bom.xml

<?xml version="1.0" encoding="utf-8"?>
<bom xmlns="http://cyclonedx.org/schema/bom/1.2" serialNumber="urn:uuid:d6aa76fa-e488-480d-9ad0-f67765dfd015" version="1">
    <metadata>
        <timestamp>2020-08-03T03:19:55.999Z</timestamp>
        <tools>
            <tool>
                <vendor>CycloneDX</vendor>
                <name>Node.js module</name>
                <version>2.0.0</version>
            </tool>
        </tools>
        <component type="library" bom-ref="pkg:npm/juice-shop@11.1.2">
            <name>juice-shop</name>
            <version>11.1.2</version>
            <description>
                <![CDATA[Probably the most modern and sophisticated insecure web application]]>
            </description>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/juice-shop@11.1.2</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://owasp-juice.shop</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/bkimminich/juice-shop/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git+https://github.com/bkimminich/juice-shop.git</url>
                </reference>
            </externalReferences>
        </component>
    </metadata>
    <components>
        <component type="library" bom-ref="pkg:npm/body-parser@1.19.0">
            <name>body-parser</name>
            <version>1.19.0</version>
            <description>
                <![CDATA[Node.js body parsing middleware]]>
            </description>
            <hashes>
                <hash alg="SHA-1">96b2709e57c9c4e09a6fd66a8fd979844f69f08a</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/body-parser@1.19.0</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/expressjs/body-parser#readme</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/expressjs/body-parser/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git+https://github.com/expressjs/body-parser.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/bytes@3.1.0">
            <name>bytes</name>
            <version>3.1.0</version>
            <description>
                <![CDATA[Utility to parse a string bytes to bytes and vice-versa]]>
            </description>
            <hashes>
                <hash alg="SHA-1">f6cf7933a360e0588fa9fde85651cdc7f805d1f6</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/bytes@3.1.0</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/visionmedia/bytes.js#readme</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/visionmedia/bytes.js/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git+https://github.com/visionmedia/bytes.js.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/content-type@1.0.4">
            <name>content-type</name>
            <version>1.0.4</version>
            <description>
                <![CDATA[Create and parse HTTP Content-Type header]]>
            </description>
            <hashes>
                <hash alg="SHA-1">e138cc75e040c727b1966fe5e5f8c9aee256fe3b</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/content-type@1.0.4</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/jshttp/content-type#readme</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/jshttp/content-type/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git+https://github.com/jshttp/content-type.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/debug@2.6.9">
            <name>debug</name>
            <version>2.6.9</version>
            <description>
                <![CDATA[small debugging utility]]>
            </description>
            <hashes>
                <hash alg="SHA-1">5d128515df134ff327e90a4c93f4e077a536341f</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/debug@2.6.9</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/visionmedia/debug#readme</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/visionmedia/debug/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git://github.com/visionmedia/debug.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/ms@2.0.0">
            <name>ms</name>
            <version>2.0.0</version>
            <description>
                <![CDATA[Tiny milisecond conversion utility]]>
            </description>
            <hashes>
                <hash alg="SHA-1">5608aeadfc00be6c2901df5f9861788de0d597c8</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/ms@2.0.0</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/zeit/ms#readme</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/zeit/ms/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git+https://github.com/zeit/ms.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/depd@1.1.2">
            <name>depd</name>
            <version>1.1.2</version>
            <description>
                <![CDATA[Deprecate all the things]]>
            </description>
            <hashes>
                <hash alg="SHA-1">9bcd52e14c097763e749b274c4346ed2e560b5a9</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/depd@1.1.2</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/dougwilson/nodejs-depd#readme</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/dougwilson/nodejs-depd/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git+https://github.com/dougwilson/nodejs-depd.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/http-errors@1.7.2">
            <name>http-errors</name>
            <version>1.7.2</version>
            <description>
                <![CDATA[Create HTTP error objects]]>
            </description>
            <hashes>
                <hash alg="SHA-1">4f5029cf13239f31036e5b2e55292bcfbcc85c8f</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/http-errors@1.7.2</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/jshttp/http-errors#readme</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/jshttp/http-errors/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git+https://github.com/jshttp/http-errors.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/inherits@2.0.3">
            <name>inherits</name>
            <version>2.0.3</version>
            <description>
                <![CDATA[Browser-friendly inheritance fully compatible with standard node.js inherits()]]>
            </description>
            <hashes>
                <hash alg="SHA-1">633c2c83e3da42a502f52466022480f4208261de</hash>
            </hashes>
            <licenses>
                <license>
                    <id>ISC</id>
                </license>
            </licenses>
            <purl>pkg:npm/inherits@2.0.3</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/isaacs/inherits#readme</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/isaacs/inherits/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git://github.com/isaacs/inherits.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/setprototypeof@1.1.1">
            <name>setprototypeof</name>
            <version>1.1.1</version>
            <description>
                <![CDATA[A small polyfill for Object.setprototypeof]]>
            </description>
            <hashes>
                <hash alg="SHA-1">7e95acb24aa92f5885e0abef5ba131330d4ae683</hash>
            </hashes>
            <licenses>
                <license>
                    <id>ISC</id>
                </license>
            </licenses>
            <purl>pkg:npm/setprototypeof@1.1.1</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/wesleytodd/setprototypeof</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/wesleytodd/setprototypeof/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git+https://github.com/wesleytodd/setprototypeof.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/statuses@1.5.0">
            <name>statuses</name>
            <version>1.5.0</version>
            <description>
                <![CDATA[HTTP status utility]]>
            </description>
            <hashes>
                <hash alg="SHA-1">161c7dac177659fd9811f43771fa99381478628c</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/statuses@1.5.0</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/jshttp/statuses#readme</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/jshttp/statuses/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git+https://github.com/jshttp/statuses.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/toidentifier@1.0.0">
            <name>toidentifier</name>
            <version>1.0.0</version>
            <description>
                <![CDATA[Convert a string of words to a JavaScript identifier]]>
            </description>
            <hashes>
                <hash alg="SHA-1">7e1be3470f1e77948bc43d94a3c8f4d7752ba553</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/toidentifier@1.0.0</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/component/toidentifier#readme</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/component/toidentifier/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git+https://github.com/component/toidentifier.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/iconv-lite@0.4.24">
            <name>iconv-lite</name>
            <version>0.4.24</version>
            <description>
                <![CDATA[Convert character encodings in pure javascript.]]>
            </description>
            <hashes>
                <hash alg="SHA-1">2022b4b25fbddc21d2f524974a474aafe733908b</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/iconv-lite@0.4.24</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/ashtuchkin/iconv-lite</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/ashtuchkin/iconv-lite/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git://github.com/ashtuchkin/iconv-lite.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/safer-buffer@2.1.2">
            <name>safer-buffer</name>
            <version>2.1.2</version>
            <description>
                <![CDATA[Modern Buffer API polyfill without footguns]]>
            </description>
            <hashes>
                <hash alg="SHA-1">44fa161b0187b9549dd84bb91802f9bd8385cd6a</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/safer-buffer@2.1.2</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/ChALkeR/safer-buffer#readme</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/ChALkeR/safer-buffer/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git+https://github.com/ChALkeR/safer-buffer.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/on-finished@2.3.0">
            <name>on-finished</name>
            <version>2.3.0</version>
            <description>
                <![CDATA[Execute a callback when a request closes, finishes, or errors]]>
            </description>
            <hashes>
                <hash alg="SHA-1">20f1336481b083cd75337992a16971aa2d906947</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/on-finished@2.3.0</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/jshttp/on-finished#readme</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/jshttp/on-finished/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git+https://github.com/jshttp/on-finished.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/ee-first@1.1.1">
            <name>ee-first</name>
            <version>1.1.1</version>
            <description>
                <![CDATA[return the first event in a set of ee/event pairs]]>
            </description>
            <hashes>
                <hash alg="SHA-1">590c61156b0ae2f4f0255732a158b266bc56b21d</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/ee-first@1.1.1</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/jonathanong/ee-first#readme</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/jonathanong/ee-first/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git+https://github.com/jonathanong/ee-first.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/qs@6.7.0">
            <name>qs</name>
            <version>6.7.0</version>
            <description>
                <![CDATA[A querystring parser that supports nesting and arrays, with a depth limit]]>
            </description>
            <hashes>
                <hash alg="SHA-1">41dc1a015e3d581f1621776be31afb2876a9b1bc</hash>
            </hashes>
            <licenses>
                <license>
                    <id>BSD-3-Clause</id>
                </license>
            </licenses>
            <purl>pkg:npm/qs@6.7.0</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/ljharb/qs</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/ljharb/qs/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git+https://github.com/ljharb/qs.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/raw-body@2.4.0">
            <name>raw-body</name>
            <version>2.4.0</version>
            <description>
                <![CDATA[Get and validate the raw body of a readable stream.]]>
            </description>
            <hashes>
                <hash alg="SHA-1">a1ce6fb9c9bc356ca52e89256ab59059e13d0332</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/raw-body@2.4.0</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/stream-utils/raw-body#readme</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/stream-utils/raw-body/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git+https://github.com/stream-utils/raw-body.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/unpipe@1.0.0">
            <name>unpipe</name>
            <version>1.0.0</version>
            <description>
                <![CDATA[Unpipe a stream from all destinations]]>
            </description>
            <hashes>
                <hash alg="SHA-1">b2bf4ee8514aae6165b4817829d21b2ef49904ec</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/unpipe@1.0.0</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/stream-utils/unpipe#readme</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/stream-utils/unpipe/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git+https://github.com/stream-utils/unpipe.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/type-is@1.6.18">
            <name>type-is</name>
            <version>1.6.18</version>
            <description>
                <![CDATA[Infer the content-type of a request.]]>
            </description>
            <hashes>
                <hash alg="SHA-1">4e552cd05df09467dcbc4ef739de89f2cf37c131</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/type-is@1.6.18</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/jshttp/type-is#readme</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/jshttp/type-is/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git+https://github.com/jshttp/type-is.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/media-typer@0.3.0">
            <name>media-typer</name>
            <version>0.3.0</version>
            <description>
                <![CDATA[Simple RFC 6838 media type parser and formatter]]>
            </description>
            <hashes>
                <hash alg="SHA-1">8710d7af0aa626f8fffa1ce00168545263255748</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/media-typer@0.3.0</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/jshttp/media-typer#readme</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/jshttp/media-typer/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git+https://github.com/jshttp/media-typer.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/mime-types@2.1.27">
            <name>mime-types</name>
            <version>2.1.27</version>
            <description>
                <![CDATA[The ultimate javascript content-type utility.]]>
            </description>
            <hashes>
                <hash alg="SHA-1">47949f98e279ea53119f5722e0f34e529bec009f</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/mime-types@2.1.27</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/jshttp/mime-types#readme</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/jshttp/mime-types/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git+https://github.com/jshttp/mime-types.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/mime-db@1.44.0">
            <name>mime-db</name>
            <version>1.44.0</version>
            <description>
                <![CDATA[Media Type Database]]>
            </description>
            <hashes>
                <hash alg="SHA-1">fa11c5eb0aca1334b4233cb4d52f10c5a6272f92</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/mime-db@1.44.0</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/jshttp/mime-db#readme</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/jshttp/mime-db/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git+https://github.com/jshttp/mime-db.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/check-dependencies@1.1.0">
            <name>check-dependencies</name>
            <version>1.1.0</version>
            <description>
                <![CDATA[Checks if currently installed npm/bower dependencies are installed in the exact same versions that are specified in package.json/bower.json]]>
            </description>
            <hashes>
                <hash alg="SHA-1">3aa2df4061770179d8e88e8bf9315c53722ddff4</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/check-dependencies@1.1.0</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/mgol/check-dependencies</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/mgol/check-dependencies/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git+https://github.com/mgol/check-dependencies.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/bower-config@1.4.3">
            <name>bower-config</name>
            <version>1.4.3</version>
            <description>
                <![CDATA[The Bower config reader and writer.]]>
            </description>
            <hashes>
                <hash alg="SHA-1">3454fecdc5f08e7aa9cc6d556e492be0669689ae</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/bower-config@1.4.3</purl>
            <externalReferences>
                <reference type="website">
                    <url>http://bower.io</url>
                </reference>
                <reference type="vcs">
                    <url>https://github.com/bower/bower/tree/master/packages/bower-config</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/graceful-fs@4.2.4">
            <name>graceful-fs</name>
            <version>4.2.4</version>
            <description>
                <![CDATA[A drop-in replacement for fs, making various improvements.]]>
            </description>
            <hashes>
                <hash alg="SHA-1">2256bde14d3632958c465ebc96dc467ca07a29fb</hash>
            </hashes>
            <licenses>
                <license>
                    <id>ISC</id>
                </license>
            </licenses>
            <purl>pkg:npm/graceful-fs@4.2.4</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/isaacs/node-graceful-fs#readme</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/isaacs/node-graceful-fs/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git+https://github.com/isaacs/node-graceful-fs.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/minimist@0.2.1">
            <name>minimist</name>
            <version>0.2.1</version>
            <description>
                <![CDATA[parse argument options]]>
            </description>
            <hashes>
                <hash alg="SHA-1">827ba4e7593464e7c221e8c5bed930904ee2c455</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/minimist@0.2.1</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/substack/minimist</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/substack/minimist/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git://github.com/substack/minimist.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/mout@1.2.2">
            <name>mout</name>
            <version>1.2.2</version>
            <description>
                <![CDATA[Modular Utilities]]>
            </description>
            <hashes>
                <hash alg="SHA-1">c9b718a499806a0632cede178e80f436259e777d</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/mout@1.2.2</purl>
            <externalReferences>
                <reference type="website">
                    <url>http://moutjs.com/</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/mout/mout/issues/</url>
                </reference>
                <reference type="vcs">
                    <url>git://github.com/mout/mout.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/osenv@0.1.5">
            <name>osenv</name>
            <version>0.1.5</version>
            <description>
                <![CDATA[Look up environment settings specific to different operating systems]]>
            </description>
            <hashes>
                <hash alg="SHA-1">85cdfafaeb28e8677f416e287592b5f3f49ea410</hash>
            </hashes>
            <licenses>
                <license>
                    <id>ISC</id>
                </license>
            </licenses>
            <purl>pkg:npm/osenv@0.1.5</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/npm/osenv#readme</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/npm/osenv/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git+https://github.com/npm/osenv.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/os-homedir@1.0.2">
            <name>os-homedir</name>
            <version>1.0.2</version>
            <description>
                <![CDATA[Node.js 4 `os.homedir()` ponyfill]]>
            </description>
            <hashes>
                <hash alg="SHA-1">ffbc4988336e0e833de0c168c7ef152121aa7fb3</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/os-homedir@1.0.2</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/sindresorhus/os-homedir#readme</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/sindresorhus/os-homedir/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git+https://github.com/sindresorhus/os-homedir.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/os-tmpdir@1.0.2">
            <name>os-tmpdir</name>
            <version>1.0.2</version>
            <description>
                <![CDATA[Node.js os.tmpdir() ponyfill]]>
            </description>
            <hashes>
                <hash alg="SHA-1">bbe67406c79aa85c5cfec766fe5734555dfa1274</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/os-tmpdir@1.0.2</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/sindresorhus/os-tmpdir#readme</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/sindresorhus/os-tmpdir/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git+https://github.com/sindresorhus/os-tmpdir.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/untildify@2.1.0">
            <name>untildify</name>
            <version>2.1.0</version>
            <description>
                <![CDATA[Convert a tilde path to an absolute path: ~/dev => /Users/sindresorhus/dev]]>
            </description>
            <hashes>
                <hash alg="SHA-1">17eb2807987f76952e9c0485fc311d06a826a2e0</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/untildify@2.1.0</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/sindresorhus/untildify#readme</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/sindresorhus/untildify/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git+https://github.com/sindresorhus/untildify.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/wordwrap@0.0.3">
            <name>wordwrap</name>
            <version>0.0.3</version>
            <description>
                <![CDATA[Wrap those words. Show them at what columns to start and stop.]]>
            </description>
            <hashes>
                <hash alg="SHA-1">a3d5da6cd5c0bc0008d37234bbaf1bed63059107</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/wordwrap@0.0.3</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/substack/node-wordwrap#readme</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/substack/node-wordwrap/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git://github.com/substack/node-wordwrap.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/chalk@2.4.2">
            <name>chalk</name>
            <version>2.4.2</version>
            <description>
                <![CDATA[Terminal string styling done right]]>
            </description>
            <hashes>
                <hash alg="SHA-1">cd42541677a54333cf541a49108c1432b44c9424</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/chalk@2.4.2</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/chalk/chalk#readme</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/chalk/chalk/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git+https://github.com/chalk/chalk.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/ansi-styles@3.2.1">
            <name>ansi-styles</name>
            <version>3.2.1</version>
            <description>
                <![CDATA[ANSI escape codes for styling strings in the terminal]]>
            </description>
            <hashes>
                <hash alg="SHA-1">41fbb20243e50b12be0f04b8dedbf07520ce841d</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/ansi-styles@3.2.1</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/chalk/ansi-styles#readme</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/chalk/ansi-styles/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git+https://github.com/chalk/ansi-styles.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/color-convert@1.9.3">
            <name>color-convert</name>
            <version>1.9.3</version>
            <description>
                <![CDATA[Plain color conversion functions]]>
            </description>
            <hashes>
                <hash alg="SHA-1">bb71850690e1f136567de629d2d5471deda4c1e8</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/color-convert@1.9.3</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/Qix-/color-convert#readme</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/Qix-/color-convert/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git+https://github.com/Qix-/color-convert.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/color-name@1.1.3">
            <name>color-name</name>
            <version>1.1.3</version>
            <description>
                <![CDATA[A list of color names and its values]]>
            </description>
            <hashes>
                <hash alg="SHA-1">a7d0558bd89c42f795dd42328f740831ca53bc25</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/color-name@1.1.3</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/dfcreative/color-name</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/dfcreative/color-name/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git+ssh://git@github.com/dfcreative/color-name.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/escape-string-regexp@1.0.5">
            <name>escape-string-regexp</name>
            <version>1.0.5</version>
            <description>
                <![CDATA[Escape RegExp special characters]]>
            </description>
            <hashes>
                <hash alg="SHA-1">1b61c0562190a8dff6ae3bb2cf0200ca130b86d4</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/escape-string-regexp@1.0.5</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/sindresorhus/escape-string-regexp#readme</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/sindresorhus/escape-string-regexp/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git+https://github.com/sindresorhus/escape-string-regexp.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/supports-color@5.5.0">
            <name>supports-color</name>
            <version>5.5.0</version>
            <description>
                <![CDATA[Detect whether a terminal supports color]]>
            </description>
            <hashes>
                <hash alg="SHA-1">e2e69a44ac8772f78a1ec0b35b689df6530efc8f</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/supports-color@5.5.0</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/chalk/supports-color#readme</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/chalk/supports-color/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git+https://github.com/chalk/supports-color.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/has-flag@3.0.0">
            <name>has-flag</name>
            <version>3.0.0</version>
            <description>
                <![CDATA[Check if argv has a specific flag]]>
            </description>
            <hashes>
                <hash alg="SHA-1">b5d454dc2199ae225699f3467e5a07f3b955bafd</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/has-flag@3.0.0</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/sindresorhus/has-flag#readme</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/sindresorhus/has-flag/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git+https://github.com/sindresorhus/has-flag.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/findup-sync@2.0.0">
            <name>findup-sync</name>
            <version>2.0.0</version>
            <description>
                <![CDATA[Find the first file matching a given pattern in the current directory or the nearest ancestor directory.]]>
            </description>
            <hashes>
                <hash alg="SHA-1">9326b1488c22d1a6088650a86901b2d9a90a2cbc</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/findup-sync@2.0.0</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/js-cli/node-findup-sync#readme</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/js-cli/node-findup-sync/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git+https://github.com/js-cli/node-findup-sync.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/detect-file@1.0.0">
            <name>detect-file</name>
            <version>1.0.0</version>
            <description>
                <![CDATA[Detects if a file exists and returns the resolved filepath.]]>
            </description>
            <hashes>
                <hash alg="SHA-1">f0d66d03672a825cb1b73bdb3fe62310c8e552b7</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/detect-file@1.0.0</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/doowb/detect-file</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/doowb/detect-file/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git+https://github.com/doowb/detect-file.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/is-glob@3.1.0">
            <name>is-glob</name>
            <version>3.1.0</version>
            <description>
                <![CDATA[Returns `true` if the given string looks like a glob pattern or an extglob pattern. This makes it easy to create code that only uses external modules like node-glob when necessary, resulting in much faster code execution and initialization time, and a better user experience.]]>
            </description>
            <hashes>
                <hash alg="SHA-1">7ba5ae24217804ac70707b96922567486cc3e84a</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/is-glob@3.1.0</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/jonschlinkert/is-glob</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/jonschlinkert/is-glob/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git+https://github.com/jonschlinkert/is-glob.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/is-extglob@2.1.1">
            <name>is-extglob</name>
            <version>2.1.1</version>
            <description>
                <![CDATA[Returns true if a string has an extglob.]]>
            </description>
            <hashes>
                <hash alg="SHA-1">a88c02535791f02ed37c76a1b9ea9773c833f8c2</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/is-extglob@2.1.1</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/jonschlinkert/is-extglob</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/jonschlinkert/is-extglob/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git+https://github.com/jonschlinkert/is-extglob.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/micromatch@3.1.10">
            <name>micromatch</name>
            <version>3.1.10</version>
            <description>
                <![CDATA[Glob matching for javascript/node.js. A drop-in replacement and faster alternative to minimatch and multimatch.]]>
            </description>
            <hashes>
                <hash alg="SHA-1">70859bc95c9840952f359a068a3fc49f9ecfac23</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/micromatch@3.1.10</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/micromatch/micromatch</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/micromatch/micromatch/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git+https://github.com/micromatch/micromatch.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/arr-diff@4.0.0">
            <name>arr-diff</name>
            <version>4.0.0</version>
            <description>
                <![CDATA[Returns an array with only the unique values from the first array, by excluding all values from additional arrays using strict equality for comparisons.]]>
            </description>
            <hashes>
                <hash alg="SHA-1">d6461074febfec71e7e15235761a329a5dc7c520</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/arr-diff@4.0.0</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/jonschlinkert/arr-diff</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/jonschlinkert/arr-diff/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git+https://github.com/jonschlinkert/arr-diff.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/array-unique@0.3.2">
            <name>array-unique</name>
            <version>0.3.2</version>
            <description>
                <![CDATA[Remove duplicate values from an array. Fastest ES5 implementation.]]>
            </description>
            <hashes>
                <hash alg="SHA-1">a894b75d4bc4f6cd679ef3244a9fd8f46ae2d428</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/array-unique@0.3.2</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/jonschlinkert/array-unique</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/jonschlinkert/array-unique/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git+https://github.com/jonschlinkert/array-unique.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/braces@2.3.2">
            <name>braces</name>
            <version>2.3.2</version>
            <description>
                <![CDATA[Bash-like brace expansion, implemented in JavaScript. Safer than other brace expansion libs, with complete support for the Bash 4.3 braces specification, without sacrificing speed.]]>
            </description>
            <hashes>
                <hash alg="SHA-1">5979fd3f14cd531565e5fa2df1abfff1dfaee729</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/braces@2.3.2</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/micromatch/braces</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/micromatch/braces/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git+https://github.com/micromatch/braces.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/arr-flatten@1.1.0">
            <name>arr-flatten</name>
            <version>1.1.0</version>
            <description>
                <![CDATA[Recursively flatten an array or arrays.]]>
            </description>
            <hashes>
                <hash alg="SHA-1">36048bbff4e7b47e136644316c99669ea5ae91f1</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/arr-flatten@1.1.0</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/jonschlinkert/arr-flatten</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/jonschlinkert/arr-flatten/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git+https://github.com/jonschlinkert/arr-flatten.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/extend-shallow@2.0.1">
            <name>extend-shallow</name>
            <version>2.0.1</version>
            <description>
                <![CDATA[Extend an object with the properties of additional objects. node.js/javascript util.]]>
            </description>
            <hashes>
                <hash alg="SHA-1">51af7d614ad9a9f610ea1bafbb989d6b1c56890f</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/extend-shallow@2.0.1</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/jonschlinkert/extend-shallow</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/jonschlinkert/extend-shallow/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git+https://github.com/jonschlinkert/extend-shallow.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/is-extendable@0.1.1">
            <name>is-extendable</name>
            <version>0.1.1</version>
            <description>
                <![CDATA[Returns true if a value is any of the object types: array, regexp, plain object, function or date. This is useful for determining if a value can be extended, e.g. "can the value have keys?"]]>
            </description>
            <hashes>
                <hash alg="SHA-1">62b110e289a471418e3ec36a617d472e301dfc89</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/is-extendable@0.1.1</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/jonschlinkert/is-extendable</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/jonschlinkert/is-extendable/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git+https://github.com/jonschlinkert/is-extendable.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/fill-range@4.0.0">
            <name>fill-range</name>
            <version>4.0.0</version>
            <description>
                <![CDATA[Fill in a range of numbers or letters, optionally passing an increment or `step` to use, or create a regex-compatible range with `options.toRegex`]]>
            </description>
            <hashes>
                <hash alg="SHA-1">d544811d428f98eb06a63dc402d2403c328c38f7</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/fill-range@4.0.0</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/jonschlinkert/fill-range</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/jonschlinkert/fill-range/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git+https://github.com/jonschlinkert/fill-range.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/is-number@3.0.0">
            <name>is-number</name>
            <version>3.0.0</version>
            <description>
                <![CDATA[Returns true if the value is a number. comprehensive tests.]]>
