line": 215 }, { "location": "src/fhirrouter.ts", "line": 218 }, { "location": "src/fhirrouter.ts", "line": 234 }, { "location": "src/fhirrouter.ts", "line": 250 }, { "location": "src/fhirrouter.ts", "line": 260 }, { "location": "src/fhirrouter.ts", "line": 263 }, { "location": "src/fhirrouter.ts", "line": 315 }, { "location": "src/fhirrouter.ts", "line": 332 }, { "location": "src/graphql/graphql.ts", "line": 13 }, { "location": "src/graphql/graphql.ts", "line": 100 }, { "location": "src/graphql/graphql.ts", "line": 107 }, { "location": "src/graphql/graphql.ts", "line": 182 }, { "location": "src/graphql/graphql.ts", "line": 190 }, { "location": "src/graphql/graphql.ts", "line": 365 }, { "location": "src/graphql/graphql.ts", "line": 389 }, { "location": "src/graphql/graphql.ts", "line": 394 }, { "location": "src/graphql/graphql.ts", "line": 418 }, { "location": "src/graphql/graphql.ts", "line": 421 }, { "location": "src/graphql/graphql.ts", "line": 426 }, { "location": "src/graphql/input-types.ts", "line": 1 }, { "location": "src/graphql/input-types.ts", "line": 29 }, { "location": "src/graphql/input-types.ts", "line": 41 }, { "location": "src/graphql/input-types.ts", "line": 54 }, { "location": "src/graphql/input-types.ts", "line": 93 }, { "location": "src/graphql/output-types.ts", "line": 16 }, { "location": "src/graphql/output-types.ts", "line": 53 }, { "location": "src/graphql/output-types.ts", "line": 60 }, { "location": "src/graphql/output-types.ts", "line": 76 }, { "location": "src/graphql/output-types.ts", "line": 78 }, { "location": "src/graphql/output-types.ts", "line": 126 }, { "location": "src/graphql/output-types.ts", "line": 156 }, { "location": "src/graphql/output-types.ts", "line": 164 }, { "location": "src/graphql/output-types.ts", "line": 191 }, { "location": "src/graphql/output-types.ts", "line": 238 }, { "location": "src/graphql/output-types.ts", "line": 240 }, { "location": "src/graphql/output-types.ts", "line": 310 }, { "location": "src/graphql/output-types.ts", "line": 333 }, { "location": "src/graphql/output-types.ts", "line": 339 }, { "location": "src/graphql/utils.ts", "line": 10 }, { "location": "src/graphql/utils.ts", "line": 81 }, { "location": "src/graphql/utils.ts", "line": 89 }, { "location": "src/graphql/utils.ts", "line": 223 }, { "location": "src/repo.ts", "line": 19 }, { "location": "src/repo.ts", "line": 216 }, { "location": "src/repo.ts", "line": 230 }, { "location": "src/repo.ts", "line": 251 }, { "location": "src/repo.ts", "line": 264 }, { "location": "src/repo.ts", "line": 276 }, { "location": "src/repo.ts", "line": 327 }, { "location": "src/repo.ts", "line": 336 }, { "location": "src/repo.ts", "line": 363 }, { "location": "src/repo.ts", "line": 367 }, { "location": "src/repo.ts", "line": 372 }, { "location": "src/repo.ts", "line": 387 }, { "location": "src/repo.ts", "line": 405 }, { "location": "src/repo.ts", "line": 408 }, { "location": "src/repo.ts", "line": 419 }, { "location": "src/repo.ts", "line": 425 }, { "location": "src/repo.ts", "line": 438 }, { "location": "src/repo.ts", "line": 455 }, { "location": "src/repo.ts", "line": 463 }, { "location": "src/repo.ts", "line": 467 }, { "location": "src/repo.ts", "line": 528 }, { "location": "src/repo.ts", "line": 529 } ] } }, { "group": "@medplum", "name": "definitions", "version": "3.3.1", "scope": "required", "hashes": [ { "alg": "SHA-512", "content": "7447847ba5a3b4c8d34f51e486aa0dc5f218b63c6f2b0df8fee585c139e50d37cf44403b8a3d9768c757701e60ad733848dcb12d0a05beffcfcb783329ced617" } ], "licenses": [ { "license": { "id": "Apache-2.0", "url": "https://opensource.org/licenses/Apache-2.0", "properties": [ { "name": "cdx:license:category", "value": "Permissive" }, { "name": "cdx:license:foss", "value": "true" }, { "name": "cdx:license:osiApproved", "value": "true" }, { "name": "cdx:license:fsfLibre", "value": "true" }, { "name": "cdx:license:deprecated", "value": "false" } ] } } ], "purl": "pkg:npm/%40medplum/definitions@3.3.1", "externalReferences": [ { "type": "distribution", "url": "https://registry.npmjs.org/@medplum/definitions/-/definitions-3.3.1.tgz" } ], "type": "library", "bom-ref": "pkg:npm/@medplum/definitions@3.3.1", "properties": [ { "name": "SrcFile", "value": "package-lock.json" }, { "name": "ResolvedUrl", "value": "https://registry.npmjs.org/@medplum/definitions/-/definitions-3.3.1.tgz" }, { "name": "cdx:license:category", "value": "Permissive" } ], "evidence": { "identity": [ { "field": "purl", "confidence": 1, "methods": [ { "technique": "manifest-analysis", "confidence": 1, "value": "package-lock.json" } ], "concludedValue": "package-lock.json" } ] } }, { "group": "@medplum", "name": "fhirtypes", "version": "3.3.1", "scope": "required", "hashes": [ { "alg": "SHA-512", "content": "b1f8cb7a6c67e34065d319faa60144de08ef150d3a4fd2582de12669903dcef4fe39c61a34016959d8c24d47022a5dafd890a0da2b1a95e9d85231d346968db0" } ], "licenses": [ { "license": { "id": "Apache-2.0", "url": "https://opensource.org/licenses/Apache-2.0", "properties": [ { "name": "cdx:license:category", "value": "Permissive" }, { "name": "cdx:license:foss", "value": "true" }, { "name": "cdx:license:osiApproved", "value": "true" }, { "name": "cdx:license:fsfLibre", "value": "true" }, { "name": "cdx:license:deprecated", "value": "false" } ] } } ], "purl": "pkg:npm/%40medplum/fhirtypes@3.3.1", "externalReferences": [ { "type": "distribution", "url": "https://registry.npmjs.org/@medplum/fhirtypes/-/fhirtypes-3.3.1.tgz" } ], "type": "library", "bom-ref": "pkg:npm/@medplum/fhirtypes@3.3.1", "properties": [ { "name": "SrcFile", "value": "package-lock.json" }, { "name": "ResolvedUrl", "value": "https://registry.npmjs.org/@medplum/fhirtypes/-/fhirtypes-3.3.1.tgz" }, { "name": "ImportedModules", "value": "@medplum/fhirtypes,Bundle,@medplum/fhirtypes/Bundle,BundleEntry,@medplum/fhirtypes/BundleEntry,BundleEntryRequest,@medplum/fhirtypes/BundleEntryRequest,OperationOutcome,@medplum/fhirtypes/OperationOutcome,ParametersParameter,@medplum/fhirtypes/ParametersParameter,Resource,@medplum/fhirtypes/Resource,CapabilityStatementRestInteraction,@medplum/fhirtypes/CapabilityStatementRestInteraction,CapabilityStatementRestResourceInteraction,@medplum/fhirtypes/CapabilityStatementRestResourceInteraction,ResourceType,@medplum/fhirtypes/ResourceType,Reference,@medplum/fhirtypes/Reference,ElementDefinitionType,@medplum/fhirtypes/ElementDefinitionType" }, { "name": "cdx:license:category", "value": "Permissive" } ], "evidence": { "identity": [ { "field": "purl", "confidence": 1, "methods": [ { "technique": "manifest-analysis", "confidence": 1, "value": "package-lock.json" } ], "concludedValue": "package-lock.json" } ], "occurrences": [ { "location": "src/batch.ts", "line": 19 }, { "location": "src/fhirrouter.ts", "line": 18 }, { "location": "src/graphql/graphql.ts", "line": 14 }, { "location": "src/graphql/input-types.ts", "line": 2 }, { "location": "src/graphql/output-types.ts", "line": 17 }, { "location": "src/graphql/utils.ts", "line": 11 }, { "location": "src/repo.ts", "line": 20 } ] } }, { "group": "", "name": "dataloader", "version": "2.2.3", "scope": "required", "hashes": [ { "alg": "SHA-512", "content": "cb692bb4048836d3c54b5ad20e369cac5827d5d714ba844455a6f094e18e7b849dc5e9d112ac23c2312501dc2f6c633b920673f5adca56271647bbdccfcae7cc" } ], "licenses": [ { "license": { "id": "MIT", "url": "https://opensource.org/licenses/MIT", "properties": [ { "name": "cdx:license:category", "value": "Permissive" }, { "name": "cdx:license:foss", "value": "true" }, { "name": "cdx:license:osiApproved", "value": "true" }, { "name": "cdx:license:fsfLibre", "value": "true" }, { "name": "cdx:license:deprecated", "value": "false" } ] } } ], "purl": "pkg:npm/dataloader@2.2.3", "externalReferences": [ { "type": "distribution", "url": "https://registry.npmjs.org/dataloader/-/dataloader-2.2.3.tgz" } ], "type": "library", "bom-ref": "pkg:npm/dataloader@2.2.3", "properties": [ { "name": "SrcFile", "value": "package-lock.json" }, { "name": "ResolvedUrl", "value": "https://registry.npmjs.org/dataloader/-/dataloader-2.2.3.tgz" }, { "name": "ImportedModules", "value": "dataloader" }, { "name": "cdx:license:category", "value": "Permissive" } ], "evidence": { "identity": [ { "field": "purl", "confidence": 1, "methods": [ { "technique": "manifest-analysis", "confidence": 1, "value": "package-lock.json" } ], "concludedValue": "package-lock.json" } ], "occurrences": [ { "location": "dist/cjs/index.cjs", "line": 1 }, { "location": "dist/cjs/index.cjs", "line": 54 }, { "location": "dist/esm/index.mjs", "line": 1 }, { "location": "dist/esm/index.mjs", "line": 54 }, { "location": "src/graphql/graphql.ts", "line": 15 }, { "location": "src/graphql/utils.ts", "line": 12 } ] } }, { "group": "", "name": "graphql", "version": "16.10.0", "scope": "required", "hashes": [ { "alg": "SHA-512", "content": "023a8629b0c650544a21108ff6d08a888187cab8b3da81c46cf21b12d7122d2b3862345e64e20f41059e938fba863c3ad87f504a15c7c9a1a2bc689854b79815" } ], "licenses": [ { "license": { "id": "MIT", "url": "https://opensource.org/licenses/MIT", "properties": [ { "name": "cdx:license:category", "value": "Permissive" }, { "name": "cdx:license:foss", "value": "true" }, { "name": "cdx:license:osiApproved", "value": "true" }, { "name": "cdx:license:fsfLibre", "value": "true" }, { "name": "cdx:license:deprecated", "value": "false" } ] } } ], "purl": "pkg:npm/graphql@16.10.0", "externalReferences": [ { "type": "distribution", "url": "https://registry.npmjs.org/graphql/-/graphql-16.10.0.tgz" } ], "type": "library", "bom-ref": "pkg:npm/graphql@16.10.0", "properties": [ { "name": "SrcFile", "value": "package-lock.json" }, { "name": "ResolvedUrl", "value": "https://registry.npmjs.org/graphql/-/graphql-16.10.0.tgz" }, { "name": "ImportedModules", "value": "graphql,ArgumentNode,graphql/ArgumentNode,ASTNode,graphql/ASTNode,ASTVisitor,graphql/ASTVisitor,DocumentNode,graphql/DocumentNode,execute,graphql/execute,ExecutionResult,graphql/ExecutionResult,FieldNode,graphql/FieldNode,GraphQLFieldConfigArgumentMap,graphql/GraphQLFieldConfigArgumentMap,GraphQLFieldConfigMap,graphql/GraphQLFieldConfigMap,GraphQLFloat,graphql/GraphQLFloat,GraphQLID,graphql/GraphQLID,GraphQLInt,graphql/GraphQLInt,GraphQLList,graphql/GraphQLList,GraphQLNonNull,graphql/GraphQLNonNull,GraphQLObjectType,graphql/GraphQLObjectType,GraphQLOutputType,graphql/GraphQLOutputType,GraphQLResolveInfo,graphql/GraphQLResolveInfo,GraphQLSchema,graphql/GraphQLSchema,GraphQLString,graphql/GraphQLString,Kind,graphql/Kind,OperationDefinitionNode,graphql/OperationDefinitionNode,parse,graphql/parse,specifiedRules,graphql/specifiedRules,validate,graphql/validate,ValidationContext,graphql/ValidationContext,GraphQLInputFieldConfig,graphql/GraphQLInputFieldConfig,GraphQLInputFieldConfigMap,graphql/GraphQLInputFieldConfigMap,GraphQLInputObjectType,graphql/GraphQLInputObjectType,GraphQLInputType,graphql/GraphQLInputType,GraphQLEnumType,graphql/GraphQLEnumType,GraphQLEnumValueConfigMap,graphql/GraphQLEnumValueConfigMap,GraphQLFieldConfig,graphql/GraphQLFieldConfig,GraphQLUnionType,graphql/GraphQLUnionType,GraphQLBoolean,graphql/GraphQLBoolean,GraphQLError,graphql/GraphQLError,GraphQLScalarType,graphql/GraphQLScalarType" }, { "name": "cdx:license:category", "value": "Permissive" } ], "evidence": { "identity": [ { "field": "purl", "confidence": 