{ "bomFormat": "CycloneDX", "specVersion": "1.7", "serialNumber": "urn:uuid:4b848aac-806f-4f61-9e66-46cadb9d48a6", "version": 1, "metadata": { "timestamp": "2026-09-24T06:34:07Z", "tools": { "components": [ { "group": "@cyclonedx", "name": "cdxgen", "version": "12.8.4", "purl": "pkg:npm/%40cyclonedx/cdxgen@12.8.4", "type": "application", "bom-ref": "pkg:npm/@cyclonedx/cdxgen@12.8.4", "publisher": "OWASP Foundation", "authors": [ { "name": "OWASP Foundation" } ] } ] }, "authors": [ { "name": "OWASP Foundation" } ], "lifecycles": [ { "phase": "pre-build" } ], "component": { "name": "farrow-api", "group": "", "version": "1.12.1", "description": "A type-friendly BFF framework", "purl": "pkg:npm/farrow-api@1.12.1", "bom-ref": "pkg:npm/farrow-api@1.12.1", "author": "Jade Gu", "properties": [ { "name": "cdx:npm:scripts", "value": "build, test, test:coverage" }, { "name": "cdx:npm:buildScripts", "value": "build" }, { "name": "cdx:license:category", "value": "Permissive" } ], "type": "application", "licenses": [ { "license": { "id": "MIT", "url": "https://opensource.org/licenses/MIT", "properties": [ { "name": "cdx:license:category", "value": "Permissive" }, { "name": "cdx:license:foss", "value": "true" }, { "name": "cdx:license:osiApproved", "value": "true" }, { "name": "cdx:license:fsfLibre", "value": "true" }, { "name": "cdx:license:deprecated", "value": "false" } ] } } ], "externalReferences": [ { "type": "vcs", "url": "git+https://github.com/Lucifier129/farrow.git" } ] }, "properties": [ { "name": "cdx:bom:componentTypes", "value": "npm" }, { "name": "cdx:bom:componentNamespaces", "value": "@types" }, { "name": "cdx:bom:componentSrcFiles", "value": "node_modules/@types/jest/package.json\\nnode_modules/@types/prettier/package.json\\nnode_modules/cosmiconfig/package.json\\nnode_modules/farrow-pipeline/package.json\\nnode_modules/farrow-schema/package.json\\nnode_modules/jest/package.json\\nnode_modules/prettier/package.json\\nnode_modules/ts-jest/package.json\\nnode_modules/tslib/package.json\\nnode_modules/typescript/package.json" } ] }, "components": [ { "authors": [ { "name": "Microsoft Corp." } ], "group": "", "name": "typescript", "version": "4.5.5", "description": "TypeScript is a language for application scale JavaScript development", "scope": "optional", "licenses": [ { "license": { "id": "Apache-2.0", "url": "https://opensource.org/licenses/Apache-2.0", "properties": [ { "name": "cdx:license:category", "value": "Permissive" }, { "name": "cdx:license:foss", "value": "true" }, { "name": "cdx:license:osiApproved", "value": "true" }, { "name": "cdx:license:fsfLibre", "value": "true" }, { "name": "cdx:license:deprecated", "value": "false" } ] } } ], "purl": "pkg:npm/typescript@4.5.5", "externalReferences": [ { "type": "website", "url": "https://www.typescriptlang.org/" }, { "type": "vcs", "url": "https://github.com/Microsoft/TypeScript.git" } ], "type": "library", "bom-ref": "pkg:npm/typescript@4.5.5", "properties": [ { "name": "SrcFile", "value": "node_modules/typescript/package.json" }, { "name": "cdx:license:category", "value": "Permissive" } ], "evidence": { "identity": [ { "field": "purl", "confidence": 0.7, "methods": [ { "technique": "manifest-analysis", "confidence": 0.7, "value": "node_modules/typescript/package.json" } ], "concludedValue": "node_modules/typescript/package.json" } ] } }, { "authors": [ { "name": "Microsoft Corp." } ], "group": "", "name": "tslib", "version": "2.3.1", "description": "Runtime library for TypeScript helper functions", "scope": "required", "licenses": [ { "license": { "id": "0BSD", "url": "https://opensource.org/licenses/0BSD", "properties": [ { "name": "cdx:license:category", "value": "Permissive" }, { "name": "cdx:license:foss", "value": "true" }, { "name": "cdx:license:osiApproved", "value": "true" }, { "name": "cdx:license:fsfLibre", "value": "false" }, { "name": "cdx:license:deprecated", "value": "false" } ] } } ], "purl": "pkg:npm/tslib@2.3.1", "externalReferences": [ { "type": "website", "url": "https://www.typescriptlang.org/" }, { "type": "vcs", "url": "https://github.com/Microsoft/tslib.git" } ], "type": "library", "bom-ref": "pkg:npm/tslib@2.3.1", "properties": [ { "name": "SrcFile", "value": "node_modules/tslib/package.json" }, { "name": "ImportedModules", "value": "tslib" }, { "name": "cdx:license:category", "value": "Permissive" } ], "evidence": { "identity": [ { "field": "purl", "confidence": 0.7, "methods": [ { "technique": "manifest-analysis", "confidence": 0.7, "value": "node_modules/tslib/package.json" } ], "concludedValue": "node_modules/tslib/package.json" } ], "occurrences": [ { "location": "dist/controvert.js", "line": 4 }, { "location": "dist/generateApi.js", "line": 4 }, { "location": "dist/index.js", "line": 3 }, { "location": "dist/prettier.js", "line": 4 } ] } }, { "authors": [ { "name": "Kulshekhar Kabra (https://github.com/kulshekhar)" } ], "group": "", "name": "ts-jest", "version": "27.1.3", "description": "A Jest transformer with source map support that lets you use Jest to test projects written in TypeScript", "scope": "optional", "licenses": [ { "license": { "id": "MIT", "url": "https://opensource.org/licenses/MIT", "properties": [ { "name": "cdx:license:category", "value": "Permissive" }, { "name": "cdx:license:foss", "value": "true" }, { "name": "cdx:license:osiApproved", "value": "true" }, { "name": "cdx:license:fsfLibre", "value": "true" }, { "name": "cdx:license:deprecated", "value": "false" } ] } } ], "purl": "pkg:npm/ts-jest@27.1.3", "externalReferences": [ { "type": "vcs", "url": "https://kulshekhar.github.io/ts-jest" }, { "type": "vcs", "url": "git+https://github.com/kulshekhar/ts-jest.git" } ], "type": "library", "bom-ref": "pkg:npm/ts-jest@27.1.3", "properties": [ { "name": "SrcFile", "value": "node_modules/ts-jest/package.json" }, { "name": "cdx:license:category", "value": "Permissive" } ], "evidence": { "identity": [ { "field": "purl", "confidence": 0.7, "methods": [ { "technique": "manifest-analysis", "confidence": 0.7, "value": "node_modules/ts-jest/package.json" } ], "concludedValue": "node_modules/ts-jest/package.json" } ] }, "tags": [ "test" ] }, { "authors": [ { "name": "James Long" } ], "group": "", "name": "prettier", "version": "2.5.1", "description": "Prettier is an opinionated code formatter", "scope": "required", "licenses": [ { "license": { "id": "MIT", "url": "https://opensource.org/licenses/MIT", "properties": [ { "name": "cdx:license:category", "value": "Permissive" }, { "name": "cdx:license:foss", "value": "true" }, { "name": "cdx:license:osiApproved", "value": "true" }, { "name": "cdx:license:fsfLibre", "value": "true" }, { "name": "cdx:license:deprecated", "value": "false" } ] } } ], "purl": "pkg:npm/prettier@2.5.1", "externalReferences": [ { "type": "website", "url": "https://prettier.io" } ], "type": "library", "bom-ref": "pkg:npm/prettier@2.5.1", "properties": [ { "name": "SrcFile", "value": "node_modules/prettier/package.json" }, { "name": "ImportedModules", "value": "prettier" }, { "name": "cdx:license:category", "value": "Permissive" } ], "evidence": { "identity": [ { "field": "purl", "confidence": 0.7, "methods": [ { "technique": "manifest-analysis", "confidence": 0.7, "value": "node_modules/prettier/package.json" } ], "concludedValue": "node_modules/prettier/package.json" } ], "occurrences": [ { "location": "dist/prettier.js", "line": 5 }, { "location": "src/prettier.ts", "line": 1 }, { "location": "src/prettier.ts", "line": 9 } ] } }, { "group": "", "name": "jest", "version": "27.4.7", "description": "Delightful JavaScript Testing.", "scope": "optional", "licenses": [ { "license": { "id": "MIT", "url": "https://opensource.org/licenses/MIT", "properties": [ { "name": "cdx:license:category", "value": "Permissive" }, { "name": "cdx:license:foss", "value": "true" }, { "name": "cdx:license:osiApproved", "value": "true" }, { "name": "cdx:license:fsfLibre", "value": "true" }, { "name": "cdx:license:deprecated", "value": "false" } ] } } ], "purl": "pkg:npm/jest@27.4.7", "externalReferences": [ { "type": "website", "url": "https://jestjs.io/" }, { "type": "vcs", "url": "https://github.com/facebook/jest" } ], "type": "library", "bom-ref": "pkg:npm/jest@27.4.7", "properties": [ { "name": "SrcFile", "value": "node_modules/jest/package.json" }, { "name": "cdx:license:category", "value": "Permissive" } ], "evidence": { "identity": [ { "field": "purl", "confidence": 0.7, "methods": [ { "technique": "manifest-analysis", "confidence": 0.7, "value": "node_modules/jest/package.json" } ], "concludedValue": "node_modules/jest/package.json" } ] }, "tags": [ "test" ] }, { "authors": [ { "name": "Jade Gu" } ], "group": "", "name": "farrow-schema", "version": "1.12.1", "description": "A powerful and extensible schema builder", "scope": "required", "licenses": [ { "license": { "id": "MIT", "url": "https://opensource.org/licenses/MIT", "properties": [ { "name": "cdx:license:category", "value": "Permissive" }, { "name": "cdx:license:foss", "value": "true" }, { "name": "cdx:license:osiApproved", "value": "true" }, { "name": "cdx:license:fsfLibre", "value": "true" }, { "name": "cdx:license:deprecated", "value": "false" } ] } } ], "purl": "pkg:npm/farrow-schema@1.12.1", "externalReferences": [ { "type": "vcs", "url": "git+https://github.com/Lucifier129/farrow.git" } ], "type": "library", "bom-ref": "pkg:npm/farrow-schema@1.12.1", "properties": [ { "name": "SrcFile", "value": "node_modules/farrow-schema/package.json" }, { "name": "ImportedModules", "value": "farrow-schema,farrow-schema/formatter,Type,farrow-schema/Type,Prettier,farrow-schema/Prettier,TypeOf,farrow-schema/TypeOf,ToSchemaCtor,farrow-schema/ToSchemaCtor,SchemaCtorInput,farrow-schema/SchemaCtorInput,JsonType,farrow-schema/JsonType,SchemaCtor,farrow-schema/SchemaCtor,String,farrow-schema/String,farrow-schema/ID,Number,farrow-schema/Number,farrow-schema/Int,Float,farrow-schema/Float,Boolean,farrow-schema/Boolean,Unknown,farrow-schema/Unknown,farrow-schema/Any,Json,farrow-schema/Json,ObjectType,farrow-schema/ObjectType,FieldDescriptor,farrow-schema/FieldDescriptor,Union,farrow-schema/Union,Intersect,farrow-schema/Intersect,Struct,farrow-schema/Struct,FieldDescriptors,farrow-schema/FieldDescriptors,Record,farrow-schema/Record,List,farrow-schema/List,Tuple,farrow-schema/Tuple,Literal,farrow-schema/Literal,Nullable,farrow-schema/Nullable,Strict,farrow-schema/Strict,NonStrict,farrow-schema/NonStrict,ReadOnly,farrow-schema/ReadOnly,ReadOnlyDeep,farrow-schema/ReadOnlyDeep,FormatTypes,farrow-schema/formatter/FormatTypes,FormatType,farrow-schema/formatter/FormatType,FormatScalarType,farrow-schema/formatter/FormatScalarType,FormatObjectType,farrow-schema/formatter/FormatObjectType,FormatFields,farrow-schema/formatter/FormatFields,FormatField,farrow-schema/formatter/FormatField,FormatUnionType,farrow-schema/formatter/FormatUnionType,FormatIntersectType,farrow-schema/formatter/FormatIntersectType,FormatStructType,farrow-schema/formatter/FormatStructType,FormatRecordType,farrow-schema/formatter/FormatRecordType,FormatListType,farrow-schema/formatter/FormatListType,FormatTupleType,farrow-schema/formatter/FormatTupleType,FormatLiteralType,farrow-schema/formatter/FormatLiteralType,FormatNullableType,farrow-schema/formatter/FormatNullableType,FormatStrictType,farrow-schema/formatter/FormatStrictType,FormatNonStrictType,farrow-schema/formatter/FormatNonStrictType,FormatReadOnlyType,farrow-schema/formatter/FormatReadOnlyType,FormatReadonlyDeepType,farrow-schema/formatter/FormatReadonlyDeepType,isNamedFormatType,farrow-schema/formatter/isNamedFormatType,toSchemaCtor,farrow-schema/toSchemaCtor,Formatter,farrow-schema/formatter/Formatter,FormatContext,farrow-schema/formatter/FormatContext" }, { "name": "cdx:license:category", "value": "Permissive" } ], "evidence": { "identity": [ { "field": "purl", "confidence": 0.7, "methods": [ { "technique": "manifest-analysis", "confidence": 0.7, "value": "node_modules/farrow-schema/package.json" } ], "concludedValue": "node_modules/farrow-schema/package.json" } ], "occurrences": [ { "location": "dist/api.js", "line": 4 }, { "location": "dist/controvert.js", "line": 5 }, { "location": "dist/generateApi.js", "line": 5 }, { "location": "dist/toJSON.js", "line": 4 }, { "location": "dist/toJSON.js", "line": 5 }, { "location": "src/api.ts", "line": 1 }, { "location": "src/controvert.ts", "line": 28 }, { "location": "src/controvert.ts", "line": 49 }, { "location": "src/controvert.ts", "line": 213 }, { "location": "src/controvert.ts", "line": 218 }, { "location": "src/controvert.ts", "line": 223 }, { "location": "src/controvert.ts", "line": 228 }, { "location": "src/controvert.ts", "line": 233 }, { "location": "src/controvert.ts", "line": 238 }, { "location": "src/controvert.ts", "line": 242 }, { "location": "src/controvert.ts", "line": 247 }, { "location": "src/controvert.ts", "line": 252 }, { "location": "src/controvert.ts", "line": 257 }, { "location": "src/controvert.ts", "line": 262 }, { "location": "src/controvert.ts", "line": 267 }, { "location": "src/generateApi.ts", "line": 1 }, { "location": "src/toJSON.ts", "line": 1 }, { "location": "src/toJSON.ts", "line": 2 }, { "location": "src/toJSON.ts", "line": 47 }, { "location": "src/generateApi.ts", "line": 5 }, { "location": "src/generateApi.ts", "line": 12 }, { "location": "src/toJSON.ts", "line": 48 } ] } }, { "authors": [ { "name": "Jade Gu" } ], "group": "", "name": "farrow-pipeline", "version": "1.12.0", "description": "Type-Friendly middleware library", "scope": "required", "licenses": [ { "license": { "id": "MIT", "url": "https://opensource.org/licenses/MIT", "properties": [ { "name": "cdx:license:category", "value": "Permissive" }, { "name": "cdx:license:foss", "value": "true" }, { "name": "cdx:license:osiApproved", "value": "true" }, { "name": "cdx:license:fsfLibre", "value": "true" }, { "name": "cdx:license:deprecated", "value": "false" } ] } } ], "purl": "pkg:npm/farrow-pipeline@1.12.0", "externalReferences": [ { "type": "vcs", "url": "git+https://github.com/Lucifier129/farrow.git" } ], "type": "library", "bom-ref": "pkg:npm/farrow-pipeline@1.12.0", "properties": [ { "name": "SrcFile", "value": "node_modules/farrow-pipeline/package.json" }, { "name": "ImportedModules", "value": "farrow-pipeline,createAsyncPipeline,farrow-pipeline/createAsyncPipeline,AsyncPipeline,farrow-pipeline/AsyncPipeline,MaybeAsync,farrow-pipeline/MaybeAsync,useContainer,farrow-pipeline/useContainer,Container,farrow-pipeline/Container" }, { "name": "cdx:license:category", "value": "Permissive" } ], "evidence": { "identity": [ { "field": "purl", "confidence": 0.7, "methods": [ { "technique": "manifest-analysis", "confidence": 0.7, "value": "node_modules/farrow-pipeline/package.json" } ], "concludedValue": "node_modules/farrow-pipeline/package.json" } ], "occurrences": [ { "location": "dist/api.js", "line": 5 }, { "location": "src/api.ts", "line": 2 }, { "location": "src/api.ts", "line": 78 }, { "location": "src/api.ts", "line": 84 } ] }, "tags": [ "middleware" ] }, { "authors": [ { "name": "David Clark " } ], "group": "", "name": "cosmiconfig", "version": "7.0.1", "description": "Find and load configuration from a package.json property, rc file, or CommonJS module", "scope": "required", "licenses": [ { "license": { "id": "MIT", "url": "https://opensource.org/licenses/MIT", "properties": [ { "name": "cdx:license:category", "value": "Permissive" }, { "name": "cdx:license:foss", "value": "true" }, { "name": "cdx:license:osiApproved", "value": "true" }, { "name": "cdx:license:fsfLibre", "value": "true" }, { "name": "cdx:license:deprecated", "value": "false" } ] } } ], "purl": "pkg:npm/cosmiconfig@7.0.1", "externalReferences": [ { "type": "vcs", "url": "https://github.com/davidtheclark/cosmiconfig#readme" }, { "type": "vcs", "url": "git+https://github.com/davidtheclark/cosmiconfig.git" } ], "type": "library", "bom-ref": "pkg:npm/cosmiconfig@7.0.1", "properties": [ { "name": "SrcFile", "value": "node_modules/cosmiconfig/package.json" }, { "name": "ImportedModules", "value": "cosmiconfig,cosmiconfigSync,cosmiconfig/cosmiconfigSync" }, { "name": "cdx:license:category", "value": "Permissive" } ], "evidence": { "identity": [ { "field": "purl", "confidence": 0.7, "methods": [ { "technique": "manifest-analysis", "confidence": 0.7, "value": "node_modules/cosmiconfig/package.json" } ], "concludedValue": "node_modules/cosmiconfig/package.json" } ], "occurrences": [ { "location": "dist/prettier.js", "line": 6 }, { "location": "src/prettier.ts", "line": 2 }, { "location": "src/prettier.ts", "line": 4 } ] } }, { "group": "@types", "name": "prettier", "version": "2.4.3", "description": "TypeScript definitions for prettier", "scope": "required", "licenses": [ { "license": { "id": "MIT", "url": "https://opensource.org/licenses/MIT", "properties": [ { "name": "cdx:license:category", "value": "Permissive" }, { "name": "cdx:license:foss", "value": "true" }, { "name": "cdx:license:osiApproved", "value": "true" }, { "name": "cdx:license:fsfLibre", "value": "true" }, { "name": "cdx:license:deprecated", "value": "false" } ] } } ], "purl": "pkg:npm/%40types/prettier@2.4.3", "externalReferences": [ { "type": "vcs", "url": "https://github.com/DefinitelyTyped/DefinitelyTyped/tree/master/types/prettier" }, { "type": "vcs", "url": "https://github.com/DefinitelyTyped/DefinitelyTyped.git" } ], "type": "library", "bom-ref": "pkg:npm/@types/prettier@2.4.3", "properties": [ { "name": "SrcFile", "value": "node_modules/@types/prettier/package.json" }, { "name": "cdx:license:category", "value": "Permissive" } ], "evidence": { "identity": [ { "field": "purl", "confidence": 0.7, "methods": [ { "technique": "manifest-analysis", "confidence": 0.7, "value": "node_modules/@types/prettier/package.json" } ], "concludedValue": "node_modules/@types/prettier/package.json" } ] } }, { "group": "@types", "name": "jest", "version": "27.4.0", "description": "TypeScript definitions for Jest", "scope": "excluded", "licenses": [ { "license": { "id": "MIT", "url": "https://opensource.org/licenses/MIT", "properties": [ { "name": "cdx:license:category", "value": "Permissive" }, { "name": "cdx:license:foss", "value": "true" }, { "name": "cdx:license:osiApproved", "value": "true" }, { "name": "cdx:license:fsfLibre", "value": "true" }, { "name": "cdx:license:deprecated", "value": "false" } ] } } ], "purl": "pkg:npm/%40types/jest@27.4.0", "externalReferences": [ { "type": "vcs", "url": "https://github.com/DefinitelyTyped/DefinitelyTyped/tree/master/types/jest" }, { "type": "vcs", "url": "https://github.com/DefinitelyTyped/DefinitelyTyped.git" } ], "type": "library", "bom-ref": "pkg:npm/@types/jest@27.4.0", "properties": [ { "name": "SrcFile", "value": "node_modules/@types/jest/package.json" }, { "name": "cdx:license:category", "value": "Permissive" } ], "evidence": { "identity": [ { "field": "purl", "confidence": 0.7, "methods": [ { "technique": "manifest-analysis", "confidence": 0.7, "value": "node_modules/@types/jest/package.json" } ], "concludedValue": "node_modules/@types/jest/package.json" } ] }, "tags": [ "test" ] } ], "dependencies": [], "annotations": [ { "bom-ref": "metadata-annotations", "subjects": [ "pkg:npm/farrow-api@1.12.1" ], "annotator": { "component": { "group": "@cyclonedx", "name": "cdxgen", "version": "12.8.4", "purl": "pkg:npm/%40cyclonedx/cdxgen@12.8.4", "type": "application", "bom-ref": "pkg:npm/@cyclonedx/cdxgen@12.8.4", "publisher": "OWASP Foundation", "authors": [ { "name": "OWASP Foundation" } ] } }, "timestamp": "2026-09-24T06:34:07Z", "text": "This Software Bill-of-Materials (SBOM) document was created on Thursday, September 24, 2026 with cdxgen. The data was captured during the pre-build lifecycle phase without building the application. The document describes an application named 'farrow-api' with version '1.12.1'. The package type in this SBOM is npm with a single purl namespace '@types' described under components. The components were identified from 10 source files." } ] }