            </description>
            <hashes>
                <hash alg="SHA-1">24fd6201a4782cf50561c810276afc7d12d71195</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/is-number@3.0.0</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/jonschlinkert/is-number</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/jonschlinkert/is-number/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git+https://github.com/jonschlinkert/is-number.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/kind-of@3.2.2">
            <name>kind-of</name>
            <version>3.2.2</version>
            <description>
                <![CDATA[Get the native type of a value.]]>
            </description>
            <hashes>
                <hash alg="SHA-1">31ea21a734bab9bbb0f32466d893aea51e4a3c64</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/kind-of@3.2.2</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/jonschlinkert/kind-of</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/jonschlinkert/kind-of/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git+https://github.com/jonschlinkert/kind-of.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/is-buffer@1.1.6">
            <name>is-buffer</name>
            <version>1.1.6</version>
            <description>
                <![CDATA[Determine if an object is a Buffer]]>
            </description>
            <hashes>
                <hash alg="SHA-1">efaa2ea9daa0d7ab2ea13a97b2b8ad51fefbe8be</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/is-buffer@1.1.6</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/feross/is-buffer#readme</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/feross/is-buffer/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git://github.com/feross/is-buffer.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/repeat-string@1.6.1">
            <name>repeat-string</name>
            <version>1.6.1</version>
            <description>
                <![CDATA[Repeat the given string n times. Fastest implementation for repeating a string.]]>
            </description>
            <hashes>
                <hash alg="SHA-1">8dcae470e1c88abc2d600fff4a776286da75e637</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/repeat-string@1.6.1</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/jonschlinkert/repeat-string</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/jonschlinkert/repeat-string/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git+https://github.com/jonschlinkert/repeat-string.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/to-regex-range@2.1.1">
            <name>to-regex-range</name>
            <version>2.1.1</version>
            <description>
                <![CDATA[Pass two numbers, get a regex-compatible source string for matching ranges. Validated against more than 2.78 million test assertions.]]>
            </description>
            <hashes>
                <hash alg="SHA-1">7c80c17b9dfebe599e27367e0d4dd5590141db38</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/to-regex-range@2.1.1</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/micromatch/to-regex-range</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/micromatch/to-regex-range/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git+https://github.com/micromatch/to-regex-range.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/isobject@3.0.1">
            <name>isobject</name>
            <version>3.0.1</version>
            <description>
                <![CDATA[Returns true if the value is an object and not an array or null.]]>
            </description>
            <hashes>
                <hash alg="SHA-1">4e431e92b11a9731636aa1f9c8d1ccbcfdab78df</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/isobject@3.0.1</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/jonschlinkert/isobject</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/jonschlinkert/isobject/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git+https://github.com/jonschlinkert/isobject.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/repeat-element@1.1.3">
            <name>repeat-element</name>
            <version>1.1.3</version>
            <description>
                <![CDATA[Create an array by repeating the given value n times.]]>
            </description>
            <hashes>
                <hash alg="SHA-1">782e0d825c0c5a3bb39731f84efee6b742e6b1ce</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/repeat-element@1.1.3</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/jonschlinkert/repeat-element</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/jonschlinkert/repeat-element/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git+https://github.com/jonschlinkert/repeat-element.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/snapdragon@0.8.2">
            <name>snapdragon</name>
            <version>0.8.2</version>
            <description>
                <![CDATA[Fast, pluggable and easy-to-use parser-renderer factory.]]>
            </description>
            <hashes>
                <hash alg="SHA-1">64922e7c565b0e14204ba1aa7d6964278d25182d</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/snapdragon@0.8.2</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/jonschlinkert/snapdragon</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/jonschlinkert/snapdragon/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git+https://github.com/jonschlinkert/snapdragon.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/base@0.11.2">
            <name>base</name>
            <version>0.11.2</version>
            <description>
                <![CDATA[base is the foundation for creating modular, unit testable and highly pluggable node.js applications, starting with a handful of common methods, like `set`, `get`, `del` and `use`.]]>
            </description>
            <hashes>
                <hash alg="SHA-1">7bde5ced145b6d551a90db87f83c558b4eb48a8f</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/base@0.11.2</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/node-base/base</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/node-base/base/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git+https://github.com/node-base/base.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/cache-base@1.0.1">
            <name>cache-base</name>
            <version>1.0.1</version>
            <description>
                <![CDATA[Basic object cache with `get`, `set`, `del`, and `has` methods for node.js/javascript projects.]]>
            </description>
            <hashes>
                <hash alg="SHA-1">0a7f46416831c8b662ee36fe4e7c59d76f666ab2</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/cache-base@1.0.1</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/jonschlinkert/cache-base</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/jonschlinkert/cache-base/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git+https://github.com/jonschlinkert/cache-base.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/collection-visit@1.0.0">
            <name>collection-visit</name>
            <version>1.0.0</version>
            <description>
                <![CDATA[Visit a method over the items in an object, or map visit over the objects in an array.]]>
            </description>
            <hashes>
                <hash alg="SHA-1">4bc0373c164bc3291b4d368c829cf1a80a59dca0</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/collection-visit@1.0.0</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/jonschlinkert/collection-visit</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/jonschlinkert/collection-visit/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git+https://github.com/jonschlinkert/collection-visit.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/map-visit@1.0.0">
            <name>map-visit</name>
            <version>1.0.0</version>
            <description>
                <![CDATA[Map `visit` over an array of objects.]]>
            </description>
            <hashes>
                <hash alg="SHA-1">ecdca8f13144e660f1b5bd41f12f3479d98dfb8f</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/map-visit@1.0.0</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/jonschlinkert/map-visit</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/jonschlinkert/map-visit/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git+https://github.com/jonschlinkert/map-visit.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/object-visit@1.0.1">
            <name>object-visit</name>
            <version>1.0.1</version>
            <description>
                <![CDATA[Call a specified method on each value in the given object.]]>
            </description>
            <hashes>
                <hash alg="SHA-1">f79c4493af0c5377b59fe39d395e41042dd045bb</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/object-visit@1.0.1</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/jonschlinkert/object-visit</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/jonschlinkert/object-visit/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git+https://github.com/jonschlinkert/object-visit.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/component-emitter@1.3.0">
            <name>component-emitter</name>
            <version>1.3.0</version>
            <description>
                <![CDATA[Event emitter]]>
            </description>
            <hashes>
                <hash alg="SHA-1">16e4070fba8ae29b679f2215853ee181ab2eabc0</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/component-emitter@1.3.0</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/component/emitter#readme</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/component/emitter/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git+https://github.com/component/emitter.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/get-value@2.0.6">
            <name>get-value</name>
            <version>2.0.6</version>
            <description>
                <![CDATA[Use property paths (`a.b.c`) to get a nested value from an object.]]>
            </description>
            <hashes>
                <hash alg="SHA-1">dc15ca1c672387ca76bd37ac0a395ba2042a2c28</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/get-value@2.0.6</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/jonschlinkert/get-value</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/jonschlinkert/get-value/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git+https://github.com/jonschlinkert/get-value.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/has-value@1.0.0">
            <name>has-value</name>
            <version>1.0.0</version>
            <description>
                <![CDATA[Returns true if a value exists, false if empty. Works with deeply nested values using object paths.]]>
            </description>
            <hashes>
                <hash alg="SHA-1">18b281da585b1c5c51def24c930ed29a0be6b177</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/has-value@1.0.0</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/jonschlinkert/has-value</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/jonschlinkert/has-value/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git+https://github.com/jonschlinkert/has-value.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/has-values@1.0.0">
            <name>has-values</name>
            <version>1.0.0</version>
            <description>
                <![CDATA[Returns true if any values exist, false if empty. Works for booleans, functions, numbers, strings, nulls, objects and arrays. ]]>
            </description>
            <hashes>
                <hash alg="SHA-1">95b0b63fec2146619a6fe57fe75628d5a39efe4f</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/has-values@1.0.0</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/jonschlinkert/has-values</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/jonschlinkert/has-values/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git+https://github.com/jonschlinkert/has-values.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/kind-of@4.0.0">
            <name>kind-of</name>
            <version>4.0.0</version>
            <description>
                <![CDATA[Get the native type of a value.]]>
            </description>
            <hashes>
                <hash alg="SHA-1">20813df3d712928b207378691a45066fae72dd57</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/kind-of@4.0.0</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/jonschlinkert/kind-of</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/jonschlinkert/kind-of/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git+https://github.com/jonschlinkert/kind-of.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/set-value@2.0.1">
            <name>set-value</name>
            <version>2.0.1</version>
            <description>
                <![CDATA[Create nested values and any intermediaries using dot notation (`'a.b.c'`) paths.]]>
            </description>
            <hashes>
                <hash alg="SHA-1">a18d40530e6f07de4228c7defe4227af8cad005b</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/set-value@2.0.1</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/jonschlinkert/set-value</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/jonschlinkert/set-value/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git+https://github.com/jonschlinkert/set-value.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/is-plain-object@2.0.4">
            <name>is-plain-object</name>
            <version>2.0.4</version>
            <description>
                <![CDATA[Returns true if an object was created by the `Object` constructor.]]>
            </description>
            <hashes>
                <hash alg="SHA-1">2c163b3fafb1b606d9d17928f05c2a1c38e07677</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/is-plain-object@2.0.4</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/jonschlinkert/is-plain-object</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/jonschlinkert/is-plain-object/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git+https://github.com/jonschlinkert/is-plain-object.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/split-string@3.1.0">
            <name>split-string</name>
            <version>3.1.0</version>
            <description>
                <![CDATA[Split a string on a character except when the character is escaped.]]>
            </description>
            <hashes>
                <hash alg="SHA-1">7cb09dda3a86585705c64b39a6466038682e8fe2</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/split-string@3.1.0</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/jonschlinkert/split-string</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/jonschlinkert/split-string/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git+https://github.com/jonschlinkert/split-string.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/extend-shallow@3.0.2">
            <name>extend-shallow</name>
            <version>3.0.2</version>
            <description>
                <![CDATA[Extend an object with the properties of additional objects. node.js/javascript util.]]>
            </description>
            <hashes>
                <hash alg="SHA-1">26a71aaf073b39fb2127172746131c2704028db8</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/extend-shallow@3.0.2</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/jonschlinkert/extend-shallow</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/jonschlinkert/extend-shallow/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git+https://github.com/jonschlinkert/extend-shallow.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/assign-symbols@1.0.0">
            <name>assign-symbols</name>
            <version>1.0.0</version>
            <description>
                <![CDATA[Assign the enumerable es6 Symbol properties from an object (or objects) to the first object passed on the arguments. Can be used as a supplement to other extend, assign or merge methods as a polyfill for the Symbols part of the es6 Object.assign method.]]>
            </description>
            <hashes>
                <hash alg="SHA-1">59667f41fadd4f20ccbc2bb96b8d4f7f78ec0367</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/assign-symbols@1.0.0</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/jonschlinkert/assign-symbols</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/jonschlinkert/assign-symbols/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git+https://github.com/jonschlinkert/assign-symbols.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/is-extendable@1.0.1">
            <name>is-extendable</name>
            <version>1.0.1</version>
            <description>
                <![CDATA[Returns true if a value is a plain object, array or function.]]>
            </description>
            <hashes>
                <hash alg="SHA-1">a7470f9e426733d81bd81e1155264e3a3507cab4</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/is-extendable@1.0.1</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/jonschlinkert/is-extendable</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/jonschlinkert/is-extendable/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git+https://github.com/jonschlinkert/is-extendable.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/to-object-path@0.3.0">
            <name>to-object-path</name>
            <version>0.3.0</version>
            <description>
                <![CDATA[Create an object path from a list or array of strings.]]>
            </description>
            <hashes>
                <hash alg="SHA-1">297588b7b0e7e0ac08e04e672f85c1f4999e17af</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/to-object-path@0.3.0</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/jonschlinkert/to-object-path</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/jonschlinkert/to-object-path/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git+https://github.com/jonschlinkert/to-object-path.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/union-value@1.0.1">
            <name>union-value</name>
            <version>1.0.1</version>
            <description>
                <![CDATA[Set an array of unique values as the property of an object. Supports setting deeply nested properties using using object-paths/dot notation.]]>
            </description>
            <hashes>
                <hash alg="SHA-1">0b6fe7b835aecda61c6ea4d4f02c14221e109847</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/union-value@1.0.1</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/jonschlinkert/union-value</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/jonschlinkert/union-value/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git+https://github.com/jonschlinkert/union-value.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/arr-union@3.1.0">
            <name>arr-union</name>
            <version>3.1.0</version>
            <description>
                <![CDATA[Combines a list of arrays, returning a single array with unique values, using strict equality for comparisons.]]>
            </description>
            <hashes>
                <hash alg="SHA-1">e39b09aea9def866a8f206e288af63919bae39c4</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/arr-union@3.1.0</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/jonschlinkert/arr-union</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/jonschlinkert/arr-union/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git+https://github.com/jonschlinkert/arr-union.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/unset-value@1.0.0">
            <name>unset-value</name>
            <version>1.0.0</version>
            <description>
                <![CDATA[Delete nested properties from an object using dot notation.]]>
            </description>
            <hashes>
                <hash alg="SHA-1">8376873f7d2335179ffb1e6fc3a8ed0dfc8ab559</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/unset-value@1.0.0</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/jonschlinkert/unset-value</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/jonschlinkert/unset-value/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git+https://github.com/jonschlinkert/unset-value.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/has-value@0.3.1">
            <name>has-value</name>
            <version>0.3.1</version>
            <description>
                <![CDATA[Returns true if a value exists, false if empty. Works with deeply nested values using object paths.]]>
            </description>
            <hashes>
                <hash alg="SHA-1">7b1f58bada62ca827ec0a2078025654845995e1f</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/has-value@0.3.1</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/jonschlinkert/has-value</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/jonschlinkert/has-value/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git+https://github.com/jonschlinkert/has-value.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/has-values@0.1.4">
            <name>has-values</name>
            <version>0.1.4</version>
            <description>
                <![CDATA[Returns true if any values exist, false if empty. Works for booleans, functions, numbers, strings, nulls, objects and arrays. ]]>
            </description>
            <hashes>
                <hash alg="SHA-1">6d61de95d91dfca9b9a02089ad384bff8f62b771</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/has-values@0.1.4</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/jonschlinkert/has-values</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/jonschlinkert/has-values/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git+https://github.com/jonschlinkert/has-values.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/isobject@2.1.0">
            <name>isobject</name>
            <version>2.1.0</version>
            <description>
                <![CDATA[Returns true if the value is an object and not an array or null.]]>
            </description>
            <hashes>
                <hash alg="SHA-1">f065561096a3f1da2ef46272f815c840d87e0c89</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/isobject@2.1.0</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/jonschlinkert/isobject</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/jonschlinkert/isobject/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git+https://github.com/jonschlinkert/isobject.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/isarray@1.0.0">
            <name>isarray</name>
            <version>1.0.0</version>
            <description>
                <![CDATA[Array#isArray for older browsers]]>
            </description>
            <hashes>
                <hash alg="SHA-1">bb935d48582cba168c06834957a54a3e07124f11</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/isarray@1.0.0</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/juliangruber/isarray</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/juliangruber/isarray/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git://github.com/juliangruber/isarray.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/class-utils@0.3.6">
            <name>class-utils</name>
            <version>0.3.6</version>
            <description>
                <![CDATA[Utils for working with JavaScript classes and prototype methods.]]>
            </description>
            <hashes>
                <hash alg="SHA-1">f93369ae8b9a7ce02fd41faad0ca83033190c463</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/class-utils@0.3.6</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/jonschlinkert/class-utils</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/jonschlinkert/class-utils/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git+https://github.com/jonschlinkert/class-utils.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/define-property@0.2.5">
            <name>define-property</name>
            <version>0.2.5</version>
            <description>
                <![CDATA[Define a non-enumerable property on an object.]]>
            </description>
            <hashes>
                <hash alg="SHA-1">c35b1ef918ec3c990f9a5bc57be04aacec5c8116</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/define-property@0.2.5</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/jonschlinkert/define-property</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/jonschlinkert/define-property/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git+https://github.com/jonschlinkert/define-property.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/is-descriptor@0.1.6">
            <name>is-descriptor</name>
            <version>0.1.6</version>
            <description>
                <![CDATA[Returns true if a value has the characteristics of a valid JavaScript descriptor. Works for data descriptors and accessor descriptors.]]>
            </description>
            <hashes>
                <hash alg="SHA-1">366d8240dde487ca51823b1ab9f07a10a78251ca</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/is-descriptor@0.1.6</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/jonschlinkert/is-descriptor</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/jonschlinkert/is-descriptor/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git+https://github.com/jonschlinkert/is-descriptor.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/is-accessor-descriptor@0.1.6">
            <name>is-accessor-descriptor</name>
            <version>0.1.6</version>
            <description>
                <![CDATA[Returns true if a value has the characteristics of a valid JavaScript accessor descriptor.]]>
            </description>
            <hashes>
                <hash alg="SHA-1">a9e12cb3ae8d876727eeef3843f8a0897b5c98d6</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/is-accessor-descriptor@0.1.6</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/jonschlinkert/is-accessor-descriptor</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/jonschlinkert/is-accessor-descriptor/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git+https://github.com/jonschlinkert/is-accessor-descriptor.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/is-data-descriptor@0.1.4">
            <name>is-data-descriptor</name>
            <version>0.1.4</version>
            <description>
                <![CDATA[Returns true if a value has the characteristics of a valid JavaScript data descriptor.]]>
            </description>
            <hashes>
                <hash alg="SHA-1">0b5ee648388e2c860282e793f1856fec3f301b56</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/is-data-descriptor@0.1.4</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/jonschlinkert/is-data-descriptor</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/jonschlinkert/is-data-descriptor/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git+https://github.com/jonschlinkert/is-data-descriptor.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/kind-of@5.1.0">
            <name>kind-of</name>
            <version>5.1.0</version>
            <description>
                <![CDATA[Get the native type of a value.]]>
            </description>
            <hashes>
                <hash alg="SHA-1">729c91e2d857b7a419a1f9aa65685c4c33f5845d</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/kind-of@5.1.0</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/jonschlinkert/kind-of</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/jonschlinkert/kind-of/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git+https://github.com/jonschlinkert/kind-of.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/static-extend@0.1.2">
            <name>static-extend</name>
            <version>0.1.2</version>
            <description>
                <![CDATA[Adds a static `extend` method to a class, to simplify inheritance. Extends the static properties, prototype properties, and descriptors from a `Parent` constructor onto `Child` constructors.]]>
            </description>
            <hashes>
                <hash alg="SHA-1">60809c39cbff55337226fd5e0b520f341f1fb5c6</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/static-extend@0.1.2</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/jonschlinkert/static-extend</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/jonschlinkert/static-extend/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git+https://github.com/jonschlinkert/static-extend.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/object-copy@0.1.0">
            <name>object-copy</name>
            <version>0.1.0</version>
            <description>
                <![CDATA[Copy static properties, prototype properties, and descriptors from one object to another.]]>
            </description>
            <hashes>
                <hash alg="SHA-1">7e7d858b781bd7c991a41ba975ed3812754e998c</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/object-copy@0.1.0</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/jonschlinkert/object-copy</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/jonschlinkert/object-copy/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git+https://github.com/jonschlinkert/object-copy.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/copy-descriptor@0.1.1">
            <name>copy-descriptor</name>
            <version>0.1.1</version>
            <description>
                <![CDATA[Copy a descriptor from object A to object B]]>
            </description>
            <hashes>
                <hash alg="SHA-1">676f6eb3c39997c2ee1ac3a924fd6124748f578d</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/copy-descriptor@0.1.1</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/jonschlinkert/copy-descriptor</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/jonschlinkert/copy-descriptor/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git+https://github.com/jonschlinkert/copy-descriptor.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/define-property@1.0.0">
            <name>define-property</name>
            <version>1.0.0</version>
            <description>
                <![CDATA[Define a non-enumerable property on an object.]]>
            </description>
            <hashes>
                <hash alg="SHA-1">769ebaaf3f4a63aad3af9e8d304c9bbe79bfb0e6</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/define-property@1.0.0</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/jonschlinkert/define-property</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/jonschlinkert/define-property/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git+https://github.com/jonschlinkert/define-property.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/is-descriptor@1.0.2">
            <name>is-descriptor</name>
            <version>1.0.2</version>
            <description>
                <![CDATA[Returns true if a value has the characteristics of a valid JavaScript descriptor. Works for data descriptors and accessor descriptors.]]>
            </description>
            <hashes>
                <hash alg="SHA-1">3b159746a66604b04f8c81524ba365c5f14d86ec</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/is-descriptor@1.0.2</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/jonschlinkert/is-descriptor</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/jonschlinkert/is-descriptor/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git+https://github.com/jonschlinkert/is-descriptor.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/is-accessor-descriptor@1.0.0">
            <name>is-accessor-descriptor</name>
            <version>1.0.0</version>
            <description>
                <![CDATA[Returns true if a value has the characteristics of a valid JavaScript accessor descriptor.]]>
            </description>
            <hashes>
                <hash alg="SHA-1">169c2f6d3df1f992618072365c9b0ea1f6878656</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/is-accessor-descriptor@1.0.0</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/jonschlinkert/is-accessor-descriptor</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/jonschlinkert/is-accessor-descriptor/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git+https://github.com/jonschlinkert/is-accessor-descriptor.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/kind-of@6.0.3">
            <name>kind-of</name>
            <version>6.0.3</version>
            <description>
                <![CDATA[Get the native type of a value.]]>
            </description>
            <hashes>
                <hash alg="SHA-1">07c05034a6c349fa06e24fa35aa76db4580ce4dd</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/kind-of@6.0.3</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/jonschlinkert/kind-of</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/jonschlinkert/kind-of/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git+https://github.com/jonschlinkert/kind-of.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/is-data-descriptor@1.0.0">
            <name>is-data-descriptor</name>
            <version>1.0.0</version>
            <description>
                <![CDATA[Returns true if a value has the characteristics of a valid JavaScript data descriptor.]]>
            </description>
            <hashes>
                <hash alg="SHA-1">d84876321d0e7add03990406abbbbd36ba9268c7</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/is-data-descriptor@1.0.0</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/jonschlinkert/is-data-descriptor</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/jonschlinkert/is-data-descriptor/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git+https://github.com/jonschlinkert/is-data-descriptor.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/mixin-deep@1.3.2">
            <name>mixin-deep</name>
            <version>1.3.2</version>
            <description>
                <![CDATA[Deeply mix the properties of objects into the first object. Like merge-deep, but doesn't clone.]]>
            </description>
            <hashes>
                <hash alg="SHA-1">1120b43dc359a785dce65b55b82e257ccf479566</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/mixin-deep@1.3.2</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/jonschlinkert/mixin-deep</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/jonschlinkert/mixin-deep/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git+https://github.com/jonschlinkert/mixin-deep.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/for-in@1.0.2">
            <name>for-in</name>
            <version>1.0.2</version>
            <description>
                <![CDATA[Iterate over the own and inherited enumerable properties of an object, and return an object with properties that evaluate to true from the callback. Exit early by returning `false`. JavaScript/Node.js]]>
            </description>
            <hashes>
                <hash alg="SHA-1">81068d295a8142ec0ac726c6e2200c30fb6d5e80</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/for-in@1.0.2</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/jonschlinkert/for-in</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/jonschlinkert/for-in/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git+https://github.com/jonschlinkert/for-in.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/pascalcase@0.1.1">
            <name>pascalcase</name>
            <version>0.1.1</version>
            <description>
                <![CDATA[Convert a string to pascal-case.]]>
            </description>
            <hashes>
                <hash alg="SHA-1">b363e55e8006ca6fe21784d2db22bd15d7917f14</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/pascalcase@0.1.1</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/jonschlinkert/pascalcase</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/jonschlinkert/pascalcase/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git+https://github.com/jonschlinkert/pascalcase.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/map-cache@0.2.2">
            <name>map-cache</name>
            <version>0.2.2</version>
            <description>
                <![CDATA[Basic cache object for storing key-value pairs.]]>
            </description>
            <hashes>
                <hash alg="SHA-1">c32abd0bd6525d9b051645bb4f26ac5dc98a0dbf</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/map-cache@0.2.2</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/jonschlinkert/map-cache</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/jonschlinkert/map-cache/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git+https://github.com/jonschlinkert/map-cache.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/source-map@0.5.7">
            <name>source-map</name>
            <version>0.5.7</version>
            <description>
                <![CDATA[Generates and consumes source maps]]>
            </description>
            <hashes>
                <hash alg="SHA-1">8a039d2d1021d22d1ea14c80d8ea468ba2ef3fcc</hash>
            </hashes>
            <licenses>
                <license>
                    <id>BSD-3-Clause</id>
                </license>
            </licenses>
            <purl>pkg:npm/source-map@0.5.7</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/mozilla/source-map</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/mozilla/source-map/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git+ssh://git@github.com/mozilla/source-map.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/source-map-resolve@0.5.3">
            <name>source-map-resolve</name>
            <version>0.5.3</version>
            <description>
                <![CDATA[Resolve the source map and/or sources for a generated file.]]>
            </description>
            <hashes>