1, "methods": [ { "technique": "manifest-analysis", "confidence": 1, "value": "package-lock.json" } ], "concludedValue": "package-lock.json" } ], "occurrences": [ { "location": "src/graphql/graphql.ts", "line": 42 }, { "location": "src/graphql/graphql.ts", "line": 105 }, { "location": "src/graphql/graphql.ts", "line": 112 }, { "location": "src/graphql/graphql.ts", "line": 138 }, { "location": "src/graphql/input-types.ts", "line": 11 }, { "location": "src/graphql/output-types.ts", "line": 32 }, { "location": "src/graphql/utils.ts", "line": 24 } ] } }, { "group": "", "name": "rfc6902", "version": "5.1.2", "scope": "required", "hashes": [ { "alg": "SHA-512", "content": "cf171bf8f5a513c3f05f4b62284eb33fded31d0f3f94799e8b0b9c46b277605ba95849a9db9466152941d5d353aa3928bf0a86e22abebb583324c052dee9bc98" } ], "licenses": [ { "license": { "id": "MIT", "url": "https://opensource.org/licenses/MIT", "properties": [ { "name": "cdx:license:category", "value": "Permissive" }, { "name": "cdx:license:foss", "value": "true" }, { "name": "cdx:license:osiApproved", "value": "true" }, { "name": "cdx:license:fsfLibre", "value": "true" }, { "name": "cdx:license:deprecated", "value": "false" } ] } } ], "purl": "pkg:npm/rfc6902@5.1.2", "externalReferences": [ { "type": "distribution", "url": "https://registry.npmjs.org/rfc6902/-/rfc6902-5.1.2.tgz" } ], "type": "library", "bom-ref": "pkg:npm/rfc6902@5.1.2", "properties": [ { "name": "SrcFile", "value": "package-lock.json" }, { "name": "ResolvedUrl", "value": "https://registry.npmjs.org/rfc6902/-/rfc6902-5.1.2.tgz" }, { "name": "ImportedModules", "value": "rfc6902,applyPatch,rfc6902/applyPatch,Operation,rfc6902/Operation" }, { "name": "cdx:license:category", "value": "Permissive" } ], "evidence": { "identity": [ { "field": "purl", "confidence": 1, "methods": [ { "technique": "manifest-analysis", "confidence": 1, "value": "package-lock.json" } ], "concludedValue": "package-lock.json" } ], "occurrences": [ { "location": "dist/cjs/index.cjs", "line": 53 }, { "location": "dist/esm/index.mjs", "line": 53 }, { "location": "src/fhirrouter.ts", "line": 20 }, { "location": "src/repo.ts", "line": 21 }, { "location": "src/repo.ts", "line": 403 } ] } } ], "dependencies": [ { "ref": "pkg:npm/@medplum/core@3.3.1", "dependsOn": [] }, { "ref": "pkg:npm/@medplum/definitions@3.3.1", "dependsOn": [] }, { "ref": "pkg:npm/@medplum/fhirtypes@3.3.1", "dependsOn": [] }, { "ref": "pkg:npm/dataloader@2.2.3", "dependsOn": [] }, { "ref": "pkg:npm/graphql@16.10.0", "dependsOn": [] }, { "ref": "pkg:npm/rfc6902@5.1.2", "dependsOn": [] }, { "ref": "pkg:npm/@medplum/fhir-router@3.3.1-tuxcare.3", "dependsOn": [ "pkg:npm/@medplum/core@3.3.1", "pkg:npm/@medplum/definitions@3.3.1", "pkg:npm/@medplum/fhirtypes@3.3.1", "pkg:npm/dataloader@2.2.3", "pkg:npm/graphql@16.10.0", "pkg:npm/rfc6902@5.1.2" ] } ], "annotations": [ { "bom-ref": "metadata-annotations", "subjects": [ "pkg:npm/@medplum/fhir-router@3.3.1-tuxcare.3" ], "annotator": { "component": { "group": "@cyclonedx", "name": "cdxgen", "version": "12.9.0", "purl": "pkg:npm/%40cyclonedx/cdxgen@12.9.0", "type": "application", "bom-ref": "pkg:npm/@cyclonedx/cdxgen@12.9.0", "publisher": "OWASP Foundation", "authors": [ { "name": "OWASP Foundation" } ] } }, "timestamp": "2026-10-24T23:03:42Z", "text": "This Software Bill-of-Materials (SBOM) document was created on Saturday, October 24, 2026 with cdxgen. The data was captured during the pre-build lifecycle phase without building the application. The document describes an application named 'fhir-router' with version '3.3.1-tuxcare.3'. The package type in this SBOM is npm with a single purl namespace '@medplum' described under components. The components were identified from the source files: package-lock.json." } ] }