                <hash alg="SHA-1">190866bece7553e1f8f267a2ee82c606b5509a1a</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/source-map-resolve@0.5.3</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/lydell/source-map-resolve#readme</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/lydell/source-map-resolve/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git+https://github.com/lydell/source-map-resolve.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/atob@2.1.2">
            <name>atob</name>
            <version>2.1.2</version>
            <description>
                <![CDATA[atob for Node.JS and Linux / Mac / Windows CLI (it's a one-liner)]]>
            </description>
            <hashes>
                <hash alg="SHA-1">6d9517eb9e030d2436666651e86bd9f6f13533c9</hash>
            </hashes>
            <licenses>
                <license>
                    <name>(MIT OR Apache-2.0)</name>
                </license>
            </licenses>
            <purl>pkg:npm/atob@2.1.2</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://git.coolaj86.com/coolaj86/atob.js.git</url>
                </reference>
                <reference type="vcs">
                    <url>git://git.coolaj86.com/coolaj86/atob.js.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/decode-uri-component@0.2.0">
            <name>decode-uri-component</name>
            <version>0.2.0</version>
            <description>
                <![CDATA[A better decodeURIComponent]]>
            </description>
            <hashes>
                <hash alg="SHA-1">eb3913333458775cb84cd1a1fae062106bb87545</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/decode-uri-component@0.2.0</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/SamVerschueren/decode-uri-component#readme</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/SamVerschueren/decode-uri-component/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git+https://github.com/SamVerschueren/decode-uri-component.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/resolve-url@0.2.1">
            <name>resolve-url</name>
            <version>0.2.1</version>
            <description>
                <![CDATA[Like Node.js’ `path.resolve`/`url.resolve` for the browser.]]>
            </description>
            <hashes>
                <hash alg="SHA-1">2c637fe77c893afd2a663fe21aa9080068e2052a</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/resolve-url@0.2.1</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/lydell/resolve-url#readme</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/lydell/resolve-url/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git+https://github.com/lydell/resolve-url.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/source-map-url@0.4.0">
            <name>source-map-url</name>
            <version>0.4.0</version>
            <description>
                <![CDATA[Tools for working with sourceMappingURL comments.]]>
            </description>
            <hashes>
                <hash alg="SHA-1">3e935d7ddd73631b97659956d55128e87b5084a3</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/source-map-url@0.4.0</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/lydell/source-map-url#readme</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/lydell/source-map-url/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git+https://github.com/lydell/source-map-url.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/urix@0.1.0">
            <name>urix</name>
            <version>0.1.0</version>
            <description>
                <![CDATA[Makes Windows-style paths more unix and URI friendly.]]>
            </description>
            <hashes>
                <hash alg="SHA-1">da937f7a62e21fec1fd18d49b35c2935067a6c72</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/urix@0.1.0</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/lydell/urix#readme</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/lydell/urix/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git+https://github.com/lydell/urix.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/use@3.1.1">
            <name>use</name>
            <version>3.1.1</version>
            <description>
                <![CDATA[Easily add plugin support to your node.js application.]]>
            </description>
            <hashes>
                <hash alg="SHA-1">d50c8cac79a19fbc20f2911f56eb973f4e10070f</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/use@3.1.1</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/jonschlinkert/use</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/jonschlinkert/use/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git+https://github.com/jonschlinkert/use.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/snapdragon-node@2.1.1">
            <name>snapdragon-node</name>
            <version>2.1.1</version>
            <description>
                <![CDATA[Snapdragon utility for creating a new AST node in custom code, such as plugins.]]>
            </description>
            <hashes>
                <hash alg="SHA-1">6c175f86ff14bdb0724563e8f3c1b021a286853b</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/snapdragon-node@2.1.1</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/jonschlinkert/snapdragon-node</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/jonschlinkert/snapdragon-node/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git+https://github.com/jonschlinkert/snapdragon-node.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/snapdragon-util@3.0.1">
            <name>snapdragon-util</name>
            <version>3.0.1</version>
            <description>
                <![CDATA[Utilities for the snapdragon parser/compiler.]]>
            </description>
            <hashes>
                <hash alg="SHA-1">f956479486f2acd79700693f6f7b805e45ab56e2</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/snapdragon-util@3.0.1</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/jonschlinkert/snapdragon-util</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/jonschlinkert/snapdragon-util/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git+https://github.com/jonschlinkert/snapdragon-util.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/to-regex@3.0.2">
            <name>to-regex</name>
            <version>3.0.2</version>
            <description>
                <![CDATA[Generate a regex from a string or array of strings.]]>
            </description>
            <hashes>
                <hash alg="SHA-1">13cfdd9b336552f30b51f33a8ae1b42a7a7599ce</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/to-regex@3.0.2</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/jonschlinkert/to-regex</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/jonschlinkert/to-regex/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git+https://github.com/jonschlinkert/to-regex.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/define-property@2.0.2">
            <name>define-property</name>
            <version>2.0.2</version>
            <description>
                <![CDATA[Define a non-enumerable property on an object. Uses Reflect.defineProperty when available, otherwise Object.defineProperty.]]>
            </description>
            <hashes>
                <hash alg="SHA-1">d459689e8d654ba77e02a817f8710d702cb16e9d</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/define-property@2.0.2</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/jonschlinkert/define-property</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/jonschlinkert/define-property/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git+https://github.com/jonschlinkert/define-property.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/regex-not@1.0.2">
            <name>regex-not</name>
            <version>1.0.2</version>
            <description>
                <![CDATA[Create a javascript regular expression for matching everything except for the given string.]]>
            </description>
            <hashes>
                <hash alg="SHA-1">1f4ece27e00b0b65e0247a6810e6a85d83a5752c</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/regex-not@1.0.2</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/jonschlinkert/regex-not</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/jonschlinkert/regex-not/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git+https://github.com/jonschlinkert/regex-not.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/safe-regex@1.1.0">
            <name>safe-regex</name>
            <version>1.1.0</version>
            <description>
                <![CDATA[detect possibly catastrophic, exponential-time regular expressions]]>
            </description>
            <hashes>
                <hash alg="SHA-1">40a3669f3b077d1e943d44629e157dd48023bf2e</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/safe-regex@1.1.0</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/substack/safe-regex</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/substack/safe-regex/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git://github.com/substack/safe-regex.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/ret@0.1.15">
            <name>ret</name>
            <version>0.1.15</version>
            <description>
                <![CDATA[Tokenizes a string that represents a regular expression.]]>
            </description>
            <hashes>
                <hash alg="SHA-1">b8a4825d5bdb1fc3f6f53c2bc33f81388681c7bc</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/ret@0.1.15</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/fent/ret.js#readme</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/fent/ret.js/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git://github.com/fent/ret.js.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/extglob@2.0.4">
            <name>extglob</name>
            <version>2.0.4</version>
            <description>
                <![CDATA[Extended glob support for JavaScript. Adds (almost) the expressive power of regular expressions to glob patterns.]]>
            </description>
            <hashes>
                <hash alg="SHA-1">ad00fe4dc612a9232e8718711dc5cb5ab0285543</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/extglob@2.0.4</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/micromatch/extglob</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/micromatch/extglob/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git+https://github.com/micromatch/extglob.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/expand-brackets@2.1.4">
            <name>expand-brackets</name>
            <version>2.1.4</version>
            <description>
                <![CDATA[Expand POSIX bracket expressions (character classes) in glob patterns.]]>
            </description>
            <hashes>
                <hash alg="SHA-1">b77735e315ce30f6b6eff0f83b04151a22449622</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/expand-brackets@2.1.4</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/jonschlinkert/expand-brackets</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/jonschlinkert/expand-brackets/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git+https://github.com/jonschlinkert/expand-brackets.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/posix-character-classes@0.1.1">
            <name>posix-character-classes</name>
            <version>0.1.1</version>
            <description>
                <![CDATA[POSIX character classes for creating regular expressions.]]>
            </description>
            <hashes>
                <hash alg="SHA-1">01eac0fe3b5af71a2a6c02feabb8c1fef7e00eab</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/posix-character-classes@0.1.1</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/jonschlinkert/posix-character-classes</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/jonschlinkert/posix-character-classes/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git+https://github.com/jonschlinkert/posix-character-classes.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/fragment-cache@0.2.1">
            <name>fragment-cache</name>
            <version>0.2.1</version>
            <description>
                <![CDATA[A cache for managing namespaced sub-caches]]>
            </description>
            <hashes>
                <hash alg="SHA-1">4290fad27f13e89be7f33799c6bc5a0abfff0d19</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/fragment-cache@0.2.1</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/jonschlinkert/fragment-cache</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/jonschlinkert/fragment-cache/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git+https://github.com/jonschlinkert/fragment-cache.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/nanomatch@1.2.13">
            <name>nanomatch</name>
            <version>1.2.13</version>
            <description>
                <![CDATA[Fast, minimal glob matcher for node.js. Similar to micromatch, minimatch and multimatch, but complete Bash 4.3 wildcard support only (no support for exglobs, posix brackets or braces)]]>
            </description>
            <hashes>
                <hash alg="SHA-1">b87a8aa4fc0de8fe6be88895b38983ff265bd119</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/nanomatch@1.2.13</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/micromatch/nanomatch</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/micromatch/nanomatch/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git+https://github.com/micromatch/nanomatch.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/is-windows@1.0.2">
            <name>is-windows</name>
            <version>1.0.2</version>
            <description>
                <![CDATA[Returns true if the platform is windows. UMD module, works with node.js, commonjs, browser, AMD, electron, etc.]]>
            </description>
            <hashes>
                <hash alg="SHA-1">d1850eb9791ecd18e6182ce12a30f396634bb19d</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/is-windows@1.0.2</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/jonschlinkert/is-windows</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/jonschlinkert/is-windows/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git+https://github.com/jonschlinkert/is-windows.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/object.pick@1.3.0">
            <name>object.pick</name>
            <version>1.3.0</version>
            <description>
                <![CDATA[Returns a filtered copy of an object with only the specified keys, similar to `_.pick` from lodash / underscore.]]>
            </description>
            <hashes>
                <hash alg="SHA-1">87a10ac4c1694bd2e1cbf53591a66141fb5dd747</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/object.pick@1.3.0</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/jonschlinkert/object.pick</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/jonschlinkert/object.pick/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git+https://github.com/jonschlinkert/object.pick.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/resolve-dir@1.0.1">
            <name>resolve-dir</name>
            <version>1.0.1</version>
            <description>
                <![CDATA[Resolve a directory that is either local, global or in the user's home directory.]]>
            </description>
            <hashes>
                <hash alg="SHA-1">79a40644c362be82f26effe739c9bb5382046f43</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/resolve-dir@1.0.1</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/jonschlinkert/resolve-dir</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/jonschlinkert/resolve-dir/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git+https://github.com/jonschlinkert/resolve-dir.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/expand-tilde@2.0.2">
            <name>expand-tilde</name>
            <version>2.0.2</version>
            <description>
                <![CDATA[Bash-like tilde expansion for node.js. Expands a leading tilde in a file path to the user home directory, or `~+` to the cwd.]]>
            </description>
            <hashes>
                <hash alg="SHA-1">97e801aa052df02454de46b02bf621642cdc8502</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/expand-tilde@2.0.2</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/jonschlinkert/expand-tilde</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/jonschlinkert/expand-tilde/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git+https://github.com/jonschlinkert/expand-tilde.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/homedir-polyfill@1.0.3">
            <name>homedir-polyfill</name>
            <version>1.0.3</version>
            <description>
                <![CDATA[Node.js os.homedir polyfill for older versions of node.js.]]>
            </description>
            <hashes>
                <hash alg="SHA-1">743298cef4e5af3e194161fbadcc2151d3a058e8</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/homedir-polyfill@1.0.3</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/doowb/homedir-polyfill</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/doowb/homedir-polyfill/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git+https://github.com/doowb/homedir-polyfill.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/parse-passwd@1.0.0">
            <name>parse-passwd</name>
            <version>1.0.0</version>
            <description>
                <![CDATA[Parse a passwd file into a list of users.]]>
            </description>
            <hashes>
                <hash alg="SHA-1">6d5b934a456993b23d37f40a382d6f1666a8e5c6</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/parse-passwd@1.0.0</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/doowb/parse-passwd</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/doowb/parse-passwd/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git+https://github.com/doowb/parse-passwd.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/global-modules@1.0.0">
            <name>global-modules</name>
            <version>1.0.0</version>
            <description>
                <![CDATA[The directory used by npm for globally installed npm modules.]]>
            </description>
            <hashes>
                <hash alg="SHA-1">6d770f0eb523ac78164d72b5e71a8877265cc3ea</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/global-modules@1.0.0</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/jonschlinkert/global-modules</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/jonschlinkert/global-modules/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git+https://github.com/jonschlinkert/global-modules.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/global-prefix@1.0.2">
            <name>global-prefix</name>
            <version>1.0.2</version>
            <description>
                <![CDATA[Get the npm global path prefix.]]>
            </description>
            <hashes>
                <hash alg="SHA-1">dbf743c6c14992593c655568cb66ed32c0122ebe</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/global-prefix@1.0.2</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/jonschlinkert/global-prefix</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/jonschlinkert/global-prefix/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git+https://github.com/jonschlinkert/global-prefix.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/ini@1.3.5">
            <name>ini</name>
            <version>1.3.5</version>
            <description>
                <![CDATA[An ini encoder/decoder for node]]>
            </description>
            <hashes>
                <hash alg="SHA-1">eee25f56db1c9ec6085e0c22778083f596abf927</hash>
            </hashes>
            <licenses>
                <license>
                    <id>ISC</id>
                </license>
            </licenses>
            <purl>pkg:npm/ini@1.3.5</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/isaacs/ini#readme</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/isaacs/ini/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git://github.com/isaacs/ini.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/which@1.3.1">
            <name>which</name>
            <version>1.3.1</version>
            <description>
                <![CDATA[Like which(1) unix command. Find the first instance of an executable in the PATH.]]>
            </description>
            <hashes>
                <hash alg="SHA-1">a45043d54f5805316da8d62f9f50918d3da70b0a</hash>
            </hashes>
            <licenses>
                <license>
                    <id>ISC</id>
                </license>
            </licenses>
            <purl>pkg:npm/which@1.3.1</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/isaacs/node-which#readme</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/isaacs/node-which/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git://github.com/isaacs/node-which.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/isexe@2.0.0">
            <name>isexe</name>
            <version>2.0.0</version>
            <description>
                <![CDATA[Minimal module to check if a file is executable.]]>
            </description>
            <hashes>
                <hash alg="SHA-1">e8fbf374dc556ff8947a10dcb0572d633f2cfa10</hash>
            </hashes>
            <licenses>
                <license>
                    <id>ISC</id>
                </license>
            </licenses>
            <purl>pkg:npm/isexe@2.0.0</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/isaacs/isexe#readme</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/isaacs/isexe/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git+https://github.com/isaacs/isexe.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/lodash.camelcase@4.3.0">
            <name>lodash.camelcase</name>
            <version>4.3.0</version>
            <description>
                <![CDATA[The lodash method `_.camelCase` exported as a module.]]>
            </description>
            <hashes>
                <hash alg="SHA-1">b28aa6288a2b9fc651035c7711f65ab6190331a6</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/lodash.camelcase@4.3.0</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://lodash.com/</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/lodash/lodash/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git+https://github.com/lodash/lodash.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/minimist@1.2.5">
            <name>minimist</name>
            <version>1.2.5</version>
            <description>
                <![CDATA[parse argument options]]>
            </description>
            <hashes>
                <hash alg="SHA-1">67d66014b66a6a8aaa0c083c5fd58df4e4e97602</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/minimist@1.2.5</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/substack/minimist</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/substack/minimist/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git://github.com/substack/minimist.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/semver@5.7.1">
            <name>semver</name>
            <version>5.7.1</version>
            <description>
                <![CDATA[The semantic version parser used by npm.]]>
            </description>
            <hashes>
                <hash alg="SHA-1">a954f931aeba508d307bbf069eff0c01c96116f7</hash>
            </hashes>
            <licenses>
                <license>
                    <id>ISC</id>
                </license>
            </licenses>
            <purl>pkg:npm/semver@5.7.1</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/npm/node-semver#readme</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/npm/node-semver/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git+https://github.com/npm/node-semver.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/clarinet@0.12.4">
            <name>clarinet</name>
            <version>0.12.4</version>
            <description>
                <![CDATA[SAX based evented streaming JSON parser in JavaScript (browser and node)]]>
            </description>
            <hashes>
                <hash alg="SHA-1">5d7196a2b2347ff283db2e2bf1ef615c0aa6afdb</hash>
            </hashes>
            <licenses>
                <license>
                    <id>BSD-2-Clause</id>
                </license>
            </licenses>
            <purl>pkg:npm/clarinet@0.12.4</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/dscape/clarinet</url>
                </reference>
                <reference type="issue-tracker">
                    <url>http://github.com/dscape/clarinet/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git+ssh://git@github.com/dscape/clarinet.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/colors@1.4.0">
            <name>colors</name>
            <version>1.4.0</version>
            <description>
                <![CDATA[get colors in your node.js console]]>
            </description>
            <hashes>
                <hash alg="SHA-1">c50491479d4c1bdaed2c9ced32cf7c7dc2360f78</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/colors@1.4.0</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/Marak/colors.js</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/Marak/colors.js/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git+ssh://git@github.com/Marak/colors.js.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/compression@1.7.4">
            <name>compression</name>
            <version>1.7.4</version>
            <description>
                <![CDATA[Node.js compression middleware]]>
            </description>
            <hashes>
                <hash alg="SHA-1">95523eff170ca57c29a0ca41e6fe131f41e5bb8f</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/compression@1.7.4</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/expressjs/compression#readme</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/expressjs/compression/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git+https://github.com/expressjs/compression.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/accepts@1.3.7">
            <name>accepts</name>
            <version>1.3.7</version>
            <description>
                <![CDATA[Higher-level content negotiation]]>
            </description>
            <hashes>
                <hash alg="SHA-1">531bc726517a3b2b41f850021c6cc15eaab507cd</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/accepts@1.3.7</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/jshttp/accepts#readme</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/jshttp/accepts/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git+https://github.com/jshttp/accepts.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/negotiator@0.6.2">
            <name>negotiator</name>
            <version>0.6.2</version>
            <description>
                <![CDATA[HTTP content negotiation]]>
            </description>
            <hashes>
                <hash alg="SHA-1">feacf7ccf525a77ae9634436a64883ffeca346fb</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/negotiator@0.6.2</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/jshttp/negotiator#readme</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/jshttp/negotiator/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git+https://github.com/jshttp/negotiator.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/bytes@3.0.0">
            <name>bytes</name>
            <version>3.0.0</version>
            <description>
                <![CDATA[Utility to parse a string bytes to bytes and vice-versa]]>
            </description>
            <hashes>
                <hash alg="SHA-1">d32815404d689699f85a4ea4fa8755dd13a96048</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/bytes@3.0.0</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/visionmedia/bytes.js#readme</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/visionmedia/bytes.js/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git+https://github.com/visionmedia/bytes.js.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/compressible@2.0.18">
            <name>compressible</name>
            <version>2.0.18</version>
            <description>
                <![CDATA[Compressible Content-Type / mime checking]]>
            </description>
            <hashes>
                <hash alg="SHA-1">af53cca6b070d4c3c0750fbd77286a6d7cc46fba</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/compressible@2.0.18</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/jshttp/compressible#readme</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/jshttp/compressible/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git+https://github.com/jshttp/compressible.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/on-headers@1.0.2">
            <name>on-headers</name>
            <version>1.0.2</version>
            <description>
                <![CDATA[Execute a listener when a response is about to write headers]]>
            </description>
            <hashes>
                <hash alg="SHA-1">772b0ae6aaa525c399e489adfad90c403eb3c28f</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/on-headers@1.0.2</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/jshttp/on-headers#readme</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/jshttp/on-headers/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git+https://github.com/jshttp/on-headers.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/safe-buffer@5.1.2">
            <name>safe-buffer</name>
            <version>5.1.2</version>
            <description>
                <![CDATA[Safer Node.js Buffer API]]>
            </description>
            <hashes>
                <hash alg="SHA-1">991ec69d296e0313747d59bdfd2b745c35f8828d</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/safe-buffer@5.1.2</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/feross/safe-buffer</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/feross/safe-buffer/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git://github.com/feross/safe-buffer.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/vary@1.1.2">
            <name>vary</name>
            <version>1.1.2</version>
            <description>
                <![CDATA[Manipulate the HTTP Vary header]]>
            </description>
            <hashes>
                <hash alg="SHA-1">2299f02c6ded30d4a5961b0b9f74524a18f634fc</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/vary@1.1.2</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/jshttp/vary#readme</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/jshttp/vary/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git+https://github.com/jshttp/vary.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/concurrently@5.2.0">
            <name>concurrently</name>
            <version>5.2.0</version>
            <description>
                <![CDATA[Run commands concurrently]]>
            </description>
            <hashes>
                <hash alg="SHA-1">ead55121d08a0fc817085584c123cedec2e08975</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/concurrently@5.2.0</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/kimmobrunfeldt/concurrently#readme</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/kimmobrunfeldt/concurrently/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git+https://github.com/kimmobrunfeldt/concurrently.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/date-fns@2.14.0">
            <name>date-fns</name>
            <version>2.14.0</version>
            <description>
                <![CDATA[Modern JavaScript date utility library]]>
            </description>
            <hashes>
                <hash alg="SHA-1">359a87a265bb34ef2e38f93ecf63ac453f9bc7ba</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/date-fns@2.14.0</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/date-fns/date-fns#readme</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/date-fns/date-fns/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git+https://github.com/date-fns/date-fns.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/lodash@4.17.19">
            <name>lodash</name>
            <version>4.17.19</version>
            <description>
                <![CDATA[Lodash modular utilities.]]>
            </description>
            <hashes>
                <hash alg="SHA-1">e48ddedbe30b3321783c5b4301fbd353bc1e4a4b</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/lodash@4.17.19</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://lodash.com/</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/lodash/lodash/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git+https://github.com/lodash/lodash.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/read-pkg@4.0.1">
            <name>read-pkg</name>
            <version>4.0.1</version>
            <description>
                <![CDATA[Read a package.json file]]>
            </description>
            <hashes>
                <hash alg="SHA-1">963625378f3e1c4d48c85872b5a6ec7d5d093237</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/read-pkg@4.0.1</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/sindresorhus/read-pkg#readme</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/sindresorhus/read-pkg/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git+https://github.com/sindresorhus/read-pkg.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/normalize-package-data@2.5.0">
            <name>normalize-package-data</name>
            <version>2.5.0</version>
            <description>
                <![CDATA[Normalizes data that can be found in package.json files.]]>
            </description>
            <hashes>
                <hash alg="SHA-1">e66db1838b200c1dfc233225d12cb36520e234a8</hash>
            </hashes>
            <licenses>
                <license>
                    <id>BSD-2-Clause</id>
                </license>
            </licenses>
            <purl>pkg:npm/normalize-package-data@2.5.0</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/npm/normalize-package-data#readme</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/npm/normalize-package-data/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git://github.com/npm/normalize-package-data.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/hosted-git-info@2.8.8">
            <name>hosted-git-info</name>
            <version>2.8.8</version>
            <description>
                <![CDATA[Provides metadata and conversions from repository urls for Github, Bitbucket and Gitlab]]>
            </description>
            <hashes>
                <hash alg="SHA-1">7539bd4bc1e0e0a895815a2e0262420b12858488</hash>
            </hashes>
            <licenses>
                <license>
                    <id>ISC</id>
                </license>
            </licenses>
            <purl>pkg:npm/hosted-git-info@2.8.8</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/npm/hosted-git-info</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/npm/hosted-git-info/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git+https://github.com/npm/hosted-git-info.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/resolve@1.17.0">
            <name>resolve</name>
            <version>1.17.0</version>
            <description>
                <![CDATA[resolve like require.resolve() on behalf of files asynchronously and synchronously]]>
            </description>
            <hashes>
                <hash alg="SHA-1">b25941b54968231cc2d1bb76a79cb7f2c0bf8444</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/resolve@1.17.0</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/browserify/resolve#readme</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/browserify/resolve/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git://github.com/browserify/resolve.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/path-parse@1.0.6">
            <name>path-parse</name>
            <version>1.0.6</version>
            <description>
                <![CDATA[Node.js path.parse() ponyfill]]>
            </description>
            <hashes>
                <hash alg="SHA-1">d62dbb5679405d72c4737ec58600e9ddcf06d24c</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/path-parse@1.0.6</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/jbgutierrez/path-parse#readme</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/jbgutierrez/path-parse/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git+https://github.com/jbgutierrez/path-parse.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/validate-npm-package-license@3.0.4">
            <name>validate-npm-package-license</name>
            <version>3.0.4</version>
            <description>
                <![CDATA[Give me a string and I'll tell you if it's a valid npm package license string]]>
            </description>
            <hashes>
                <hash alg="SHA-1">fc91f6b9c7ba15c857f4cb2c5defeec39d4f410a</hash>
            </hashes>
            <licenses>
                <license>
                    <id>Apache-2.0</id>
                </license>
            </licenses>
            <purl>pkg:npm/validate-npm-package-license@3.0.4</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/kemitchell/validate-npm-package-license.js#readme</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/kemitchell/validate-npm-package-license.js/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git+https://github.com/kemitchell/validate-npm-package-license.js.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/spdx-correct@3.1.1">
            <name>spdx-correct</name>
            <version>3.1.1</version>
            <description>
                <![CDATA[correct invalid SPDX expressions]]>
            </description>
            <hashes>
                <hash alg="SHA-1">dece81ac9c1e6713e5f7d1b6f17d468fa53d89a9</hash>
            </hashes>
            <licenses>
                <license>
                    <id>Apache-2.0</id>
                </license>
            </licenses>
            <purl>pkg:npm/spdx-correct@3.1.1</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/jslicense/spdx-correct.js#readme</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/jslicense/spdx-correct.js/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git+https://github.com/jslicense/spdx-correct.js.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/spdx-expression-parse@3.0.1">
            <name>spdx-expression-parse</name>
            <version>3.0.1</version>
            <description>
                <![CDATA[parse SPDX license expressions]]>
            </description>
            <hashes>
                <hash alg="SHA-1">cf70f50482eefdc98e3ce0a6833e4a53ceeba679</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/spdx-expression-parse@3.0.1</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/jslicense/spdx-expression-parse.js#readme</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/jslicense/spdx-expression-parse.js/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git+https://github.com/jslicense/spdx-expression-parse.js.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/spdx-exceptions@2.3.0">
            <name>spdx-exceptions</name>
            <version>2.3.0</version>
            <description>
                <![CDATA[list of SPDX standard license exceptions]]>
            </description>
            <hashes>
                <hash alg="SHA-1">3f28ce1a77a00372683eade4a433183527a2163d</hash>
            </hashes>
            <licenses>
                <license>
                    <id>CC-BY-3.0</id>
                </license>
            </licenses>
            <purl>pkg:npm/spdx-exceptions@2.3.0</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/kemitchell/spdx-exceptions.json#readme</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/kemitchell/spdx-exceptions.json/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git+https://github.com/kemitchell/spdx-exceptions.json.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/spdx-license-ids@3.0.5">
            <name>spdx-license-ids</name>
            <version>3.0.5</version>
            <description>
                <![CDATA[A list of SPDX license identifiers]]>
            </description>
            <hashes>
                <hash alg="SHA-1">3694b5804567a458d3c8045842a6358632f62654</hash>
            </hashes>
            <licenses>
                <license>
                    <id>CC0-1.0</id>
                </license>
            </licenses>
            <purl>pkg:npm/spdx-license-ids@3.0.5</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/shinnn/spdx-license-ids#readme</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/shinnn/spdx-license-ids/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git+https://github.com/shinnn/spdx-license-ids.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/parse-json@4.0.0">
            <name>parse-json</name>
            <version>4.0.0</version>
            <description>
                <![CDATA[Parse JSON with more helpful errors]]>
            </description>
            <hashes>
                <hash alg="SHA-1">be35f5425be1f7f6c747184f98a788cb99477ee0</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/parse-json@4.0.0</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/sindresorhus/parse-json#readme</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/sindresorhus/parse-json/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git+https://github.com/sindresorhus/parse-json.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/error-ex@1.3.2">
            <name>error-ex</name>
            <version>1.3.2</version>
            <description>
                <![CDATA[Easy error subclassing and stack customization]]>
            </description>
            <hashes>
                <hash alg="SHA-1">b4ac40648107fdcdcfae242f428bea8a14d4f1bf</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/error-ex@1.3.2</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/qix-/node-error-ex#readme</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/qix-/node-error-ex/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git+https://github.com/qix-/node-error-ex.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/is-arrayish@0.2.1">
            <name>is-arrayish</name>
            <version>0.2.1</version>
            <description>
                <![CDATA[Determines if an object can be used as an array]]>
            </description>
            <hashes>
                <hash alg="SHA-1">77c99840527aa8ecb1a8ba697b80645a7a926a9d</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/is-arrayish@0.2.1</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/qix-/node-is-arrayish#readme</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/qix-/node-is-arrayish/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git+https://github.com/qix-/node-is-arrayish.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/json-parse-better-errors@1.0.2">
            <name>json-parse-better-errors</name>
            <version>1.0.2</version>
            <description>
                <![CDATA[JSON.parse with context information on error]]>
            </description>
            <hashes>
                <hash alg="SHA-1">bb867cfb3450e69107c131d1c514bab3dc8bcaa9</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/json-parse-better-errors@1.0.2</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/zkat/json-parse-better-errors#readme</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/zkat/json-parse-better-errors/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git+https://github.com/zkat/json-parse-better-errors.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/pify@3.0.0">
            <name>pify</name>
            <version>3.0.0</version>
            <description>
                <![CDATA[Promisify a callback-style function]]>
            </description>
            <hashes>
                <hash alg="SHA-1">e5a4acd2c101fdf3d9a4d07f0dbc4db49dd28176</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/pify@3.0.0</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/sindresorhus/pify#readme</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/sindresorhus/pify/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git+https://github.com/sindresorhus/pify.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/rxjs@6.6.0">
            <name>rxjs</name>
            <version>6.6.0</version>
            <description>
                <![CDATA[Reactive Extensions for modern JavaScript]]>
            </description>
            <hashes>
                <hash alg="SHA-1">af2901eedf02e3a83ffa7f886240ff9018bbec84</hash>
            </hashes>
            <licenses>
                <license>
                    <id>Apache-2.0</id>
                </license>
            </licenses>
            <purl>pkg:npm/rxjs@6.6.0</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/ReactiveX/RxJS</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/ReactiveX/RxJS/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git+https://github.com/reactivex/rxjs.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/tslib@1.13.0">
            <name>tslib</name>
            <version>1.13.0</version>
            <description>
                <![CDATA[Runtime library for TypeScript helper functions]]>
            </description>
            <hashes>
                <hash alg="SHA-1">c881e13cc7015894ed914862d276436fa9a47043</hash>
            </hashes>
            <licenses>
                <license>
                    <id>0BSD</id>
                </license>
            </licenses>
            <purl>pkg:npm/tslib@1.13.0</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://www.typescriptlang.org/</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/Microsoft/TypeScript/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git+https://github.com/Microsoft/tslib.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/spawn-command@0.0.2-1">
            <name>spawn-command</name>
            <version>0.0.2-1</version>
            <description>
                <![CDATA[Spawn commands like `child_process.exec` does but return a `ChildProcess`]]>
            </description>
            <hashes>
                <hash alg="SHA-1">62f5e9466981c1b796dc5929937e11c9c6921bd0</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/spawn-command@0.0.2-1</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/mmalecki/spawn-command#readme</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/mmalecki/spawn-command/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git+https://github.com/mmalecki/spawn-command.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/supports-color@6.1.0">
            <name>supports-color</name>
            <version>6.1.0</version>
            <description>
                <![CDATA[Detect whether a terminal supports color]]>
            </description>
            <hashes>
                <hash alg="SHA-1">0764abc69c63d5ac842dd4867e8d025e880df8f3</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/supports-color@6.1.0</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/chalk/supports-color#readme</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/chalk/supports-color/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git+https://github.com/chalk/supports-color.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/tree-kill@1.2.2">
            <name>tree-kill</name>
            <version>1.2.2</version>
            <description>
                <![CDATA[kill trees of processes]]>
            </description>
            <hashes>
                <hash alg="SHA-1">4ca09a9092c88b73a7cdc5e8a01b507b0790a0cc</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/tree-kill@1.2.2</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/pkrumins/node-tree-kill</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/pkrumins/node-tree-kill/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git://github.com/pkrumins/node-tree-kill.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/yargs@13.3.2">
            <name>yargs</name>
            <version>13.3.2</version>
            <description>
                <![CDATA[yargs the modern, pirate-themed, successor to optimist.]]>
            </description>
            <hashes>
                <hash alg="SHA-1">ad7ffefec1aa59565ac915f82dccb38a9c31a2dd</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/yargs@13.3.2</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://yargs.js.org/</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/yargs/yargs/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git+https://github.com/yargs/yargs.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/cliui@5.0.0">
            <name>cliui</name>
            <version>5.0.0</version>
            <description>
                <![CDATA[easily create complex multi-column command-line-interfaces]]>
            </description>
            <hashes>
                <hash alg="SHA-1">deefcfdb2e800784aa34f46fa08e06851c7bbbc5</hash>
            </hashes>
            <licenses>
                <license>
                    <id>ISC</id>
                </license>
            </licenses>
            <purl>pkg:npm/cliui@5.0.0</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/yargs/cliui#readme</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/yargs/cliui/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git+ssh://git@github.com/yargs/cliui.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/string-width@3.1.0">
            <name>string-width</name>
            <version>3.1.0</version>
            <description>
                <![CDATA[Get the visual width of a string - the number of columns required to display it]]>
            </description>
            <hashes>
                <hash alg="SHA-1">22767be21b62af1081574306f69ac51b62203961</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/string-width@3.1.0</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/sindresorhus/string-width#readme</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/sindresorhus/string-width/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git+https://github.com/sindresorhus/string-width.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/emoji-regex@7.0.3">
            <name>emoji-regex</name>
            <version>7.0.3</version>
            <description>
                <![CDATA[A regular expression to match all Emoji-only symbols as per the Unicode Standard.]]>
            </description>
            <hashes>
                <hash alg="SHA-1">933a04052860c85e83c122479c4748a8e4c72156</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/emoji-regex@7.0.3</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://mths.be/emoji-regex</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/mathiasbynens/emoji-regex/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git+https://github.com/mathiasbynens/emoji-regex.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/is-fullwidth-code-point@2.0.0">
            <name>is-fullwidth-code-point</name>
            <version>2.0.0</version>
            <description>
                <![CDATA[Check if the character represented by a given Unicode code point is fullwidth]]>
            </description>
            <hashes>
                <hash alg="SHA-1">a3b30a5c4f199183167aaab93beefae3ddfb654f</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/is-fullwidth-code-point@2.0.0</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/sindresorhus/is-fullwidth-code-point#readme</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/sindresorhus/is-fullwidth-code-point/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git+https://github.com/sindresorhus/is-fullwidth-code-point.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/strip-ansi@5.2.0">
            <name>strip-ansi</name>
            <version>5.2.0</version>
            <description>
                <![CDATA[Strip ANSI escape codes from a string]]>
            </description>
            <hashes>
                <hash alg="SHA-1">8c9a536feb6afc962bdfa5b104a5091c1ad9c0ae</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/strip-ansi@5.2.0</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/chalk/strip-ansi#readme</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/chalk/strip-ansi/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git+https://github.com/chalk/strip-ansi.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/ansi-regex@4.1.0">
            <name>ansi-regex</name>
            <version>4.1.0</version>
            <description>
                <![CDATA[Regular expression for matching ANSI escape codes]]>
            </description>
            <hashes>
                <hash alg="SHA-1">8b9f8f08cf1acb843756a839ca8c7e3168c51997</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/ansi-regex@4.1.0</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/chalk/ansi-regex#readme</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/chalk/ansi-regex/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git+https://github.com/chalk/ansi-regex.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/wrap-ansi@5.1.0">
            <name>wrap-ansi</name>
            <version>5.1.0</version>
            <description>
                <![CDATA[Wordwrap a string with ANSI escape codes]]>
            </description>
            <hashes>
                <hash alg="SHA-1">1fd1f67235d5b6d0fee781056001bfb694c03b09</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/wrap-ansi@5.1.0</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/chalk/wrap-ansi#readme</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/chalk/wrap-ansi/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git+https://github.com/chalk/wrap-ansi.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/find-up@3.0.0">
            <name>find-up</name>
            <version>3.0.0</version>
            <description>
                <![CDATA[Find a file or directory by walking up parent directories]]>
            </description>
            <hashes>
                <hash alg="SHA-1">49169f1d7993430646da61ecc5ae355c21c97b73</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/find-up@3.0.0</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/sindresorhus/find-up#readme</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/sindresorhus/find-up/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git+https://github.com/sindresorhus/find-up.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/locate-path@3.0.0">
            <name>locate-path</name>
            <version>3.0.0</version>
            <description>
                <![CDATA[Get the first path that exists on disk of multiple paths]]>
            </description>
            <hashes>
                <hash alg="SHA-1">dbec3b3ab759758071b58fe59fc41871af21400e</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/locate-path@3.0.0</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/sindresorhus/locate-path#readme</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/sindresorhus/locate-path/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git+https://github.com/sindresorhus/locate-path.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/p-locate@3.0.0">
            <name>p-locate</name>
            <version>3.0.0</version>
            <description>
                <![CDATA[Get the first fulfilled promise that satisfies the provided testing function]]>
            </description>
            <hashes>
                <hash alg="SHA-1">322d69a05c0264b25997d9f40cd8a891ab0064a4</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/p-locate@3.0.0</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/sindresorhus/p-locate#readme</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/sindresorhus/p-locate/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git+https://github.com/sindresorhus/p-locate.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/p-limit@2.3.0">
            <name>p-limit</name>
            <version>2.3.0</version>
            <description>
                <![CDATA[Run multiple promise-returning & async functions with limited concurrency]]>
            </description>
            <hashes>
                <hash alg="SHA-1">3dd33c647a214fdfffd835933eb086da0dc21db1</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/p-limit@2.3.0</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/sindresorhus/p-limit#readme</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/sindresorhus/p-limit/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git+https://github.com/sindresorhus/p-limit.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/p-try@2.2.0">
            <name>p-try</name>
            <version>2.2.0</version>
            <description>
                <![CDATA[`Start a promise chain]]>
            </description>
            <hashes>
                <hash alg="SHA-1">cb2868540e313d61de58fafbe35ce9004d5540e6</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/p-try@2.2.0</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/sindresorhus/p-try#readme</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/sindresorhus/p-try/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git+https://github.com/sindresorhus/p-try.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/path-exists@3.0.0">
            <name>path-exists</name>
            <version>3.0.0</version>
            <description>
                <![CDATA[Check if a path exists]]>
            </description>
            <hashes>
                <hash alg="SHA-1">ce0ebeaa5f78cb18925ea7d810d7b59b010fd515</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/path-exists@3.0.0</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/sindresorhus/path-exists#readme</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/sindresorhus/path-exists/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git+https://github.com/sindresorhus/path-exists.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/get-caller-file@2.0.5">
            <name>get-caller-file</name>
            <version>2.0.5</version>
            <description>
                <![CDATA[[![Build Status](https://travis-ci.org/stefanpenner/get-caller-file.svg?branch=master)](https://travis-ci.org/stefanpenner/get-caller-file) [![Build status](https://ci.appveyor.com/api/projects/status/ol2q94g1932cy14a/branch/master?svg=true)](https://ci.appveyor.com/project/embercli/get-caller-file/branch/master)]]>
            </description>
            <hashes>
                <hash alg="SHA-1">4f94412a82db32f36e3b0b9741f8a97feb031f7e</hash>
            </hashes>
            <licenses>
                <license>
                    <id>ISC</id>
                </license>
            </licenses>
            <purl>pkg:npm/get-caller-file@2.0.5</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/stefanpenner/get-caller-file#readme</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/stefanpenner/get-caller-file/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git+https://github.com/stefanpenner/get-caller-file.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/require-directory@2.1.1">
            <name>require-directory</name>
            <version>2.1.1</version>
            <description>
                <![CDATA[Recursively iterates over specified directory, require()'ing each file, and returning a nested hash structure containing those modules.]]>
            </description>
            <hashes>
                <hash alg="SHA-1">8c64ad5fd30dab1c976e2344ffe7f792a6a6df42</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/require-directory@2.1.1</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/troygoode/node-require-directory/</url>
                </reference>
                <reference type="issue-tracker">
                    <url>http://github.com/troygoode/node-require-directory/issues/</url>
                </reference>
                <reference type="vcs">
                    <url>git://github.com/troygoode/node-require-directory.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/require-main-filename@2.0.0">
            <name>require-main-filename</name>
            <version>2.0.0</version>
            <description>
                <![CDATA[shim for require.main.filename() that works in as many environments as possible]]>
            </description>
            <hashes>
                <hash alg="SHA-1">d0b329ecc7cc0f61649f62215be69af54aa8989b</hash>
            </hashes>
            <licenses>
                <license>
                    <id>ISC</id>
                </license>
            </licenses>
            <purl>pkg:npm/require-main-filename@2.0.0</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/yargs/require-main-filename#readme</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/yargs/require-main-filename/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git+ssh://git@github.com/yargs/require-main-filename.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/set-blocking@2.0.0">
            <name>set-blocking</name>
            <version>2.0.0</version>
            <description>
                <![CDATA[set blocking stdio and stderr ensuring that terminal output does not truncate]]>
            </description>
            <hashes>
                <hash alg="SHA-1">045f9782d011ae9a6803ddd382b24392b3d890f7</hash>
            </hashes>
            <licenses>
                <license>
                    <id>ISC</id>
                </license>
            </licenses>
            <purl>pkg:npm/set-blocking@2.0.0</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/yargs/set-blocking#readme</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/yargs/set-blocking/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git+https://github.com/yargs/set-blocking.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/which-module@2.0.0">
            <name>which-module</name>
            <version>2.0.0</version>
            <description>
                <![CDATA[Find the module object for something that was require()d]]>
            </description>
            <hashes>
                <hash alg="SHA-1">d9ef07dce77b9902b8a3a8fa4b31c3e3f7e6e87a</hash>
            </hashes>
            <licenses>
                <license>
                    <id>ISC</id>
                </license>
            </licenses>
            <purl>pkg:npm/which-module@2.0.0</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/nexdrew/which-module#readme</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/nexdrew/which-module/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git+https://github.com/nexdrew/which-module.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/y18n@4.0.0">
            <name>y18n</name>
            <version>4.0.0</version>
            <description>
                <![CDATA[the bare-bones internationalization library used by yargs]]>
            </description>
            <hashes>
                <hash alg="SHA-1">95ef94f85ecc81d007c264e190a120f0a3c8566b</hash>
            </hashes>
            <licenses>
                <license>
                    <id>ISC</id>
                </license>
            </licenses>
            <purl>pkg:npm/y18n@4.0.0</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/yargs/y18n</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/yargs/y18n/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git+ssh://git@github.com/yargs/y18n.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/yargs-parser@13.1.2">
            <name>yargs-parser</name>
            <version>13.1.2</version>
            <description>
                <![CDATA[the mighty option parser used by yargs]]>
            </description>
            <hashes>
                <hash alg="SHA-1">130f09702ebaeef2650d54ce6e3e5706f7a4fb38</hash>
            </hashes>
            <licenses>
                <license>
                    <id>ISC</id>
                </license>
            </licenses>
            <purl>pkg:npm/yargs-parser@13.1.2</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/yargs/yargs-parser#readme</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/yargs/yargs-parser/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git+ssh://git@github.com/yargs/yargs-parser.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/camelcase@5.3.1">
            <name>camelcase</name>
            <version>5.3.1</version>
            <description>
                <![CDATA[Convert a dash/dot/underscore/space separated string to camelCase or PascalCase: `foo-bar` → `fooBar`]]>
            </description>
            <hashes>
                <hash alg="SHA-1">e3c9b31569e106811df242f715725a1f4c494320</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/camelcase@5.3.1</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/sindresorhus/camelcase#readme</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/sindresorhus/camelcase/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git+https://github.com/sindresorhus/camelcase.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/decamelize@1.2.0">
            <name>decamelize</name>
            <version>1.2.0</version>
            <description>
                <![CDATA[Convert a camelized string into a lowercased one with a custom separator: unicornRainbow → unicorn_rainbow]]>
            </description>
            <hashes>
                <hash alg="SHA-1">f6534d15148269b20352e7bee26f501f9a191290</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/decamelize@1.2.0</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/sindresorhus/decamelize#readme</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/sindresorhus/decamelize/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git+https://github.com/sindresorhus/decamelize.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/config@3.3.1">
            <name>config</name>
            <version>3.3.1</version>
            <description>
                <![CDATA[Configuration control for production node deployments]]>
            </description>
            <hashes>
                <hash alg="SHA-1">b6a70e2908a43b98ed20be7e367edf0cc8ed5a19</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/config@3.3.1</purl>
            <externalReferences>
                <reference type="website">
                    <url>http://lorenwest.github.com/node-config</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/lorenwest/node-config/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git+ssh://git@github.com/lorenwest/node-config.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/json5@2.1.3">
            <name>json5</name>
            <version>2.1.3</version>
            <description>
                <![CDATA[JSON for humans.]]>
            </description>
            <hashes>
                <hash alg="SHA-1">c9b0f7fa9233bfe5807fe66fcf3a5617ed597d43</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/json5@2.1.3</purl>
            <externalReferences>
                <reference type="website">
                    <url>http://json5.org/</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/json5/json5/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git+https://github.com/json5/json5.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/cookie-parser@1.4.5">
            <name>cookie-parser</name>
            <version>1.4.5</version>
            <description>
                <![CDATA[Parse HTTP request cookies]]>
            </description>
            <hashes>
                <hash alg="SHA-1">3e572d4b7c0c80f9c61daf604e4336831b5d1d49</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/cookie-parser@1.4.5</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/expressjs/cookie-parser#readme</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/expressjs/cookie-parser/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git+https://github.com/expressjs/cookie-parser.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/cookie@0.4.0">
            <name>cookie</name>
            <version>0.4.0</version>
            <description>
                <![CDATA[HTTP server cookie parsing and serialization]]>
            </description>
            <hashes>
                <hash alg="SHA-1">beb437e7022b3b6d49019d088665303ebe9c14ba</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/cookie@0.4.0</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/jshttp/cookie#readme</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/jshttp/cookie/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git+https://github.com/jshttp/cookie.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/cookie-signature@1.0.6">
            <name>cookie-signature</name>
            <version>1.0.6</version>
            <description>
                <![CDATA[Sign and unsign cookies]]>
            </description>
            <hashes>
                <hash alg="SHA-1">e303a882b342cc3ee8ca513a79999734dab3ae2c</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/cookie-signature@1.0.6</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/visionmedia/node-cookie-signature#readme</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/visionmedia/node-cookie-signature/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git+https://github.com/visionmedia/node-cookie-signature.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/cors@2.8.5">
            <name>cors</name>
            <version>2.8.5</version>
            <description>
                <![CDATA[Node.js CORS middleware]]>
            </description>
            <hashes>
                <hash alg="SHA-1">eac11da51592dd86b9f06f6e7ac293b3df875d29</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/cors@2.8.5</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/expressjs/cors#readme</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/expressjs/cors/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git+https://github.com/expressjs/cors.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/object-assign@4.1.1">
            <name>object-assign</name>
            <version>4.1.1</version>
            <description>
                <![CDATA[ES2015 `Object.assign()` ponyfill]]>
            </description>
            <hashes>
                <hash alg="SHA-1">2109adc7965887cfc05cbbd442cac8bfbb360863</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/object-assign@4.1.1</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/sindresorhus/object-assign#readme</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/sindresorhus/object-assign/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git+https://github.com/sindresorhus/object-assign.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/dottie@2.0.2">
            <name>dottie</name>
            <version>2.0.2</version>
            <description>
                <![CDATA[Fast and safe nested object access and manipulation in JavaScript]]>
            </description>
            <hashes>
                <hash alg="SHA-1">cc91c0726ce3a054ebf11c55fbc92a7f266dd154</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/dottie@2.0.2</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/mickhansen/dottie.js#readme</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/mickhansen/dottie.js/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git://github.com/mickhansen/dottie.js.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/download@7.1.0">
            <name>download</name>
            <version>7.1.0</version>
            <description>
                <![CDATA[Download and extract files]]>
            </description>
            <hashes>
                <hash alg="SHA-1">9059aa9d70b503ee76a132897be6dec8e5587233</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/download@7.1.0</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/kevva/download#readme</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/kevva/download/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git+https://github.com/kevva/download.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/archive-type@4.0.0">
            <name>archive-type</name>
            <version>4.0.0</version>
            <description>
                <![CDATA[Detect the archive type of a Buffer/Uint8Array]]>
            </description>
            <hashes>
                <hash alg="SHA-1">f92e72233056dfc6969472749c267bdb046b1d70</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/archive-type@4.0.0</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/kevva/archive-type#readme</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/kevva/archive-type/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git+https://github.com/kevva/archive-type.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/file-type@4.4.0">
            <name>file-type</name>
            <version>4.4.0</version>
            <description>
                <![CDATA[Detect the file type of a Buffer/Uint8Array]]>
            </description>
            <hashes>
                <hash alg="SHA-1">1b600e5fca1fbdc6e80c0a70c71c8dba5f7906c5</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/file-type@4.4.0</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/sindresorhus/file-type#readme</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/sindresorhus/file-type/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git+https://github.com/sindresorhus/file-type.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/caw@2.0.1">
            <name>caw</name>
            <version>2.0.1</version>
            <description>
                <![CDATA[Construct HTTP/HTTPS agents for tunneling proxies]]>
            </description>
            <hashes>
                <hash alg="SHA-1">6c3ca071fc194720883c2dc5da9b074bfc7e9e95</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/caw@2.0.1</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/kevva/caw#readme</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/kevva/caw/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git+https://github.com/kevva/caw.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/get-proxy@2.1.0">
            <name>get-proxy</name>
            <version>2.1.0</version>
            <description>
                <![CDATA[Get configured proxy]]>
            </description>
            <hashes>
                <hash alg="SHA-1">349f2b4d91d44c4d4d4e9cba2ad90143fac5ef93</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/get-proxy@2.1.0</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/kevva/get-proxy#readme</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/kevva/get-proxy/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git+https://github.com/kevva/get-proxy.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/npm-conf@1.1.3">
            <name>npm-conf</name>
            <version>1.1.3</version>
            <description>
                <![CDATA[Get the npm config]]>
            </description>
            <hashes>
                <hash alg="SHA-1">256cc47bd0e218c259c4e9550bf413bc2192aff9</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/npm-conf@1.1.3</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/kevva/npm-conf#readme</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/kevva/npm-conf/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git+https://github.com/kevva/npm-conf.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/config-chain@1.1.12">
            <name>config-chain</name>
            <version>1.1.12</version>
            <description>
                <![CDATA[HANDLE CONFIGURATION ONCE AND FOR ALL]]>
            </description>
            <hashes>
                <hash alg="SHA-1">0fde8d091200eb5e808caf25fe618c02f48e4efa</hash>
            </hashes>
            <purl>pkg:npm/config-chain@1.1.12</purl>
            <externalReferences>
                <reference type="website">
                    <url>http://github.com/dominictarr/config-chain</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/dominictarr/config-chain/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git+https://github.com/dominictarr/config-chain.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/proto-list@1.2.4">
            <name>proto-list</name>
            <version>1.2.4</version>
            <description>
                <![CDATA[A utility for managing a prototype chain]]>
            </description>
            <hashes>
                <hash alg="SHA-1">212d5bfe1318306a420f6402b8e26ff39647a849</hash>
            </hashes>
            <licenses>
                <license>
                    <id>ISC</id>
                </license>
            </licenses>
            <purl>pkg:npm/proto-list@1.2.4</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/isaacs/proto-list#readme</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/isaacs/proto-list/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git+https://github.com/isaacs/proto-list.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/isurl@1.0.0">
            <name>isurl</name>
            <version>1.0.0</version>
            <description>
                <![CDATA[Checks whether a value is a WHATWG URL.]]>
            </description>
            <hashes>
                <hash alg="SHA-1">b27f4f49f3cdaa3ea44a0a5b7f3462e6edc39d67</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/isurl@1.0.0</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/stevenvachon/isurl#readme</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/stevenvachon/isurl/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git+https://github.com/stevenvachon/isurl.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/has-to-string-tag-x@1.4.1">
            <name>has-to-string-tag-x</name>
            <version>1.4.1</version>
            <description>
                <![CDATA[Tests if ES6 @@toStringTag is supported.]]>
            </description>
            <hashes>
                <hash alg="SHA-1">a045ab383d7b4b2012a00148ab0aa5f290044d4d</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/has-to-string-tag-x@1.4.1</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/Xotic750/has-to-string-tag-x</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/Xotic750/has-to-string-tag-x/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git+https://github.com/Xotic750/has-to-string-tag-x.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/has-symbol-support-x@1.4.2">
            <name>has-symbol-support-x</name>
            <version>1.4.2</version>
            <description>
                <![CDATA[Tests if ES6 Symbol is supported.]]>
            </description>
            <hashes>
                <hash alg="SHA-1">1409f98bc00247da45da67cee0a36f282ff26455</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/has-symbol-support-x@1.4.2</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/Xotic750/has-symbol-support-x</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/Xotic750/has-symbol-support-x/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git+https://github.com/Xotic750/has-symbol-support-x.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/is-object@1.0.1">
            <name>is-object</name>
            <version>1.0.1</version>
            <description>
                <![CDATA[Checks whether a value is an object]]>
            </description>
            <hashes>
                <hash alg="SHA-1">8952688c5ec2ffd6b03ecc85e769e02903083470</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/is-object@1.0.1</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/ljharb/is-object</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/ljharb/is-object/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git://github.com/ljharb/is-object.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/tunnel-agent@0.6.0">
            <name>tunnel-agent</name>
            <version>0.6.0</version>
            <description>
                <![CDATA[HTTP proxy tunneling agent. Formerly part of mikeal/request, now a standalone module.]]>
            </description>
            <hashes>
                <hash alg="SHA-1">27a5dea06b36b04a0a9966774b290868f0fc40fd</hash>
            </hashes>
            <licenses>
                <license>
                    <id>Apache-2.0</id>
                </license>
            </licenses>
            <purl>pkg:npm/tunnel-agent@0.6.0</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/mikeal/tunnel-agent#readme</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/mikeal/tunnel-agent/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git+https://github.com/mikeal/tunnel-agent.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/url-to-options@1.0.1">
            <name>url-to-options</name>
            <version>1.0.1</version>
            <description>
                <![CDATA[Convert a WHATWG URL to an http(s).request options object.]]>
            </description>
            <hashes>
                <hash alg="SHA-1">1505a03a289a48cbd7a434efbaeec5055f5633a9</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/url-to-options@1.0.1</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/stevenvachon/url-to-options#readme</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/stevenvachon/url-to-options/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git+https://github.com/stevenvachon/url-to-options.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/content-disposition@0.5.3">
            <name>content-disposition</name>
            <version>0.5.3</version>
            <description>
                <![CDATA[Create and parse Content-Disposition header]]>
            </description>
            <hashes>
                <hash alg="SHA-1">e130caf7e7279087c5616c2007d0485698984fbd</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/content-disposition@0.5.3</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/jshttp/content-disposition#readme</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/jshttp/content-disposition/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git+https://github.com/jshttp/content-disposition.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/decompress@4.2.1">
            <name>decompress</name>
            <version>4.2.1</version>
            <description>
                <![CDATA[Extracting archives made easy]]>
            </description>
            <hashes>
                <hash alg="SHA-1">007f55cc6a62c055afa37c07eb6a4ee1b773f118</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/decompress@4.2.1</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/kevva/decompress#readme</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/kevva/decompress/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git+https://github.com/kevva/decompress.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/decompress-tar@4.1.1">
            <name>decompress-tar</name>
            <version>4.1.1</version>
            <description>
                <![CDATA[decompress tar plugin]]>
            </description>
            <hashes>
                <hash alg="SHA-1">718cbd3fcb16209716e70a26b84e7ba4592e5af1</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/decompress-tar@4.1.1</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/kevva/decompress-tar#readme</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/kevva/decompress-tar/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git+https://github.com/kevva/decompress-tar.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/file-type@5.2.0">
            <name>file-type</name>
            <version>5.2.0</version>
            <description>
                <![CDATA[Detect the file type of a Buffer/Uint8Array]]>
            </description>
            <hashes>
                <hash alg="SHA-1">2ddbea7c73ffe36368dfae49dc338c058c2b8ad6</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/file-type@5.2.0</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/sindresorhus/file-type#readme</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/sindresorhus/file-type/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git+https://github.com/sindresorhus/file-type.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/is-stream@1.1.0">
            <name>is-stream</name>
            <version>1.1.0</version>
            <description>
                <![CDATA[Check if something is a Node.js stream]]>
            </description>
            <hashes>
                <hash alg="SHA-1">12d4a3dd4e68e0b79ceb8dbc84173ae80d91ca44</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/is-stream@1.1.0</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/sindresorhus/is-stream#readme</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/sindresorhus/is-stream/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git+https://github.com/sindresorhus/is-stream.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/tar-stream@1.6.2">
            <name>tar-stream</name>
            <version>1.6.2</version>
            <description>
                <![CDATA[tar-stream is a streaming tar parser and generator and nothing else. It is streams2 and operates purely using streams which means you can easily extract/parse tarballs without ever hitting the file system.]]>
            </description>
            <hashes>
                <hash alg="SHA-1">8ea55dab37972253d9a9af90fdcd559ae435c555</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/tar-stream@1.6.2</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/mafintosh/tar-stream</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/mafintosh/tar-stream/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git+https://github.com/mafintosh/tar-stream.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/bl@1.2.2">
            <name>bl</name>
            <version>1.2.2</version>
            <description>
                <![CDATA[Buffer List: collect buffers and access with a standard readable Buffer interface, streamable too!]]>
            </description>
            <hashes>
                <hash alg="SHA-1">a160911717103c07410cef63ef51b397c025af9c</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/bl@1.2.2</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/rvagg/bl</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/rvagg/bl/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git+https://github.com/rvagg/bl.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/readable-stream@2.3.7">
            <name>readable-stream</name>
            <version>2.3.7</version>
            <description>
                <![CDATA[Streams3, a user-land copy of the stream library from Node.js]]>
            </description>
            <hashes>
                <hash alg="SHA-1">1eca1cf711aef814c04f62252a36a62f6cb23b57</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/readable-stream@2.3.7</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/nodejs/readable-stream#readme</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/nodejs/readable-stream/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git://github.com/nodejs/readable-stream.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/core-util-is@1.0.2">
            <name>core-util-is</name>
            <version>1.0.2</version>
            <description>
                <![CDATA[The `util.is*` functions introduced in Node v0.12.]]>
            </description>
            <hashes>
                <hash alg="SHA-1">b5fd54220aa2bc5ab57aab7140c940754503c1a7</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/core-util-is@1.0.2</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/isaacs/core-util-is#readme</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/isaacs/core-util-is/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git://github.com/isaacs/core-util-is.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/process-nextick-args@2.0.1">
            <name>process-nextick-args</name>
            <version>2.0.1</version>
            <description>
                <![CDATA[process.nextTick but always with args]]>
            </description>
            <hashes>
                <hash alg="SHA-1">7820d9b16120cc55ca9ae7792680ae7dba6d7fe2</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/process-nextick-args@2.0.1</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/calvinmetcalf/process-nextick-args</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/calvinmetcalf/process-nextick-args/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git+https://github.com/calvinmetcalf/process-nextick-args.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/string_decoder@1.1.1">
            <name>string_decoder</name>
            <version>1.1.1</version>
            <description>
                <![CDATA[The string_decoder module from Node core]]>
            </description>
            <hashes>
                <hash alg="SHA-1">9cf1611ba62685d7030ae9e4ba34149c3af03fc8</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/string_decoder@1.1.1</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/nodejs/string_decoder</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/nodejs/string_decoder/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git://github.com/nodejs/string_decoder.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/util-deprecate@1.0.2">
            <name>util-deprecate</name>
            <version>1.0.2</version>
            <description>
                <![CDATA[The Node.js `util.deprecate()` function with browser support]]>
            </description>
            <hashes>
                <hash alg="SHA-1">450d4dc9fa70de732762fbd2d4a28981419a0ccf</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/util-deprecate@1.0.2</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/TooTallNate/util-deprecate</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/TooTallNate/util-deprecate/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git://github.com/TooTallNate/util-deprecate.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/buffer-alloc@1.2.0">
            <name>buffer-alloc</name>
            <version>1.2.0</version>
            <description>
                <![CDATA[A [ponyfill](https://ponyfill.com) for `Buffer.alloc`.]]>
            </description>
            <hashes>
                <hash alg="SHA-1">890dd90d923a873e08e10e5fd51a57e5b7cce0ec</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/buffer-alloc@1.2.0</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/LinusU/buffer-alloc#readme</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/LinusU/buffer-alloc/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git+https://github.com/LinusU/buffer-alloc.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/buffer-alloc-unsafe@1.1.0">
            <name>buffer-alloc-unsafe</name>
            <version>1.1.0</version>
            <description>
                <![CDATA[A [ponyfill](https://ponyfill.com) for `Buffer.allocUnsafe`.]]>
            </description>
            <hashes>
                <hash alg="SHA-1">bd7dc26ae2972d0eda253be061dba992349c19f0</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/buffer-alloc-unsafe@1.1.0</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/LinusU/buffer-alloc-unsafe#readme</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/LinusU/buffer-alloc-unsafe/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git+https://github.com/LinusU/buffer-alloc-unsafe.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/buffer-fill@1.0.0">
            <name>buffer-fill</name>
            <version>1.0.0</version>
            <description>
                <![CDATA[A [ponyfill](https://ponyfill.com) for `Buffer.fill`.]]>
            </description>
            <hashes>
                <hash alg="SHA-1">f8f78b76789888ef39f205cd637f68e702122b2c</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/buffer-fill@1.0.0</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/LinusU/buffer-fill#readme</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/LinusU/buffer-fill/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git+https://github.com/LinusU/buffer-fill.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/end-of-stream@1.4.4">
            <name>end-of-stream</name>
            <version>1.4.4</version>
            <description>
                <![CDATA[Call a callback when a readable/writable/duplex stream has completed or failed.]]>
            </description>
            <hashes>
                <hash alg="SHA-1">5ae64a5f45057baf3626ec14da0ca5e4b2431eb0</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/end-of-stream@1.4.4</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/mafintosh/end-of-stream</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/mafintosh/end-of-stream/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git://github.com/mafintosh/end-of-stream.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/once@1.4.0">
            <name>once</name>
            <version>1.4.0</version>
            <description>
                <![CDATA[Run a function exactly one time]]>
            </description>
            <hashes>
                <hash alg="SHA-1">583b1aa775961d4b113ac17d9c50baef9dd76bd1</hash>
            </hashes>
            <licenses>
                <license>
                    <id>ISC</id>
                </license>
            </licenses>
            <purl>pkg:npm/once@1.4.0</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/isaacs/once#readme</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/isaacs/once/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git://github.com/isaacs/once.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/wrappy@1.0.2">
            <name>wrappy</name>
            <version>1.0.2</version>
            <description>
                <![CDATA[Callback wrapping utility]]>
            </description>
            <hashes>
                <hash alg="SHA-1">b5243d8f3ec1aa35f1364605bc0d1036e30ab69f</hash>
            </hashes>
            <licenses>
                <license>
                    <id>ISC</id>
                </license>
            </licenses>
            <purl>pkg:npm/wrappy@1.0.2</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/npm/wrappy</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/npm/wrappy/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git+https://github.com/npm/wrappy.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/fs-constants@1.0.0">
            <name>fs-constants</name>
            <version>1.0.0</version>
            <description>
                <![CDATA[Require constants across node and the browser]]>
            </description>
            <hashes>
                <hash alg="SHA-1">6be0de9be998ce16af8afc24497b9ee9b7ccd9ad</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/fs-constants@1.0.0</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/mafintosh/fs-constants</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/mafintosh/fs-constants/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git+https://github.com/mafintosh/fs-constants.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/to-buffer@1.1.1">
            <name>to-buffer</name>
            <version>1.1.1</version>
            <description>
                <![CDATA[Pass in a string, get a buffer back. Pass in a buffer, get the same buffer back]]>
            </description>
            <hashes>
                <hash alg="SHA-1">493bd48f62d7c43fcded313a03dcadb2e1213a80</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/to-buffer@1.1.1</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/mafintosh/to-buffer</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/mafintosh/to-buffer/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git+https://github.com/mafintosh/to-buffer.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/xtend@4.0.2">
            <name>xtend</name>
            <version>4.0.2</version>
            <description>
                <![CDATA[extend like a boss]]>
            </description>
            <hashes>
                <hash alg="SHA-1">bb72779f5fa465186b1f438f674fa347fdb5db54</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/xtend@4.0.2</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/Raynos/xtend</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/Raynos/xtend/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git://github.com/Raynos/xtend.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/decompress-tarbz2@4.1.1">
            <name>decompress-tarbz2</name>
            <version>4.1.1</version>
            <description>
                <![CDATA[decompress tar.bz2 plugin]]>
            </description>
            <hashes>
                <hash alg="SHA-1">3082a5b880ea4043816349f378b56c516be1a39b</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/decompress-tarbz2@4.1.1</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/kevva/decompress-tarbz2#readme</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/kevva/decompress-tarbz2/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git+https://github.com/kevva/decompress-tarbz2.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/file-type@6.2.0">
            <name>file-type</name>
            <version>6.2.0</version>
            <description>
                <![CDATA[Detect the file type of a Buffer/Uint8Array]]>
            </description>
            <hashes>
                <hash alg="SHA-1">e50cd75d356ffed4e306dc4f5bcf52a79903a919</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/file-type@6.2.0</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/sindresorhus/file-type#readme</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/sindresorhus/file-type/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git+https://github.com/sindresorhus/file-type.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/seek-bzip@1.0.5">
            <name>seek-bzip</name>
            <version>1.0.5</version>
            <description>
                <![CDATA[a pure-JavaScript Node.JS module for random-access decoding bzip2 data]]>
            </description>
            <hashes>
                <hash alg="SHA-1">cfe917cb3d274bcffac792758af53173eb1fabdc</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/seek-bzip@1.0.5</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/cscott/seek-bzip#readme</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/cscott/seek-bzip/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git+https://github.com/cscott/seek-bzip.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/commander@2.8.1">
            <name>commander</name>
            <version>2.8.1</version>
            <description>
                <![CDATA[the complete solution for node.js command-line programs]]>
            </description>
            <hashes>
                <hash alg="SHA-1">06be367febfda0c330aa1e2a072d3dc9762425d4</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/commander@2.8.1</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/tj/commander.js#readme</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/tj/commander.js/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git+https://github.com/tj/commander.js.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/graceful-readlink@1.0.1">
            <name>graceful-readlink</name>
            <version>1.0.1</version>
            <description>
                <![CDATA[graceful fs.readlink]]>
            </description>
            <hashes>
                <hash alg="SHA-1">4cafad76bc62f02fa039b2f94e9a3dd3a391a725</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/graceful-readlink@1.0.1</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/zhiyelee/graceful-readlink</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/zhiyelee/graceful-readlink/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git://github.com/zhiyelee/graceful-readlink.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/unbzip2-stream@1.4.3">
            <name>unbzip2-stream</name>
            <version>1.4.3</version>
            <description>
                <![CDATA[streaming unbzip2 implementation in pure javascript for node and browsers]]>
            </description>
            <hashes>
                <hash alg="SHA-1">b0da04c4371311df771cdc215e87f2130991ace7</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/unbzip2-stream@1.4.3</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/regular/unbzip2-stream#readme</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/regular/unbzip2-stream/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git+https://github.com/regular/unbzip2-stream.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/buffer@5.6.0">
            <name>buffer</name>
            <version>5.6.0</version>
            <description>
                <![CDATA[Node.js Buffer API, for the browser]]>
            </description>
            <hashes>
                <hash alg="SHA-1">a31749dc7d81d84db08abf937b6b8c4033f62786</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/buffer@5.6.0</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/feross/buffer</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/feross/buffer/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git://github.com/feross/buffer.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/base64-js@1.3.1">
            <name>base64-js</name>
            <version>1.3.1</version>
            <description>
                <![CDATA[Base64 encoding/decoding in pure JS]]>
            </description>
            <hashes>
                <hash alg="SHA-1">58ece8cb75dd07e71ed08c736abc5fac4dbf8df1</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/base64-js@1.3.1</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/beatgammit/base64-js</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/beatgammit/base64-js/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git://github.com/beatgammit/base64-js.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/ieee754@1.1.13">
            <name>ieee754</name>
            <version>1.1.13</version>
            <description>
                <![CDATA[Read/write IEEE754 floating point numbers from/to a Buffer or array-like object]]>
            </description>
            <hashes>
                <hash alg="SHA-1">ec168558e95aa181fd87d37f55c32bbcb6708b84</hash>
            </hashes>
            <licenses>
                <license>
                    <id>BSD-3-Clause</id>
                </license>
            </licenses>
            <purl>pkg:npm/ieee754@1.1.13</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/feross/ieee754#readme</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/feross/ieee754/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git://github.com/feross/ieee754.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/through@2.3.8">
            <name>through</name>
            <version>2.3.8</version>
            <description>
                <![CDATA[simplified stream construction]]>
            </description>
            <hashes>
                <hash alg="SHA-1">0dd4c9ffaabc357960b1b724115d7e0e86a2e1f5</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/through@2.3.8</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/dominictarr/through</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/dominictarr/through/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git+https://github.com/dominictarr/through.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/decompress-targz@4.1.1">
            <name>decompress-targz</name>
            <version>4.1.1</version>
            <description>
                <![CDATA[decompress tar.gz plugin]]>
            </description>
            <hashes>
                <hash alg="SHA-1">c09bc35c4d11f3de09f2d2da53e9de23e7ce1eee</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/decompress-targz@4.1.1</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/kevva/decompress-targz#readme</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/kevva/decompress-targz/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git+https://github.com/kevva/decompress-targz.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/decompress-unzip@4.0.1">
            <name>decompress-unzip</name>
            <version>4.0.1</version>
            <description>
                <![CDATA[decompress zip plugin]]>
            </description>
            <hashes>
                <hash alg="SHA-1">deaaccdfd14aeaf85578f733ae8210f9b4848f69</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/decompress-unzip@4.0.1</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/kevva/decompress-unzip#readme</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/kevva/decompress-unzip/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git+https://github.com/kevva/decompress-unzip.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/file-type@3.9.0">
            <name>file-type</name>
            <version>3.9.0</version>
            <description>
                <![CDATA[Detect the file type of a Buffer/Uint8Array]]>
            </description>
            <hashes>
                <hash alg="SHA-1">257a078384d1db8087bc449d107d52a52672b9e9</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/file-type@3.9.0</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/sindresorhus/file-type#readme</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/sindresorhus/file-type/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git+https://github.com/sindresorhus/file-type.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/get-stream@2.3.1">
            <name>get-stream</name>
            <version>2.3.1</version>
            <description>
                <![CDATA[Get a stream as a string, buffer, or array]]>
            </description>
            <hashes>
                <hash alg="SHA-1">5f38f93f346009666ee0150a054167f91bdd95de</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/get-stream@2.3.1</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/sindresorhus/get-stream#readme</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/sindresorhus/get-stream/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git+https://github.com/sindresorhus/get-stream.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/pinkie-promise@2.0.1">
            <name>pinkie-promise</name>
            <version>2.0.1</version>
            <description>
                <![CDATA[ES2015 Promise ponyfill]]>
            </description>
            <hashes>
                <hash alg="SHA-1">2135d6dfa7a358c069ac9b178776288228450ffa</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/pinkie-promise@2.0.1</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/floatdrop/pinkie-promise#readme</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/floatdrop/pinkie-promise/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git+https://github.com/floatdrop/pinkie-promise.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/pinkie@2.0.4">
            <name>pinkie</name>
            <version>2.0.4</version>
            <description>
                <![CDATA[Itty bitty little widdle twinkie pinkie ES2015 Promise implementation]]>
            </description>
            <hashes>
                <hash alg="SHA-1">72556b80cfa0d48a974e80e77248e80ed4f7f870</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/pinkie@2.0.4</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/floatdrop/pinkie#readme</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/floatdrop/pinkie/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git+https://github.com/floatdrop/pinkie.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/pify@2.3.0">
            <name>pify</name>
            <version>2.3.0</version>
            <description>
                <![CDATA[Promisify a callback-style function]]>
            </description>
            <hashes>
                <hash alg="SHA-1">ed141a6ac043a849ea588498e7dca8b15330e90c</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/pify@2.3.0</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/sindresorhus/pify#readme</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/sindresorhus/pify/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git+https://github.com/sindresorhus/pify.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/yauzl@2.10.0">
            <name>yauzl</name>
            <version>2.10.0</version>
            <description>
                <![CDATA[yet another unzip library for node]]>
            </description>
            <hashes>
                <hash alg="SHA-1">c7eb17c93e112cb1086fa6d8e51fb0667b79a5f9</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/yauzl@2.10.0</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/thejoshwolfe/yauzl</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/thejoshwolfe/yauzl/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git+https://github.com/thejoshwolfe/yauzl.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/buffer-crc32@0.2.13">
            <name>buffer-crc32</name>
            <version>0.2.13</version>
            <description>
                <![CDATA[A pure javascript CRC32 algorithm that plays nice with binary data]]>
            </description>
            <hashes>
                <hash alg="SHA-1">0d333e3f00eac50aa1454abd30ef8c2a5d9a7242</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/buffer-crc32@0.2.13</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/brianloveswords/buffer-crc32</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/brianloveswords/buffer-crc32/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git://github.com/brianloveswords/buffer-crc32.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/fd-slicer@1.1.0">
            <name>fd-slicer</name>
            <version>1.1.0</version>
            <description>
                <![CDATA[safely create multiple ReadStream or WriteStream objects from the same file descriptor]]>
            </description>
            <hashes>
                <hash alg="SHA-1">25c7c89cb1f9077f8891bbe61d8f390eae256f1e</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/fd-slicer@1.1.0</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/andrewrk/node-fd-slicer#readme</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/andrewrk/node-fd-slicer/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git://github.com/andrewrk/node-fd-slicer.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/pend@1.2.0">
            <name>pend</name>
            <version>1.2.0</version>
            <description>
                <![CDATA[dead-simple optimistic async helper]]>
            </description>
            <hashes>
                <hash alg="SHA-1">7a57eb550a6783f9115331fcf4663d5c8e007a50</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/pend@1.2.0</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/andrewrk/node-pend#readme</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/andrewrk/node-pend/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git://github.com/andrewrk/node-pend.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/make-dir@1.3.0">
            <name>make-dir</name>
            <version>1.3.0</version>
            <description>
                <![CDATA[Make a directory and its parents if needed - Think `mkdir -p`]]>
            </description>
            <hashes>
                <hash alg="SHA-1">79c1033b80515bd6d24ec9933e860ca75ee27f0c</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/make-dir@1.3.0</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/sindresorhus/make-dir#readme</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/sindresorhus/make-dir/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git+https://github.com/sindresorhus/make-dir.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/strip-dirs@2.1.0">
            <name>strip-dirs</name>
            <version>2.1.0</version>
            <description>
                <![CDATA[Remove leading directory components from a path, like tar's --strip-components option]]>
            </description>
            <hashes>
                <hash alg="SHA-1">4987736264fc344cf20f6c34aca9d13d1d4ed6c5</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/strip-dirs@2.1.0</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/shinnn/node-strip-dirs#readme</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/shinnn/node-strip-dirs/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git+https://github.com/shinnn/node-strip-dirs.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/is-natural-number@4.0.1">
            <name>is-natural-number</name>
            <version>4.0.1</version>
            <description>
                <![CDATA[Check if a value is a natural number]]>
            </description>
            <hashes>
                <hash alg="SHA-1">ab9d76e1db4ced51e35de0c72ebecf09f734cde8</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/is-natural-number@4.0.1</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/shinnn/is-natural-number.js#readme</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/shinnn/is-natural-number.js/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git+https://github.com/shinnn/is-natural-number.js.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/ext-name@5.0.0">
            <name>ext-name</name>
            <version>5.0.0</version>
            <description>
                <![CDATA[Get the file extension and MIME type from a file]]>
            </description>
            <hashes>
                <hash alg="SHA-1">70781981d183ee15d13993c8822045c506c8f0a6</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/ext-name@5.0.0</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/kevva/ext-name#readme</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/kevva/ext-name/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git+https://github.com/kevva/ext-name.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/ext-list@2.2.2">
            <name>ext-list</name>
            <version>2.2.2</version>
            <description>
                <![CDATA[List of known file extensions and their MIME types]]>
            </description>
            <hashes>
                <hash alg="SHA-1">0b98e64ed82f5acf0f2931babf69212ef52ddd37</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/ext-list@2.2.2</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/kevva/ext-list#readme</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/kevva/ext-list/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git+https://github.com/kevva/ext-list.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/sort-keys-length@1.0.1">
            <name>sort-keys-length</name>
            <version>1.0.1</version>
            <description>
                <![CDATA[Sort objecy keys by length]]>
            </description>
            <hashes>
                <hash alg="SHA-1">9cb6f4f4e9e48155a6aa0671edd336ff1479a188</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/sort-keys-length@1.0.1</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/kevva/sort-keys-length#readme</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/kevva/sort-keys-length/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git+https://github.com/kevva/sort-keys-length.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/sort-keys@1.1.2">
            <name>sort-keys</name>
            <version>1.1.2</version>
            <description>
                <![CDATA[Sort the keys of an object]]>
            </description>
            <hashes>
                <hash alg="SHA-1">441b6d4d346798f1b4e49e8920adfba0e543f9ad</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/sort-keys@1.1.2</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/sindresorhus/sort-keys#readme</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/sindresorhus/sort-keys/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git+https://github.com/sindresorhus/sort-keys.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/is-plain-obj@1.1.0">
            <name>is-plain-obj</name>
            <version>1.1.0</version>
            <description>
                <![CDATA[Check if a value is a plain object]]>
            </description>
            <hashes>
                <hash alg="SHA-1">71a50c8429dfca773c92a390a4a03b39fcd51d3e</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/is-plain-obj@1.1.0</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/sindresorhus/is-plain-obj#readme</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/sindresorhus/is-plain-obj/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git+https://github.com/sindresorhus/is-plain-obj.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/file-type@8.1.0">
            <name>file-type</name>
            <version>8.1.0</version>
            <description>
                <![CDATA[Detect the file type of a Buffer/Uint8Array]]>
            </description>
            <hashes>
                <hash alg="SHA-1">244f3b7ef641bbe0cca196c7276e4b332399f68c</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/file-type@8.1.0</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/sindresorhus/file-type#readme</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/sindresorhus/file-type/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git+https://github.com/sindresorhus/file-type.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/filenamify@2.1.0">
            <name>filenamify</name>
            <version>2.1.0</version>
            <description>
                <![CDATA[Convert a string to a valid safe filename]]>
            </description>
            <hashes>
                <hash alg="SHA-1">88faf495fb1b47abfd612300002a16228c677ee9</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/filenamify@2.1.0</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/sindresorhus/filenamify#readme</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/sindresorhus/filenamify/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git+https://github.com/sindresorhus/filenamify.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/filename-reserved-regex@2.0.0">
            <name>filename-reserved-regex</name>
            <version>2.0.0</version>
            <description>
                <![CDATA[Regular expression for matching reserved filename characters]]>
            </description>
            <hashes>
                <hash alg="SHA-1">abf73dfab735d045440abfea2d91f389ebbfa229</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/filename-reserved-regex@2.0.0</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/sindresorhus/filename-reserved-regex#readme</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/sindresorhus/filename-reserved-regex/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git+https://github.com/sindresorhus/filename-reserved-regex.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/strip-outer@1.0.1">
            <name>strip-outer</name>
            <version>1.0.1</version>
            <description>
                <![CDATA[Strip a substring from the start/end of a string]]>
            </description>
            <hashes>
                <hash alg="SHA-1">b2fd2abf6604b9d1e6013057195df836b8a9d631</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/strip-outer@1.0.1</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/sindresorhus/strip-outer#readme</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/sindresorhus/strip-outer/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git+https://github.com/sindresorhus/strip-outer.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/trim-repeated@1.0.0">
            <name>trim-repeated</name>
            <version>1.0.0</version>
            <description>
                <![CDATA[Trim a consecutively repeated substring: foo--bar---baz → foo-bar-baz]]>
            </description>
            <hashes>
                <hash alg="SHA-1">e3646a2ea4e891312bf7eace6cfb05380bc01c21</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/trim-repeated@1.0.0</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/sindresorhus/trim-repeated#readme</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/sindresorhus/trim-repeated/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git+https://github.com/sindresorhus/trim-repeated.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/get-stream@3.0.0">
            <name>get-stream</name>
            <version>3.0.0</version>
            <description>
                <![CDATA[Get a stream as a string, buffer, or array]]>
            </description>
            <hashes>
                <hash alg="SHA-1">8e943d1358dc37555054ecbe2edb05aa174ede14</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/get-stream@3.0.0</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/sindresorhus/get-stream#readme</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/sindresorhus/get-stream/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git+https://github.com/sindresorhus/get-stream.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/got@8.3.2">
            <name>got</name>
            <version>8.3.2</version>
            <description>
                <![CDATA[Simplified HTTP requests]]>
            </description>
            <hashes>
                <hash alg="SHA-1">1d23f64390e97f776cac52e5b936e5f514d2e937</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/got@8.3.2</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/sindresorhus/got#readme</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/sindresorhus/got/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git+https://github.com/sindresorhus/got.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/%40sindresorhus/is@0.7.0">
            <group>@sindresorhus</group>
            <name>is</name>
            <version>0.7.0</version>
            <description>
                <![CDATA[Type check values: `is.string('🦄') //=> true`]]>
            </description>
            <hashes>
                <hash alg="SHA-1">9a06f4f137ee84d7df0460c1fdb1135ffa6c50fd</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/%40sindresorhus/is@0.7.0</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/sindresorhus/is#readme</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/sindresorhus/is/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git+https://github.com/sindresorhus/is.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/cacheable-request@2.1.4">
            <name>cacheable-request</name>
            <version>2.1.4</version>
            <description>
                <![CDATA[Wrap native HTTP requests with RFC compliant cache support]]>
            </description>
            <hashes>
                <hash alg="SHA-1">0d808801b6342ad33c91df9d0b44dc09b91e5c3d</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/cacheable-request@2.1.4</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/lukechilds/cacheable-request</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/lukechilds/cacheable-request/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git+https://github.com/lukechilds/cacheable-request.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/clone-response@1.0.2">
            <name>clone-response</name>
            <version>1.0.2</version>
            <description>
                <![CDATA[Clone a Node.js HTTP response stream]]>
            </description>
            <hashes>
                <hash alg="SHA-1">d1dc973920314df67fbeb94223b4ee350239e96b</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/clone-response@1.0.2</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/lukechilds/clone-response</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/lukechilds/clone-response/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git+https://github.com/lukechilds/clone-response.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/mimic-response@1.0.1">
            <name>mimic-response</name>
            <version>1.0.1</version>
            <description>
                <![CDATA[Mimic a Node.js HTTP response stream]]>
            </description>
            <hashes>
                <hash alg="SHA-1">4923538878eef42063cb8a3e3b0798781487ab1b</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/mimic-response@1.0.1</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/sindresorhus/mimic-response#readme</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/sindresorhus/mimic-response/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git+https://github.com/sindresorhus/mimic-response.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/http-cache-semantics@3.8.1">
            <name>http-cache-semantics</name>
            <version>3.8.1</version>
            <description>
                <![CDATA[Parses Cache-Control and other headers. Helps building correct HTTP caches and proxies]]>
            </description>
            <hashes>
                <hash alg="SHA-1">39b0e16add9b605bf0a9ef3d9daaf4843b4cacd2</hash>
            </hashes>
            <licenses>
                <license>
                    <id>BSD-2-Clause</id>
                </license>
            </licenses>
            <purl>pkg:npm/http-cache-semantics@3.8.1</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/pornel/http-cache-semantics#readme</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/pornel/http-cache-semantics/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git+https://github.com/pornel/http-cache-semantics.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/keyv@3.0.0">
            <name>keyv</name>
            <version>3.0.0</version>
            <description>
                <![CDATA[Simple key-value storage with support for multiple backends]]>
            </description>
            <hashes>
                <hash alg="SHA-1">44923ba39e68b12a7cec7df6c3268c031f2ef373</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/keyv@3.0.0</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/lukechilds/keyv</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/lukechilds/keyv/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git+https://github.com/lukechilds/keyv.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/json-buffer@3.0.0">
            <name>json-buffer</name>
            <version>3.0.0</version>
            <description>
                <![CDATA[JSON parse & stringify that supports binary via bops & base64]]>
            </description>
            <hashes>
                <hash alg="SHA-1">5b1f397afc75d677bde8bcfc0e47e1f9a3d9a898</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/json-buffer@3.0.0</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/dominictarr/json-buffer</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/dominictarr/json-buffer/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git://github.com/dominictarr/json-buffer.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/lowercase-keys@1.0.0">
            <name>lowercase-keys</name>
            <version>1.0.0</version>
            <description>
                <![CDATA[Lowercase the keys of an object]]>
            </description>
            <hashes>
                <hash alg="SHA-1">4e3366b39e7f5457e35f1324bdf6f88d0bfc7306</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/lowercase-keys@1.0.0</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/sindresorhus/lowercase-keys#readme</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/sindresorhus/lowercase-keys/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git+https://github.com/sindresorhus/lowercase-keys.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/normalize-url@2.0.1">
            <name>normalize-url</name>
            <version>2.0.1</version>
            <description>
                <![CDATA[Normalize a URL]]>
            </description>
            <hashes>
                <hash alg="SHA-1">835a9da1551fa26f70e92329069a23aa6574d7e6</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/normalize-url@2.0.1</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/sindresorhus/normalize-url#readme</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/sindresorhus/normalize-url/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git+https://github.com/sindresorhus/normalize-url.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/prepend-http@2.0.0">
            <name>prepend-http</name>
            <version>2.0.0</version>
            <description>
                <![CDATA[Prepend `http://` to humanized URLs like todomvc.com and localhost]]>
            </description>
            <hashes>
                <hash alg="SHA-1">e92434bfa5ea8c19f41cdfd401d741a3c819d897</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/prepend-http@2.0.0</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/sindresorhus/prepend-http#readme</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/sindresorhus/prepend-http/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git+https://github.com/sindresorhus/prepend-http.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/query-string@5.1.1">
            <name>query-string</name>
            <version>5.1.1</version>
            <description>
                <![CDATA[Parse and stringify URL query strings]]>
            </description>
            <hashes>
                <hash alg="SHA-1">a78c012b71c17e05f2e3fa2319dd330682efb3cb</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/query-string@5.1.1</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/sindresorhus/query-string#readme</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/sindresorhus/query-string/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git+https://github.com/sindresorhus/query-string.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/strict-uri-encode@1.1.0">
            <name>strict-uri-encode</name>
            <version>1.1.0</version>
            <description>
                <![CDATA[A stricter URI encode adhering to RFC 3986]]>
            </description>
            <hashes>
                <hash alg="SHA-1">279b225df1d582b1f54e65addd4352e18faa0713</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/strict-uri-encode@1.1.0</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/kevva/strict-uri-encode#readme</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/kevva/strict-uri-encode/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git+https://github.com/kevva/strict-uri-encode.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/sort-keys@2.0.0">
            <name>sort-keys</name>
            <version>2.0.0</version>
            <description>
                <![CDATA[Sort the keys of an object]]>
            </description>
            <hashes>
                <hash alg="SHA-1">658535584861ec97d730d6cf41822e1f56684128</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/sort-keys@2.0.0</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/sindresorhus/sort-keys#readme</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/sindresorhus/sort-keys/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git+https://github.com/sindresorhus/sort-keys.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/responselike@1.0.2">
            <name>responselike</name>
            <version>1.0.2</version>
            <description>
                <![CDATA[A response-like object for mocking a Node.js HTTP response stream]]>
            </description>
            <hashes>
                <hash alg="SHA-1">918720ef3b631c5642be068f15ade5a46f4ba1e7</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/responselike@1.0.2</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/lukechilds/responselike#readme</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/lukechilds/responselike/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git+https://github.com/lukechilds/responselike.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/lowercase-keys@1.0.1">
            <name>lowercase-keys</name>
            <version>1.0.1</version>
            <description>
                <![CDATA[Lowercase the keys of an object]]>
            </description>
            <hashes>
                <hash alg="SHA-1">6f9e30b47084d971a7c820ff15a6c5167b74c26f</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/lowercase-keys@1.0.1</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/sindresorhus/lowercase-keys#readme</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/sindresorhus/lowercase-keys/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git+https://github.com/sindresorhus/lowercase-keys.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/decompress-response@3.3.0">
            <name>decompress-response</name>
            <version>3.3.0</version>
            <description>
                <![CDATA[Decompress a HTTP response if needed]]>
            </description>
            <hashes>
                <hash alg="SHA-1">80a4dd323748384bfa248083622aedec982adff3</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/decompress-response@3.3.0</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/sindresorhus/decompress-response#readme</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/sindresorhus/decompress-response/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git+https://github.com/sindresorhus/decompress-response.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/duplexer3@0.1.4">
            <name>duplexer3</name>
            <version>0.1.4</version>
            <description>
                <![CDATA[Like duplexer but using streams3]]>
            </description>
            <hashes>
                <hash alg="SHA-1">ee01dd1cac0ed3cbc7fdbea37dc0a8f1ce002ce2</hash>
            </hashes>
            <licenses>
                <license>
                    <id>BSD-3-Clause</id>
                </license>
            </licenses>
            <purl>pkg:npm/duplexer3@0.1.4</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/floatdrop/duplexer3#readme</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/floatdrop/duplexer3/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git+https://github.com/floatdrop/duplexer3.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/into-stream@3.1.0">
            <name>into-stream</name>
            <version>3.1.0</version>
            <description>
                <![CDATA[Convert a buffer/string/array/object/iterable/promise into a stream]]>
            </description>
            <hashes>
                <hash alg="SHA-1">96fb0a936c12babd6ff1752a17d05616abd094c6</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/into-stream@3.1.0</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/sindresorhus/into-stream#readme</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/sindresorhus/into-stream/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git+https://github.com/sindresorhus/into-stream.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/from2@2.3.0">
            <name>from2</name>
            <version>2.3.0</version>
            <description>
                <![CDATA[Convenience wrapper for ReadableStream, with an API lifted from "from" and "through2"]]>
            </description>
            <hashes>
                <hash alg="SHA-1">8bfb5502bde4a4d36cfdeea007fcca21d7e382af</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/from2@2.3.0</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/hughsk/from2</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/hughsk/from2/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git://github.com/hughsk/from2.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/p-is-promise@1.1.0">
            <name>p-is-promise</name>
            <version>1.1.0</version>
            <description>
                <![CDATA[Check if something is a promise]]>
            </description>
            <hashes>
                <hash alg="SHA-1">9c9456989e9f6588017b0434d56097675c3da05e</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/p-is-promise@1.1.0</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/sindresorhus/p-is-promise#readme</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/sindresorhus/p-is-promise/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git+https://github.com/sindresorhus/p-is-promise.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/is-retry-allowed@1.2.0">
            <name>is-retry-allowed</name>
            <version>1.2.0</version>
            <description>
                <![CDATA[Is retry allowed for Error?]]>
            </description>
            <hashes>
                <hash alg="SHA-1">d778488bd0a4666a3be8a1482b9f2baafedea8b4</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/is-retry-allowed@1.2.0</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/floatdrop/is-retry-allowed#readme</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/floatdrop/is-retry-allowed/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git+https://github.com/floatdrop/is-retry-allowed.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/p-cancelable@0.4.1">
            <name>p-cancelable</name>
            <version>0.4.1</version>
            <description>
                <![CDATA[Create a promise that can be canceled]]>
            </description>
            <hashes>
                <hash alg="SHA-1">35f363d67d52081c8d9585e37bcceb7e0bbcb2a0</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/p-cancelable@0.4.1</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/sindresorhus/p-cancelable#readme</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/sindresorhus/p-cancelable/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git+https://github.com/sindresorhus/p-cancelable.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/p-timeout@2.0.1">
            <name>p-timeout</name>
            <version>2.0.1</version>
            <description>
                <![CDATA[Timeout a promise after a specified amount of time]]>
            </description>
            <hashes>
                <hash alg="SHA-1">d8dd1979595d2dc0139e1fe46b8b646cb3cdf038</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/p-timeout@2.0.1</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/sindresorhus/p-timeout#readme</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/sindresorhus/p-timeout/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git+https://github.com/sindresorhus/p-timeout.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/p-finally@1.0.0">
            <name>p-finally</name>
            <version>1.0.0</version>
            <description>
                <![CDATA[`Promise#finally()` ponyfill - Invoked when the promise is settled regardless of outcome]]>
            </description>
            <hashes>
                <hash alg="SHA-1">3fbcfb15b899a44123b34b6dcc18b724336a2cae</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/p-finally@1.0.0</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/sindresorhus/p-finally#readme</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/sindresorhus/p-finally/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git+https://github.com/sindresorhus/p-finally.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/timed-out@4.0.1">
            <name>timed-out</name>
            <version>4.0.1</version>
            <description>
                <![CDATA[Emit `ETIMEDOUT` or `ESOCKETTIMEDOUT` when ClientRequest is hanged]]>
            </description>
            <hashes>
                <hash alg="SHA-1">f32eacac5a175bea25d7fab565ab3ed8741ef56f</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/timed-out@4.0.1</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/floatdrop/timed-out#readme</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/floatdrop/timed-out/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git+https://github.com/floatdrop/timed-out.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/url-parse-lax@3.0.0">
            <name>url-parse-lax</name>
            <version>3.0.0</version>
            <description>
                <![CDATA[Lax url.parse() with support for protocol-less URLs & IPs]]>
            </description>
            <hashes>
                <hash alg="SHA-1">16b5cafc07dbe3676c1b1999177823d6503acb0c</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/url-parse-lax@3.0.0</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/sindresorhus/url-parse-lax#readme</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/sindresorhus/url-parse-lax/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git+https://github.com/sindresorhus/url-parse-lax.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/p-event@2.3.1">
            <name>p-event</name>
            <version>2.3.1</version>
            <description>
                <![CDATA[Promisify an event by waiting for it to be emitted]]>
            </description>
            <hashes>
                <hash alg="SHA-1">596279ef169ab2c3e0cae88c1cfbb08079993ef6</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/p-event@2.3.1</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/sindresorhus/p-event#readme</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/sindresorhus/p-event/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git+https://github.com/sindresorhus/p-event.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/errorhandler@1.5.1">
            <name>errorhandler</name>
            <version>1.5.1</version>
            <description>
                <![CDATA[Development-only error handler middleware]]>
            </description>
            <hashes>
                <hash alg="SHA-1">b9ba5d17cf90744cd1e851357a6e75bf806a9a91</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/errorhandler@1.5.1</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/expressjs/errorhandler#readme</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/expressjs/errorhandler/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git+https://github.com/expressjs/errorhandler.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/escape-html@1.0.3">
            <name>escape-html</name>
            <version>1.0.3</version>
            <description>
                <![CDATA[Escape string for use in HTML]]>
            </description>
            <hashes>
                <hash alg="SHA-1">0258eae4d3d0c0974de1c169188ef0051d1d1988</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/escape-html@1.0.3</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/component/escape-html#readme</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/component/escape-html/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git+https://github.com/component/escape-html.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="framework" bom-ref="pkg:npm/express@4.17.1">
            <name>express</name>
            <version>4.17.1</version>
            <description>
                <![CDATA[Fast, unopinionated, minimalist web framework]]>
            </description>
            <hashes>
                <hash alg="SHA-1">4491fc38605cf51f8629d39c2b5d026f98a4c134</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/express@4.17.1</purl>
            <externalReferences>
                <reference type="website">
                    <url>http://expressjs.com/</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/expressjs/express/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git+https://github.com/expressjs/express.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/array-flatten@1.1.1">
            <name>array-flatten</name>
            <version>1.1.1</version>
            <description>
                <![CDATA[Flatten an array of nested arrays into a single flat array]]>
            </description>
            <hashes>
                <hash alg="SHA-1">9a5f699051b1e7073328f2a008968b64ea2955d2</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/array-flatten@1.1.1</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/blakeembrey/array-flatten</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/blakeembrey/array-flatten/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git://github.com/blakeembrey/array-flatten.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/encodeurl@1.0.2">
            <name>encodeurl</name>
            <version>1.0.2</version>
            <description>
                <![CDATA[Encode a URL to a percent-encoded form, excluding already-encoded sequences]]>
            </description>
            <hashes>
                <hash alg="SHA-1">ad3ff4c86ec2d029322f5a02c3a9a606c95b3f59</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/encodeurl@1.0.2</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/pillarjs/encodeurl#readme</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/pillarjs/encodeurl/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git+https://github.com/pillarjs/encodeurl.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/etag@1.8.1">
            <name>etag</name>
            <version>1.8.1</version>
            <description>
                <![CDATA[Create simple HTTP ETags]]>
            </description>
            <hashes>
                <hash alg="SHA-1">41ae2eeb65efa62268aebfea83ac7d79299b0887</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/etag@1.8.1</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/jshttp/etag#readme</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/jshttp/etag/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git+https://github.com/jshttp/etag.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/finalhandler@1.1.2">
            <name>finalhandler</name>
            <version>1.1.2</version>
            <description>
                <![CDATA[Node.js final http responder]]>
            </description>
            <hashes>
                <hash alg="SHA-1">b7e7d000ffd11938d0fdb053506f6ebabe9f587d</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/finalhandler@1.1.2</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/pillarjs/finalhandler#readme</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/pillarjs/finalhandler/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git+https://github.com/pillarjs/finalhandler.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/parseurl@1.3.3">
            <name>parseurl</name>
            <version>1.3.3</version>
            <description>
                <![CDATA[parse a url with memoization]]>
            </description>
            <hashes>
                <hash alg="SHA-1">9da19e7bee8d12dff0513ed5b76957793bc2e8d4</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/parseurl@1.3.3</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/pillarjs/parseurl#readme</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/pillarjs/parseurl/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git+https://github.com/pillarjs/parseurl.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/fresh@0.5.2">
            <name>fresh</name>
            <version>0.5.2</version>
            <description>
                <![CDATA[HTTP response freshness testing]]>
            </description>
            <hashes>
                <hash alg="SHA-1">3d8cadd90d976569fa835ab1f8e4b23a105605a7</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/fresh@0.5.2</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/jshttp/fresh#readme</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/jshttp/fresh/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git+https://github.com/jshttp/fresh.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/merge-descriptors@1.0.1">
            <name>merge-descriptors</name>
            <version>1.0.1</version>
            <description>
                <![CDATA[Merge objects using descriptors]]>
            </description>
            <hashes>
                <hash alg="SHA-1">b00aaa556dd8b44568150ec9d1b953f3f90cbb61</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/merge-descriptors@1.0.1</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/component/merge-descriptors#readme</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/component/merge-descriptors/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git+https://github.com/component/merge-descriptors.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/methods@1.1.2">
            <name>methods</name>
            <version>1.1.2</version>
            <description>
                <![CDATA[HTTP methods that node supports]]>
            </description>
            <hashes>
                <hash alg="SHA-1">5529a4d67654134edcc5266656835b0f851afcee</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/methods@1.1.2</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/jshttp/methods#readme</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/jshttp/methods/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git+https://github.com/jshttp/methods.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/path-to-regexp@0.1.7">
            <name>path-to-regexp</name>
            <version>0.1.7</version>
            <description>
                <![CDATA[Express style path to RegExp utility]]>
            </description>
            <hashes>
                <hash alg="SHA-1">df604178005f522f15eb4490e7247a1bfaa67f8c</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/path-to-regexp@0.1.7</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/component/path-to-regexp#readme</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/component/path-to-regexp/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git+https://github.com/component/path-to-regexp.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/proxy-addr@2.0.6">
            <name>proxy-addr</name>
            <version>2.0.6</version>
            <description>
                <![CDATA[Determine address of proxied request]]>
            </description>
            <hashes>
                <hash alg="SHA-1">fdc2336505447d3f2f2c638ed272caf614bbb2bf</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/proxy-addr@2.0.6</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/jshttp/proxy-addr#readme</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/jshttp/proxy-addr/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git+https://github.com/jshttp/proxy-addr.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/forwarded@0.1.2">
            <name>forwarded</name>
            <version>0.1.2</version>
            <description>
                <![CDATA[Parse HTTP X-Forwarded-For header]]>
            </description>
            <hashes>
                <hash alg="SHA-1">98c23dab1175657b8c0573e8ceccd91b0ff18c84</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/forwarded@0.1.2</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/jshttp/forwarded#readme</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/jshttp/forwarded/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git+https://github.com/jshttp/forwarded.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/ipaddr.js@1.9.1">
            <name>ipaddr.js</name>
            <version>1.9.1</version>
            <description>
                <![CDATA[A library for manipulating IPv4 and IPv6 addresses in JavaScript.]]>
            </description>
            <hashes>
                <hash alg="SHA-1">bff38543eeb8984825079ff3a2a8e6cbd46781b3</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/ipaddr.js@1.9.1</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/whitequark/ipaddr.js#readme</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/whitequark/ipaddr.js/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git://github.com/whitequark/ipaddr.js.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/range-parser@1.2.1">
            <name>range-parser</name>
            <version>1.2.1</version>
            <description>
                <![CDATA[Range header field string parser]]>
            </description>
            <hashes>
                <hash alg="SHA-1">3cf37023d199e1c24d1a55b84800c2f3e6468031</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/range-parser@1.2.1</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/jshttp/range-parser#readme</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/jshttp/range-parser/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git+https://github.com/jshttp/range-parser.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/send@0.17.1">
            <name>send</name>
            <version>0.17.1</version>
            <description>
                <![CDATA[Better streaming static file server with Range and conditional-GET support]]>
            </description>
            <hashes>
                <hash alg="SHA-1">c1d8b059f7900f7466dd4938bdc44e11ddb376c8</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/send@0.17.1</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/pillarjs/send#readme</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/pillarjs/send/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git+https://github.com/pillarjs/send.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/destroy@1.0.4">
            <name>destroy</name>
            <version>1.0.4</version>
            <description>
                <![CDATA[destroy a stream if possible]]>
            </description>
            <hashes>
                <hash alg="SHA-1">978857442c44749e4206613e37946205826abd80</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/destroy@1.0.4</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/stream-utils/destroy#readme</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/stream-utils/destroy/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git+https://github.com/stream-utils/destroy.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/mime@1.6.0">
            <name>mime</name>
            <version>1.6.0</version>
            <description>
                <![CDATA[A comprehensive library for mime-type mapping]]>
            </description>
            <hashes>
                <hash alg="SHA-1">32cd9e5c64553bd58d19a568af452acff04981b1</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/mime@1.6.0</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/broofa/node-mime#readme</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/broofa/node-mime/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git+https://github.com/broofa/node-mime.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/ms@2.1.1">
            <name>ms</name>
            <version>2.1.1</version>
            <description>
                <![CDATA[Tiny millisecond conversion utility]]>
            </description>
            <hashes>
                <hash alg="SHA-1">30a5864eb3ebb0a66f2ebe6d727af06a09d86e0a</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/ms@2.1.1</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/zeit/ms#readme</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/zeit/ms/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git+https://github.com/zeit/ms.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/serve-static@1.14.1">
            <name>serve-static</name>
            <version>1.14.1</version>
            <description>
                <![CDATA[Serve static files]]>
            </description>
            <hashes>
                <hash alg="SHA-1">666e636dc4f010f7ef29970a88a674320898b2f9</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/serve-static@1.14.1</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/expressjs/serve-static#readme</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/expressjs/serve-static/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git+https://github.com/expressjs/serve-static.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/utils-merge@1.0.1">
            <name>utils-merge</name>
            <version>1.0.1</version>
            <description>
                <![CDATA[merge() utility function]]>
            </description>
            <hashes>
                <hash alg="SHA-1">9f95710f50a267947b2ccc124741c1028427e713</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/utils-merge@1.0.1</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/jaredhanson/utils-merge#readme</url>
                </reference>
                <reference type="issue-tracker">
                    <url>http://github.com/jaredhanson/utils-merge/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git://github.com/jaredhanson/utils-merge.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/express-jwt@0.1.3">
            <name>express-jwt</name>
            <version>0.1.3</version>
            <description>
                <![CDATA[JWT authentication middleware.]]>
            </description>
            <hashes>
                <hash alg="SHA-1">7c78221f8b9d72106aff556a8a5b8e852d41b12f</hash>
            </hashes>
            <purl>pkg:npm/express-jwt@0.1.3</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/auth0/express-jwt#readme</url>
                </reference>
                <reference type="issue-tracker">
                    <url>http://github.com/auth0/express-jwt/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git://github.com/auth0/express-jwt.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/jsonwebtoken@0.1.0">
            <name>jsonwebtoken</name>
            <version>0.1.0</version>
            <description>
                <![CDATA[JSON Web Token implementation (symmetric and asymmetric)]]>
            </description>
            <hashes>
                <hash alg="SHA-1">505628492092fe35d08b600fa6768cd06711aaa2</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/jsonwebtoken@0.1.0</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/auth0/node-jsonwebtoken#readme</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/auth0/node-jsonwebtoken/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git+https://github.com/auth0/node-jsonwebtoken.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/jws@0.2.6">
            <name>jws</name>
            <version>0.2.6</version>
            <description>
                <![CDATA[Implementation of JSON Web Signatures]]>
            </description>
            <hashes>
                <hash alg="SHA-1">e9b7e9ac8d2ac1067413233bc6c20fbd8868e9ba</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/jws@0.2.6</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/brianloveswords/node-jws#readme</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/brianloveswords/node-jws/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git://github.com/brianloveswords/node-jws.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/base64url@0.0.6">
            <name>base64url</name>
            <version>0.0.6</version>
            <description>
                <![CDATA[For encoding to/from base64urls]]>
            </description>
            <hashes>
                <hash alg="SHA-1">9597b36b330db1c42477322ea87ea8027499b82b</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/base64url@0.0.6</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/brianloveswords/base64url#readme</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/brianloveswords/base64url/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git://github.com/brianloveswords/base64url.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/jwa@0.0.1">
            <name>jwa</name>
            <version>0.0.1</version>
            <description>
                <![CDATA[JWA implementation (supports all JWS algorithms)]]>
            </description>
            <hashes>
                <hash alg="SHA-1">2d05f54d68f170648c30fe45944731a388cd07cc</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/jwa@0.0.1</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/brianloveswords/node-jwa#readme</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/brianloveswords/node-jwa/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git://github.com/brianloveswords/node-jwa.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/moment@2.0.0">
            <name>moment</name>
            <version>2.0.0</version>
            <description>
                <![CDATA[Parse, manipulate, and display dates.]]>
            </description>
            <hashes>
                <hash alg="SHA-1">2bbc5b44c321837693ab6efcadbd46ed946211fe</hash>
            </hashes>
            <purl>pkg:npm/moment@2.0.0</purl>
            <externalReferences>
                <reference type="website">
                    <url>http://momentjs.com</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/timrwood/moment/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git+https://github.com/timrwood/moment.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/express-rate-limit@5.1.3">
            <name>express-rate-limit</name>
            <version>5.1.3</version>
            <description>
                <![CDATA[Basic IP rate-limiting middleware for Express. Use to limit repeated requests to public APIs and/or endpoints such as password reset.]]>
            </description>
            <hashes>
                <hash alg="SHA-1">656bacce3f093034976346958a0f0199902c9174</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/express-rate-limit@5.1.3</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/nfriedly/express-rate-limit</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/nfriedly/express-rate-limit/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git+https://github.com/nfriedly/express-rate-limit.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/express-robots-txt@0.4.1">
            <name>express-robots-txt</name>
            <version>0.4.1</version>
            <description>
                <![CDATA[Express middleware to serve and generate robots.txt]]>
            </description>
            <hashes>
                <hash alg="SHA-1">f3123a9875fd885d3c11cf4a7348b89a20f40ffc</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/express-robots-txt@0.4.1</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/modosc/express-robots-txt</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/modosc/express-robots-txt/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git+https://github.com/modosc/express-robots-txt.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/express-security.txt@2.0.0">
            <name>express-security.txt</name>
            <version>2.0.0</version>
            <description>
                <![CDATA[[![Build Status](https://travis-ci.org/gergelyke/express-security.txt.svg?branch=master)](https://travis-ci.org/gergelyke/express-security.txt)]]>
            </description>
            <hashes>
                <hash alg="SHA-1">e5b825109ea88ccfb3001c1558a4739528d1fde0</hash>
            </hashes>
            <licenses>
                <license>
                    <id>ISC</id>
                </license>
            </licenses>
            <purl>pkg:npm/express-security.txt@2.0.0</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/gergelyke/express-security.txt#readme</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/gergelyke/express-security.txt/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git+https://github.com/gergelyke/express-security.txt.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/file-stream-rotator@0.5.7">
            <name>file-stream-rotator</name>
            <version>0.5.7</version>
            <description>
                <![CDATA[Automated stream rotation useful for log files]]>
            </description>
            <hashes>
                <hash alg="SHA-1">868a2e5966f7640a17dd86eda0e4467c089f6286</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/file-stream-rotator@0.5.7</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/rogerc/file-stream-rotator#readme</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/rogerc/file-stream-rotator/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git://github.com/rogerc/file-stream-rotator.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/moment@2.27.0">
            <name>moment</name>
            <version>2.27.0</version>
            <description>
                <![CDATA[Parse, validate, manipulate, and display dates]]>
            </description>
            <hashes>
                <hash alg="SHA-1">8bff4e3e26a236220dfe3e36de756b6ebaa0105d</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/moment@2.27.0</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://momentjs.com</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/moment/moment/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git+https://github.com/moment/moment.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/file-type@12.4.2">
            <name>file-type</name>
            <version>12.4.2</version>
            <description>
                <![CDATA[Detect the file type of a Buffer/Uint8Array/ArrayBuffer]]>
            </description>
            <hashes>
                <hash alg="SHA-1">a344ea5664a1d01447ee7fb1b635f72feb6169d9</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/file-type@12.4.2</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/sindresorhus/file-type#readme</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/sindresorhus/file-type/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git+https://github.com/sindresorhus/file-type.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/finale-rest@1.1.1">
            <name>finale-rest</name>
            <version>1.1.1</version>
            <description>
                <![CDATA[Create REST resources and controllers with Sequelize and Express or Restify]]>
            </description>
            <hashes>
                <hash alg="SHA-1">74dc49fb1655e938cc84210acf8c349887090086</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/finale-rest@1.1.1</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/tommybananas/finale#readme</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/tommybananas/finale/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git+https://github.com/tommybananas/finale.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/bluebird@3.7.2">
            <name>bluebird</name>
            <version>3.7.2</version>
            <description>
                <![CDATA[Full featured Promises/A+ implementation with exceptionally good performance]]>
            </description>
            <hashes>
                <hash alg="SHA-1">9f229c15be272454ffa973ace0dbee79a1b0c36f</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/bluebird@3.7.2</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/petkaantonov/bluebird</url>
                </reference>
                <reference type="issue-tracker">
                    <url>http://github.com/petkaantonov/bluebird/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git://github.com/petkaantonov/bluebird.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/inflection@1.12.0">
            <name>inflection</name>
            <version>1.12.0</version>
            <description>
                <![CDATA[A port of inflection-js to node.js module]]>
            </description>
            <hashes>
                <hash alg="SHA-1">a200935656d6f5f6bc4dc7502e1aecb703228416</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/inflection@1.12.0</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/dreamerslab/node.inflection#readme</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/dreamerslab/node.inflection/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git+https://github.com/dreamerslab/node.inflection.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/fs-extra@8.1.0">
            <name>fs-extra</name>
            <version>8.1.0</version>
            <description>
                <![CDATA[fs-extra contains methods that aren't included in the vanilla Node.js fs package. Such as mkdir -p, cp -r, and rm -rf.]]>
            </description>
            <hashes>
                <hash alg="SHA-1">49d43c45a88cd9677668cb7be1b46efdb8d2e1c0</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/fs-extra@8.1.0</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/jprichardson/node-fs-extra</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/jprichardson/node-fs-extra/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git+https://github.com/jprichardson/node-fs-extra.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/jsonfile@4.0.0">
            <name>jsonfile</name>
            <version>4.0.0</version>
            <description>
                <![CDATA[Easily read/write JSON files.]]>
            </description>
            <hashes>
                <hash alg="SHA-1">8771aae0799b64076b76640fca058f9c10e33ecb</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/jsonfile@4.0.0</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/jprichardson/node-jsonfile#readme</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/jprichardson/node-jsonfile/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git+ssh://git@github.com/jprichardson/node-jsonfile.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/universalify@0.1.2">
            <name>universalify</name>
            <version>0.1.2</version>
            <description>
                <![CDATA[Make a callback- or promise-based function support both promises and callbacks.]]>
            </description>
            <hashes>
                <hash alg="SHA-1">b646f69be3942dabcecc9d6639c80dc105efaa66</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/universalify@0.1.2</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/RyanZim/universalify#readme</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/RyanZim/universalify/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git+https://github.com/RyanZim/universalify.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/glob@7.1.6">
            <name>glob</name>
            <version>7.1.6</version>
            <description>
                <![CDATA[a little globber]]>
            </description>
            <hashes>
                <hash alg="SHA-1">141f33b81a7c2492e125594307480c46679278a6</hash>
            </hashes>
            <licenses>
                <license>
                    <id>ISC</id>
                </license>
            </licenses>
            <purl>pkg:npm/glob@7.1.6</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/isaacs/node-glob#readme</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/isaacs/node-glob/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git://github.com/isaacs/node-glob.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/fs.realpath@1.0.0">
            <name>fs.realpath</name>
            <version>1.0.0</version>
            <description>
                <![CDATA[Use node's fs.realpath, but fall back to the JS implementation if the native one fails]]>
            </description>
            <hashes>
                <hash alg="SHA-1">1504ad2523158caa40db4a2787cb01411994ea4f</hash>
            </hashes>
            <licenses>
                <license>
                    <id>ISC</id>
                </license>
            </licenses>
            <purl>pkg:npm/fs.realpath@1.0.0</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/isaacs/fs.realpath#readme</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/isaacs/fs.realpath/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git+https://github.com/isaacs/fs.realpath.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/inflight@1.0.6">
            <name>inflight</name>
            <version>1.0.6</version>
            <description>
                <![CDATA[Add callbacks to requests in flight to avoid async duplication]]>
            </description>
            <hashes>
                <hash alg="SHA-1">49bd6331d7d02d0c09bc910a1075ba8165b56df9</hash>
            </hashes>
            <licenses>
                <license>
                    <id>ISC</id>
                </license>
            </licenses>
            <purl>pkg:npm/inflight@1.0.6</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/isaacs/inflight</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/isaacs/inflight/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git+https://github.com/npm/inflight.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/minimatch@3.0.4">
            <name>minimatch</name>
            <version>3.0.4</version>
            <description>
                <![CDATA[a glob matcher in javascript]]>
            </description>
            <hashes>
                <hash alg="SHA-1">5166e286457f03306064be5497e8dbb0c3d32083</hash>
            </hashes>
            <licenses>
                <license>
                    <id>ISC</id>
                </license>
            </licenses>
            <purl>pkg:npm/minimatch@3.0.4</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/isaacs/minimatch#readme</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/isaacs/minimatch/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git://github.com/isaacs/minimatch.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/brace-expansion@1.1.11">
            <name>brace-expansion</name>
            <version>1.1.11</version>
            <description>
                <![CDATA[Brace expansion as known from sh/bash]]>
            </description>
            <hashes>
                <hash alg="SHA-1">3c7fcbf529d87226f3d2f52b966ff5271eb441dd</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/brace-expansion@1.1.11</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/juliangruber/brace-expansion</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/juliangruber/brace-expansion/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git://github.com/juliangruber/brace-expansion.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/balanced-match@1.0.0">
            <name>balanced-match</name>
            <version>1.0.0</version>
            <description>
                <![CDATA[Match balanced character pairs, like "{" and "}"]]>
            </description>
            <hashes>
                <hash alg="SHA-1">89b4d199ab2bee49de164ea02b89ce462d71b767</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/balanced-match@1.0.0</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/juliangruber/balanced-match</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/juliangruber/balanced-match/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git://github.com/juliangruber/balanced-match.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/concat-map@0.0.1">
            <name>concat-map</name>
            <version>0.0.1</version>
            <description>
                <![CDATA[concatenative mapdashery]]>
            </description>
            <hashes>
                <hash alg="SHA-1">d8a96bd77fd68df7793a73036a3ba0d5405d477b</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/concat-map@0.0.1</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/substack/node-concat-map#readme</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/substack/node-concat-map/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git://github.com/substack/node-concat-map.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/path-is-absolute@1.0.1">
            <name>path-is-absolute</name>
            <version>1.0.1</version>
            <description>
                <![CDATA[Node.js 0.12 path.isAbsolute() ponyfill]]>
            </description>
            <hashes>
                <hash alg="SHA-1">174b9268735534ffbc7ace6bf53a5a9e1b5c5f5f</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/path-is-absolute@1.0.1</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/sindresorhus/path-is-absolute#readme</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/sindresorhus/path-is-absolute/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git+https://github.com/sindresorhus/path-is-absolute.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/grunt@1.2.1">
            <name>grunt</name>
            <version>1.2.1</version>
            <description>
                <![CDATA[The JavaScript Task Runner]]>
            </description>
            <hashes>
                <hash alg="SHA-1">5a1fcdfc222841108893e4e50c1a46f413a564ab</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/grunt@1.2.1</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://gruntjs.com/</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/gruntjs/grunt/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git+https://github.com/gruntjs/grunt.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/dateformat@3.0.3">
            <name>dateformat</name>
            <version>3.0.3</version>
            <description>
                <![CDATA[A node.js package for Steven Levithan's excellent dateFormat() function.]]>
            </description>
            <hashes>
                <hash alg="SHA-1">a6e37499a4d9a9cf85ef5872044d62901c9889ae</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/dateformat@3.0.3</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/felixge/node-dateformat</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/felixge/node-dateformat/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git+https://github.com/felixge/node-dateformat.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/eventemitter2@0.4.14">
            <name>eventemitter2</name>
            <version>0.4.14</version>
            <description>
                <![CDATA[A Node.js event emitter implementation with namespaces, wildcards, TTL and browser support.]]>
            </description>
            <hashes>
                <hash alg="SHA-1">8f61b75cde012b2e9eb284d4545583b5643b61ab</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/eventemitter2@0.4.14</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/hij1nx/EventEmitter2#readme</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/hij1nx/EventEmitter2/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git://github.com/hij1nx/EventEmitter2.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/exit@0.1.2">
            <name>exit</name>
            <version>0.1.2</version>
            <description>
                <![CDATA[A replacement for process.exit that ensures stdio are fully drained before exiting.]]>
            </description>
            <hashes>
                <hash alg="SHA-1">0632638f8d877cc82107d30a0fff1a17cba1cd0c</hash>
            </hashes>
            <purl>pkg:npm/exit@0.1.2</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/cowboy/node-exit</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/cowboy/node-exit/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git://github.com/cowboy/node-exit.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/findup-sync@0.3.0">
            <name>findup-sync</name>
            <version>0.3.0</version>
            <description>
                <![CDATA[Find the first file matching a given pattern in the current directory or the nearest ancestor directory.]]>
            </description>
            <hashes>
                <hash alg="SHA-1">37930aa5d816b777c03445e1966cc6790a4c0b16</hash>
            </hashes>
            <purl>pkg:npm/findup-sync@0.3.0</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/cowboy/node-findup-sync</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/cowboy/node-findup-sync/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git://github.com/cowboy/node-findup-sync.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/glob@5.0.15">
            <name>glob</name>
            <version>5.0.15</version>
            <description>
                <![CDATA[a little globber]]>
            </description>
            <hashes>
                <hash alg="SHA-1">1bc936b9e02f4a603fcc222ecf7633d30b8b93b1</hash>
            </hashes>
            <licenses>
                <license>
                    <id>ISC</id>
                </license>
            </licenses>
            <purl>pkg:npm/glob@5.0.15</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/isaacs/node-glob#readme</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/isaacs/node-glob/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git://github.com/isaacs/node-glob.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/grunt-cli@1.3.2">
            <name>grunt-cli</name>
            <version>1.3.2</version>
            <description>
                <![CDATA[The grunt command line interface]]>
            </description>
            <hashes>
                <hash alg="SHA-1">60f12d12c1b5aae94ae3469c6b5fe24e960014e8</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/grunt-cli@1.3.2</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/gruntjs/grunt-cli#readme</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/gruntjs/grunt-cli/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git+https://github.com/gruntjs/grunt-cli.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/grunt-known-options@1.1.1">
            <name>grunt-known-options</name>
            <version>1.1.1</version>
            <description>
                <![CDATA[The known options used in Grunt]]>
            </description>
            <hashes>
                <hash alg="SHA-1">6cc088107bd0219dc5d3e57d91923f469059804d</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/grunt-known-options@1.1.1</purl>
            <externalReferences>
                <reference type="website">
                    <url>http://gruntjs.com/</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/gruntjs/grunt-known-options/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git+https://github.com/gruntjs/grunt-known-options.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/interpret@1.1.0">
            <name>interpret</name>
            <version>1.1.0</version>
            <description>
                <![CDATA[A dictionary of file extensions and associated module loaders.]]>
            </description>
            <hashes>
                <hash alg="SHA-1">7ed1b1410c6a0e0f78cf95d3b8440c63f78b8614</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/interpret@1.1.0</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/tkellen/node-interpret</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/tkellen/node-interpret/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git://github.com/tkellen/node-interpret.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/liftoff@2.5.0">
            <name>liftoff</name>
            <version>2.5.0</version>
            <description>
                <![CDATA[Launch your command line tool with ease.]]>
            </description>
            <hashes>
                <hash alg="SHA-1">2009291bb31cea861bbf10a7c15a28caf75c31ec</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/liftoff@2.5.0</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/js-cli/js-liftoff#readme</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/js-cli/js-liftoff/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git+https://github.com/js-cli/js-liftoff.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/extend@3.0.2">
            <name>extend</name>
            <version>3.0.2</version>
            <description>
                <![CDATA[Port of jQuery.extend for node.js and the browser]]>
            </description>
            <hashes>
                <hash alg="SHA-1">f8b1136b4071fbd8eb140aff858b1019ec2915fa</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/extend@3.0.2</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/justmoon/node-extend#readme</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/justmoon/node-extend/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git+https://github.com/justmoon/node-extend.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/fined@1.2.0">
            <name>fined</name>
            <version>1.2.0</version>
            <description>
                <![CDATA[Find a file given a declaration of locations.]]>
            </description>
            <hashes>
                <hash alg="SHA-1">d00beccf1aa2b475d16d423b0238b713a2c4a37b</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/fined@1.2.0</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/gulpjs/fined#readme</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/gulpjs/fined/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git+https://github.com/gulpjs/fined.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/object.defaults@1.1.0">
            <name>object.defaults</name>
            <version>1.1.0</version>
            <description>
                <![CDATA[Like `extend` but only copies missing properties/values to the target object.]]>
            </description>
            <hashes>
                <hash alg="SHA-1">3a7f868334b407dea06da16d88d5cd29e435fecf</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/object.defaults@1.1.0</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/jonschlinkert/object.defaults</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/jonschlinkert/object.defaults/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git+https://github.com/jonschlinkert/object.defaults.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/array-each@1.0.1">
            <name>array-each</name>
            <version>1.0.1</version>
            <description>
                <![CDATA[Loop over each item in an array and call the given function on every element.]]>
            </description>
            <hashes>
                <hash alg="SHA-1">a794af0c05ab1752846ee753a1f211a05ba0c44f</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/array-each@1.0.1</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/jonschlinkert/array-each</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/jonschlinkert/array-each/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git+https://github.com/jonschlinkert/array-each.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/array-slice@1.1.0">
            <name>array-slice</name>
            <version>1.1.0</version>
            <description>
                <![CDATA[Array-slice method. Slices `array` from the `start` index up to, but not including, the `end` index.]]>
            </description>
            <hashes>
                <hash alg="SHA-1">e368ea15f89bc7069f7ffb89aec3a6c7d4ac22d4</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/array-slice@1.1.0</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/jonschlinkert/array-slice</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/jonschlinkert/array-slice/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git+https://github.com/jonschlinkert/array-slice.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/for-own@1.0.0">
            <name>for-own</name>
            <version>1.0.0</version>
            <description>
                <![CDATA[Iterate over the own enumerable properties of an object, and return an object with properties that evaluate to true from the callback. Exit early by returning `false`. JavaScript/Node.js.]]>
            </description>
            <hashes>
                <hash alg="SHA-1">c63332f415cedc4b04dbfe70cf836494c53cb44b</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/for-own@1.0.0</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/jonschlinkert/for-own</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/jonschlinkert/for-own/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git+https://github.com/jonschlinkert/for-own.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/parse-filepath@1.0.2">
            <name>parse-filepath</name>
            <version>1.0.2</version>
            <description>
                <![CDATA[Pollyfill for node.js `path.parse`, parses a filepath into an object.]]>
            </description>
            <hashes>
                <hash alg="SHA-1">a632127f53aaf3d15876f5872f3ffac763d6c891</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/parse-filepath@1.0.2</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/jonschlinkert/parse-filepath</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/jonschlinkert/parse-filepath/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git+https://github.com/jonschlinkert/parse-filepath.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/is-absolute@1.0.0">
            <name>is-absolute</name>
            <version>1.0.0</version>
            <description>
                <![CDATA[Returns true if a file path is absolute. Does not rely on the path module and can be used as a polyfill for node.js native `path.isAbolute`.]]>
            </description>
            <hashes>
                <hash alg="SHA-1">395e1ae84b11f26ad1795e73c17378e48a301576</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/is-absolute@1.0.0</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/jonschlinkert/is-absolute</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/jonschlinkert/is-absolute/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git+https://github.com/jonschlinkert/is-absolute.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/is-relative@1.0.0">
            <name>is-relative</name>
            <version>1.0.0</version>
            <description>
                <![CDATA[Returns `true` if the path appears to be relative.]]>
            </description>
            <hashes>
                <hash alg="SHA-1">a1bb6935ce8c5dba1e8b9754b9b2dcc020e2260d</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/is-relative@1.0.0</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/jonschlinkert/is-relative</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/jonschlinkert/is-relative/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git+https://github.com/jonschlinkert/is-relative.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/is-unc-path@1.0.0">
            <name>is-unc-path</name>
            <version>1.0.0</version>
            <description>
                <![CDATA[Returns true if a filepath is a windows UNC file path.]]>
            </description>
            <hashes>
                <hash alg="SHA-1">d731e8898ed090a12c352ad2eaed5095ad322c9d</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/is-unc-path@1.0.0</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/jonschlinkert/is-unc-path</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/jonschlinkert/is-unc-path/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git+https://github.com/jonschlinkert/is-unc-path.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/unc-path-regex@0.1.2">
            <name>unc-path-regex</name>
            <version>0.1.2</version>
            <description>
                <![CDATA[Regular expression for testing if a file path is a windows UNC file path. Can also be used as a component of another regexp via the `.source` property.]]>
            </description>
            <hashes>
                <hash alg="SHA-1">e73dd3d7b0d7c5ed86fbac6b0ae7d8c6a69d50fa</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/unc-path-regex@0.1.2</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/regexhq/unc-path-regex</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/regexhq/unc-path-regex/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git+https://github.com/regexhq/unc-path-regex.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/path-root@0.1.1">
            <name>path-root</name>
            <version>0.1.1</version>
            <description>
                <![CDATA[Get the root of a posix or windows filepath.]]>
            </description>
            <hashes>
                <hash alg="SHA-1">9a4a6814cac1c0cd73360a95f32083c8ea4745b7</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/path-root@0.1.1</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/jonschlinkert/path-root</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/jonschlinkert/path-root/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git+https://github.com/jonschlinkert/path-root.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/path-root-regex@0.1.2">
            <name>path-root-regex</name>
            <version>0.1.2</version>
            <description>
                <![CDATA[Regular expression for getting the root of a posix or windows filepath.]]>
            </description>
            <hashes>
                <hash alg="SHA-1">bfccdc8df5b12dc52c8b43ec38d18d72c04ba96d</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/path-root-regex@0.1.2</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/regexhq/path-root-regex</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/regexhq/path-root-regex/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git+https://github.com/regexhq/path-root-regex.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/flagged-respawn@1.0.1">
            <name>flagged-respawn</name>
            <version>1.0.1</version>
            <description>
                <![CDATA[A tool for respawning node binaries when special flags are present.]]>
            </description>
            <hashes>
                <hash alg="SHA-1">e7de6f1279ddd9ca9aac8a5971d618606b3aab41</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/flagged-respawn@1.0.1</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/gulpjs/flagged-respawn#readme</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/gulpjs/flagged-respawn/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git+https://github.com/gulpjs/flagged-respawn.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/object.map@1.0.1">
            <name>object.map</name>
            <version>1.0.1</version>
            <description>
                <![CDATA[Similar to map for arrays, this creates a new object by calling the callback on each property of the original object.]]>
            </description>
            <hashes>
                <hash alg="SHA-1">cf83e59dc8fcc0ad5f4250e1f78b3b81bd801d37</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/object.map@1.0.1</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/jonschlinkert/object.map</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/jonschlinkert/object.map/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git+https://github.com/jonschlinkert/object.map.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/make-iterator@1.0.1">
            <name>make-iterator</name>
            <version>1.0.1</version>
            <description>
                <![CDATA[Convert an argument into a valid iterator. Based on the `.makeIterator()` implementation in mout https://github.com/mout/mout.]]>
            </description>
            <hashes>
                <hash alg="SHA-1">29b33f312aa8f547c4a5e490f56afcec99133ad6</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/make-iterator@1.0.1</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/jonschlinkert/make-iterator</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/jonschlinkert/make-iterator/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git+https://github.com/jonschlinkert/make-iterator.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/rechoir@0.6.2">
            <name>rechoir</name>
            <version>0.6.2</version>
            <description>
                <![CDATA[Require any supported file as a node module.]]>
            </description>
            <hashes>
                <hash alg="SHA-1">85204b54dba82d5742e28c96756ef43af50e3384</hash>
            </hashes>
            <purl>pkg:npm/rechoir@0.6.2</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/tkellen/node-rechoir</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/tkellen/node-rechoir/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git://github.com/tkellen/node-rechoir.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/nopt@4.0.3">
            <name>nopt</name>
            <version>4.0.3</version>
            <description>
                <![CDATA[Option parsing for Node, supporting types, shorthands, etc. Used by npm.]]>
            </description>
            <hashes>
                <hash alg="SHA-1">a375cad9d02fd921278d954c2254d5aa57e15e48</hash>
            </hashes>
            <licenses>
                <license>
                    <id>ISC</id>
                </license>
            </licenses>
            <purl>pkg:npm/nopt@4.0.3</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/npm/nopt#readme</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/npm/nopt/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git+https://github.com/npm/nopt.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/abbrev@1.1.1">
            <name>abbrev</name>
            <version>1.1.1</version>
            <description>
                <![CDATA[Like ruby's abbrev module, but in js]]>
            </description>
            <hashes>
                <hash alg="SHA-1">f8f2c887ad10bf67f634f005b6987fed3179aac8</hash>
            </hashes>
            <licenses>
                <license>
                    <id>ISC</id>
                </license>
            </licenses>
            <purl>pkg:npm/abbrev@1.1.1</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/isaacs/abbrev-js#readme</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/isaacs/abbrev-js/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git+ssh://git@github.com/isaacs/abbrev-js.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/v8flags@3.1.3">
            <name>v8flags</name>
            <version>3.1.3</version>
            <description>
                <![CDATA[Get available v8 flags.]]>
            </description>
            <hashes>
                <hash alg="SHA-1">fc9dc23521ca20c5433f81cc4eb9b3033bb105d8</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/v8flags@3.1.3</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/gulpjs/v8flags#readme</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/gulpjs/v8flags/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git+https://github.com/gulpjs/v8flags.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/grunt-legacy-log@2.0.0">
            <name>grunt-legacy-log</name>
            <version>2.0.0</version>
            <description>
                <![CDATA[The Grunt 0.4.x logger.]]>
            </description>
            <hashes>
                <hash alg="SHA-1">c8cd2c6c81a4465b9bbf2d874d963fef7a59ffb9</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/grunt-legacy-log@2.0.0</purl>
            <externalReferences>
                <reference type="website">
                    <url>http://gruntjs.com/</url>
                </reference>
                <reference type="issue-tracker">
                    <url>http://github.com/gruntjs/grunt-legacy-log/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git://github.com/gruntjs/grunt-legacy-log.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/colors@1.1.2">
            <name>colors</name>
            <version>1.1.2</version>
            <description>
                <![CDATA[get colors in your node.js console]]>
            </description>
            <hashes>
                <hash alg="SHA-1">168a4701756b6a7f51a12ce0c97bfa28c084ed63</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/colors@1.1.2</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/Marak/colors.js</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/Marak/colors.js/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git+ssh://git@github.com/Marak/colors.js.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/grunt-legacy-log-utils@2.0.1">
            <name>grunt-legacy-log-utils</name>
            <version>2.0.1</version>
            <description>
                <![CDATA[Static methods for the Grunt 0.4.x logger.]]>
            </description>
            <hashes>
                <hash alg="SHA-1">d2f442c7c0150065d9004b08fd7410d37519194e</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/grunt-legacy-log-utils@2.0.1</purl>
            <externalReferences>
                <reference type="website">
                    <url>http://gruntjs.com/</url>
                </reference>
                <reference type="issue-tracker">
                    <url>http://github.com/gruntjs/grunt-legacy-log-utils/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git://github.com/gruntjs/grunt-legacy-log-utils.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/hooker@0.2.3">
            <name>hooker</name>
            <version>0.2.3</version>
            <description>
                <![CDATA[Monkey-patch (hook) functions for debugging and stuff.]]>
            </description>
            <hashes>
                <hash alg="SHA-1">b834f723cc4a242aa65963459df6d984c5d3d959</hash>
            </hashes>
            <purl>pkg:npm/hooker@0.2.3</purl>
            <externalReferences>
                <reference type="website">
                    <url>http://github.com/cowboy/javascript-hooker</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/cowboy/javascript-hooker/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git://github.com/cowboy/javascript-hooker.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/grunt-legacy-util@1.1.1">
            <name>grunt-legacy-util</name>
            <version>1.1.1</version>
            <description>
                <![CDATA[Some old grunt utils provided for backwards compatibility.]]>
            </description>
            <hashes>
                <hash alg="SHA-1">e10624e7c86034e5b870c8a8616743f0a0845e42</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/grunt-legacy-util@1.1.1</purl>
            <externalReferences>
                <reference type="website">
                    <url>http://gruntjs.com/</url>
                </reference>
                <reference type="issue-tracker">
                    <url>http://github.com/gruntjs/grunt-legacy-util/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git://github.com/gruntjs/grunt-legacy-util.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/async@1.5.2">
            <name>async</name>
            <version>1.5.2</version>
            <description>
                <![CDATA[Higher-order functions and common patterns for asynchronous code]]>
            </description>
            <hashes>
                <hash alg="SHA-1">ec6a61ae56480c0c3cb241c95618e20892f9672a</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/async@1.5.2</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/caolan/async#readme</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/caolan/async/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git+https://github.com/caolan/async.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/getobject@0.1.0">
            <name>getobject</name>
            <version>0.1.0</version>
            <description>
                <![CDATA[get.and.set.deep.objects.easily = true]]>
            </description>
            <hashes>
                <hash alg="SHA-1">047a449789fa160d018f5486ed91320b6ec7885c</hash>
            </hashes>
            <purl>pkg:npm/getobject@0.1.0</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/cowboy/node-getobject</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/cowboy/node-getobject/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git://github.com/cowboy/node-getobject.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/underscore.string@3.3.5">
            <name>underscore.string</name>
            <version>3.3.5</version>
            <description>
                <![CDATA[String manipulation extensions for Underscore.js javascript library.]]>
            </description>
            <hashes>
                <hash alg="SHA-1">fc2ad255b8bd309e239cbc5816fd23a9b7ea4023</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/underscore.string@3.3.5</purl>
            <externalReferences>
                <reference type="website">
                    <url>http://epeli.github.com/underscore.string/</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/epeli/underscore.string/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git+https://github.com/epeli/underscore.string.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/sprintf-js@1.1.2">
            <name>sprintf-js</name>
            <version>1.1.2</version>
            <description>
                <![CDATA[JavaScript sprintf implementation]]>
            </description>
            <hashes>
                <hash alg="SHA-1">da1765262bf8c0f571749f2ad6c26300207ae673</hash>
            </hashes>
            <licenses>
                <license>
                    <id>BSD-3-Clause</id>
                </license>
            </licenses>
            <purl>pkg:npm/sprintf-js@1.1.2</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/alexei/sprintf.js#readme</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/alexei/sprintf.js/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git+https://github.com/alexei/sprintf.js.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/js-yaml@3.14.0">
            <name>js-yaml</name>
            <version>3.14.0</version>
            <description>
                <![CDATA[YAML 1.2 parser and serializer]]>
            </description>
            <hashes>
                <hash alg="SHA-1">a7a34170f26a21bb162424d8adacb4113a69e482</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/js-yaml@3.14.0</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/nodeca/js-yaml</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/nodeca/js-yaml/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git+https://github.com/nodeca/js-yaml.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/argparse@1.0.10">
            <name>argparse</name>
            <version>1.0.10</version>
            <description>
                <![CDATA[Very powerful CLI arguments parser. Native port of argparse - python's options parsing library]]>
            </description>
            <hashes>
                <hash alg="SHA-1">bcd6791ea5ae09725e17e5ad988134cd40b3d911</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/argparse@1.0.10</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/nodeca/argparse#readme</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/nodeca/argparse/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git+https://github.com/nodeca/argparse.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/sprintf-js@1.0.3">
            <name>sprintf-js</name>
            <version>1.0.3</version>
            <description>
                <![CDATA[JavaScript sprintf implementation]]>
            </description>
            <hashes>
                <hash alg="SHA-1">04e6926f662895354f3dd015203633b857297e2c</hash>
            </hashes>
            <licenses>
                <license>
                    <id>BSD-3-Clause</id>
                </license>
            </licenses>
            <purl>pkg:npm/sprintf-js@1.0.3</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/alexei/sprintf.js#readme</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/alexei/sprintf.js/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git+https://github.com/alexei/sprintf.js.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/esprima@4.0.1">
            <name>esprima</name>
            <version>4.0.1</version>
            <description>
                <![CDATA[ECMAScript parsing infrastructure for multipurpose analysis]]>
            </description>
            <hashes>
                <hash alg="SHA-1">13b04cdb3e6c5d19df91ab6987a8695619b0aa71</hash>
            </hashes>
            <licenses>
                <license>
                    <id>BSD-2-Clause</id>
                </license>
            </licenses>
            <purl>pkg:npm/esprima@4.0.1</purl>
            <externalReferences>
                <reference type="website">
                    <url>http://esprima.org</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/jquery/esprima/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git+https://github.com/jquery/esprima.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/mkdirp@1.0.4">
            <name>mkdirp</name>
            <version>1.0.4</version>
            <description>
                <![CDATA[Recursively mkdir, like `mkdir -p`]]>
            </description>
            <hashes>
                <hash alg="SHA-1">3eb5ed62622756d79a5f0e2a221dfebad75c2f7e</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/mkdirp@1.0.4</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/isaacs/node-mkdirp#readme</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/isaacs/node-mkdirp/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git+https://github.com/isaacs/node-mkdirp.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/nopt@3.0.6">
            <name>nopt</name>
            <version>3.0.6</version>
            <description>
                <![CDATA[Option parsing for Node, supporting types, shorthands, etc. Used by npm.]]>
            </description>
            <hashes>
                <hash alg="SHA-1">c6465dbf08abcd4db359317f79ac68a646b28ff9</hash>
            </hashes>
            <licenses>
                <license>
                    <id>ISC</id>
                </license>
            </licenses>
            <purl>pkg:npm/nopt@3.0.6</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/npm/nopt#readme</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/npm/nopt/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git+https://github.com/npm/nopt.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/rimraf@3.0.2">
            <name>rimraf</name>
            <version>3.0.2</version>
            <description>
                <![CDATA[A deep deletion module for node (like `rm -rf`)]]>
            </description>
            <hashes>
                <hash alg="SHA-1">f1a5402ba6220ad52cc1282bac1ae3aa49fd061a</hash>
            </hashes>
            <licenses>
                <license>
                    <id>ISC</id>
                </license>
            </licenses>
            <purl>pkg:npm/rimraf@3.0.2</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/isaacs/rimraf#readme</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/isaacs/rimraf/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git://github.com/isaacs/rimraf.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/grunt-contrib-compress@1.6.0">
            <name>grunt-contrib-compress</name>
            <version>1.6.0</version>
            <description>
                <![CDATA[Compress files and folders]]>
            </description>
            <hashes>
                <hash alg="SHA-1">9708885c738a97a12c5f3072dc97dbc31b4121db</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/grunt-contrib-compress@1.6.0</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/gruntjs/grunt-contrib-compress#readme</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/gruntjs/grunt-contrib-compress/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git+https://github.com/gruntjs/grunt-contrib-compress.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/archiver@1.3.0">
            <name>archiver</name>
            <version>1.3.0</version>
            <description>
                <![CDATA[a streaming interface for archive generation]]>
            </description>
            <hashes>
                <hash alg="SHA-1">4f2194d6d8f99df3f531e6881f14f15d55faaf22</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/archiver@1.3.0</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/archiverjs/node-archiver</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/archiverjs/node-archiver/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git+https://github.com/archiverjs/node-archiver.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/archiver-utils@1.3.0">
            <name>archiver-utils</name>
            <version>1.3.0</version>
            <description>
                <![CDATA[utility functions for archiver]]>
            </description>
            <hashes>
                <hash alg="SHA-1">e50b4c09c70bf3d680e32ff1b7994e9f9d895174</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/archiver-utils@1.3.0</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/archiverjs/archiver-utils#readme</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/archiverjs/archiver-utils/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git+https://github.com/archiverjs/archiver-utils.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/lazystream@1.0.0">
            <name>lazystream</name>
            <version>1.0.0</version>
            <description>
                <![CDATA[Open Node Streams on demand.]]>
            </description>
            <hashes>
                <hash alg="SHA-1">f6995fe0f820392f61396be89462407bb77168e4</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/lazystream@1.0.0</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/jpommerening/node-lazystream</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/jpommerening/node-lazystream/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git+https://github.com/jpommerening/node-lazystream.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/normalize-path@2.1.1">
            <name>normalize-path</name>
            <version>2.1.1</version>
            <description>
                <![CDATA[Normalize file path slashes to be unix-like forward slashes. Also condenses repeat slashes to a single slash and removes and trailing slashes unless disabled.]]>
            </description>
            <hashes>
                <hash alg="SHA-1">1ab28b556e198363a8c1a6f7e6fa20137fe6aed9</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/normalize-path@2.1.1</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/jonschlinkert/normalize-path</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/jonschlinkert/normalize-path/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git+https://github.com/jonschlinkert/normalize-path.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/remove-trailing-separator@1.1.0">
            <name>remove-trailing-separator</name>
            <version>1.1.0</version>
            <description>
                <![CDATA[Removes separators from the end of the string.]]>
            </description>
            <hashes>
                <hash alg="SHA-1">c24bce2a283adad5bc3f58e0d48249b92379d8ef</hash>
            </hashes>
            <licenses>
                <license>
                    <id>ISC</id>
                </license>
            </licenses>
            <purl>pkg:npm/remove-trailing-separator@1.1.0</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/darsain/remove-trailing-separator#readme</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/darsain/remove-trailing-separator/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git+https://github.com/darsain/remove-trailing-separator.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/async@2.6.3">
            <name>async</name>
            <version>2.6.3</version>
            <description>
                <![CDATA[Higher-order functions and common patterns for asynchronous code]]>
            </description>
            <hashes>
                <hash alg="SHA-1">d72625e2344a3656e3a3ad4fa749fa83299d82ff</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/async@2.6.3</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://caolan.github.io/async/</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/caolan/async/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git+https://github.com/caolan/async.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/walkdir@0.0.11">
            <name>walkdir</name>
            <version>0.0.11</version>
            <description>
                <![CDATA[Find files simply. Walks a directory tree emitting events based on what it finds. Presents a familiar callback/emitter/a+sync interface. Walk a tree of any depth.]]>
            </description>
            <hashes>
                <hash alg="SHA-1">a16d025eb931bd03b52f308caed0f40fcebe9532</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/walkdir@0.0.11</purl>
            <externalReferences>
                <reference type="website">
                    <url>http://github.com/soldair/node-walkdir</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/soldair/node-walkdir/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git://github.com/soldair/node-walkdir.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/zip-stream@1.2.0">
            <name>zip-stream</name>
            <version>1.2.0</version>
            <description>
                <![CDATA[a streaming zip archive generator.]]>
            </description>
            <hashes>
                <hash alg="SHA-1">a8bc45f4c1b49699c6b90198baacaacdbcd4ba04</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/zip-stream@1.2.0</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/archiverjs/node-zip-stream</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/archiverjs/node-zip-stream/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git+https://github.com/archiverjs/node-zip-stream.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/compress-commons@1.2.2">
            <name>compress-commons</name>
            <version>1.2.2</version>
            <description>
                <![CDATA[a library that defines a common interface for working with archive formats within node]]>
            </description>
            <hashes>
                <hash alg="SHA-1">524a9f10903f3a813389b0225d27c48bb751890f</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/compress-commons@1.2.2</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/archiverjs/node-compress-commons</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/archiverjs/node-compress-commons/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git+https://github.com/archiverjs/node-compress-commons.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/crc32-stream@2.0.0">
            <name>crc32-stream</name>
            <version>2.0.0</version>
            <description>
                <![CDATA[a streaming CRC32 checksumer]]>
            </description>
            <hashes>
                <hash alg="SHA-1">e3cdd3b4df3168dd74e3de3fbbcb7b297fe908f4</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/crc32-stream@2.0.0</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/archiverjs/node-crc32-stream</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/archiverjs/node-crc32-stream/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git+https://github.com/archiverjs/node-crc32-stream.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/crc@3.8.0">
            <name>crc</name>
            <version>3.8.0</version>
            <description>
                <![CDATA[Module for calculating Cyclic Redundancy Check (CRC) for Node.js and the Browser.]]>
            </description>
            <hashes>
                <hash alg="SHA-1">ad60269c2c856f8c299e2c4cc0de4556914056c6</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/crc@3.8.0</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/alexgorbatchev/node-crc</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/alexgorbatchev/node-crc/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git://github.com/alexgorbatchev/node-crc.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/chalk@1.1.3">
            <name>chalk</name>
            <version>1.1.3</version>
            <description>
                <![CDATA[Terminal string styling done right. Much color.]]>
            </description>
            <hashes>
                <hash alg="SHA-1">a8115c55e4a702fe4d150abd3872822a7e09fc98</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/chalk@1.1.3</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/chalk/chalk#readme</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/chalk/chalk/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git+https://github.com/chalk/chalk.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/ansi-styles@2.2.1">
            <name>ansi-styles</name>
            <version>2.2.1</version>
            <description>
                <![CDATA[ANSI escape codes for styling strings in the terminal]]>
            </description>
            <hashes>
                <hash alg="SHA-1">b432dd3358b634cf75e1e4664368240533c1ddbe</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/ansi-styles@2.2.1</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/chalk/ansi-styles#readme</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/chalk/ansi-styles/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git+https://github.com/chalk/ansi-styles.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/has-ansi@2.0.0">
            <name>has-ansi</name>
            <version>2.0.0</version>
            <description>
                <![CDATA[Check if a string has ANSI escape codes]]>
            </description>
            <hashes>
                <hash alg="SHA-1">34f5049ce1ecdf2b0649af3ef24e45ed35416d91</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/has-ansi@2.0.0</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/sindresorhus/has-ansi#readme</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/sindresorhus/has-ansi/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git+https://github.com/sindresorhus/has-ansi.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/ansi-regex@2.1.1">
            <name>ansi-regex</name>
            <version>2.1.1</version>
            <description>
                <![CDATA[Regular expression for matching ANSI escape codes]]>
            </description>
            <hashes>
                <hash alg="SHA-1">c3b33ab5ee360d86e0e628f0468ae7ef27d654df</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/ansi-regex@2.1.1</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/chalk/ansi-regex#readme</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/chalk/ansi-regex/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git+https://github.com/chalk/ansi-regex.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/strip-ansi@3.0.1">
            <name>strip-ansi</name>
            <version>3.0.1</version>
            <description>
                <![CDATA[Strip ANSI escape codes]]>
            </description>
            <hashes>
                <hash alg="SHA-1">6a385fb8853d952d5ff05d0e8aaf94278dc63dcf</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/strip-ansi@3.0.1</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/chalk/strip-ansi#readme</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/chalk/strip-ansi/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git+https://github.com/chalk/strip-ansi.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/supports-color@2.0.0">
            <name>supports-color</name>
            <version>2.0.0</version>
            <description>
                <![CDATA[Detect whether a terminal supports color]]>
            </description>
            <hashes>
                <hash alg="SHA-1">535d045ce6b6363fa40117084629995e9df324c7</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/supports-color@2.0.0</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/chalk/supports-color#readme</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/chalk/supports-color/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git+https://github.com/chalk/supports-color.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/pretty-bytes@4.0.2">
            <name>pretty-bytes</name>
            <version>4.0.2</version>
            <description>
                <![CDATA[Convert bytes to a human readable string: 1337 → 1.34 kB]]>
            </description>
            <hashes>
                <hash alg="SHA-1">b2bf82e7350d65c6c33aa95aaa5a4f6327f61cd9</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/pretty-bytes@4.0.2</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/sindresorhus/pretty-bytes#readme</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/sindresorhus/pretty-bytes/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git+https://github.com/sindresorhus/pretty-bytes.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/stream-buffers@2.2.0">
            <name>stream-buffers</name>
            <version>2.2.0</version>
            <description>
                <![CDATA[Buffer-backed Streams for reading and writing.]]>
            </description>
            <hashes>
                <hash alg="SHA-1">91d5f5130d1cef96dcfa7f726945188741d09ee4</hash>
            </hashes>
            <licenses>
                <license>
                    <id>Unlicense</id>
                </license>
            </licenses>
            <purl>pkg:npm/stream-buffers@2.2.0</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/samcday/node-stream-buffer#readme</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/samcday/node-stream-buffer/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git+https://github.com/samcday/node-stream-buffer.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/grunt-replace-json@0.1.0">
            <name>grunt-replace-json</name>
            <version>0.1.0</version>
            <description>
                <![CDATA[Updates attributes of json files.]]>
            </description>
            <hashes>
                <hash alg="SHA-1">2e58602249181718f744147a9365e4d383ca15af</hash>
            </hashes>
            <purl>pkg:npm/grunt-replace-json@0.1.0</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/exo-dev/grunt-replace-json</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/exo-dev/grunt-replace-json/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git+https://github.com/exo-dev/grunt-replace-json.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/lodash.set@4.3.2">
            <name>lodash.set</name>
            <version>4.3.2</version>
            <description>
                <![CDATA[The lodash method `_.set` exported as a module.]]>
            </description>
            <hashes>
                <hash alg="SHA-1">d8757b1da807dde24816b0d6a84bea1a76230b23</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/lodash.set@4.3.2</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://lodash.com/</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/lodash/lodash/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git+https://github.com/lodash/lodash.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/hashids@2.2.1">
            <name>hashids</name>
            <version>2.2.1</version>
            <description>
                <![CDATA[Generate YouTube-like ids from numbers. Use Hashids when you do not want to expose your database ids to the user.]]>
            </description>
            <hashes>
                <hash alg="SHA-1">ad0c600f0083aa0df7451dfd184e53db34f71289</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/hashids@2.2.1</purl>
            <externalReferences>
                <reference type="website">
                    <url>http://hashids.org/javascript</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/niieani/hashids.js/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git+https://github.com/niieani/hashids.js.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/helmet@3.23.3">
            <name>helmet</name>
            <version>3.23.3</version>
            <description>
                <![CDATA[help secure Express/Connect apps with various HTTP headers]]>
            </description>
            <hashes>
                <hash alg="SHA-1">5ba30209c5f73ded4ab65746a3a11bedd4579ab7</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/helmet@3.23.3</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://helmetjs.github.io/</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/helmetjs/helmet/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git://github.com/helmetjs/helmet.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/depd@2.0.0">
            <name>depd</name>
            <version>2.0.0</version>
            <description>
                <![CDATA[Deprecate all the things]]>
            </description>
            <hashes>
                <hash alg="SHA-1">b696163cc757560d09cf22cc8fad1571b79e76df</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/depd@2.0.0</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/dougwilson/nodejs-depd#readme</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/dougwilson/nodejs-depd/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git+https://github.com/dougwilson/nodejs-depd.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/dont-sniff-mimetype@1.1.0">
            <name>dont-sniff-mimetype</name>
            <version>1.1.0</version>
            <description>
                <![CDATA[Middleware to prevent mimetype from being sniffed]]>
            </description>
            <hashes>
                <hash alg="SHA-1">c7d0427f8bcb095762751252af59d148b0a623b2</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/dont-sniff-mimetype@1.1.0</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://helmetjs.github.io/docs/dont-sniff-mimetype</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/helmetjs/dont-sniff-mimetype/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git://github.com/helmetjs/dont-sniff-mimetype.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/feature-policy@0.3.0">
            <name>feature-policy</name>
            <version>0.3.0</version>
            <description>
                <![CDATA[Middleware to set the Feature-Policy HTTP header]]>
            </description>
            <hashes>
                <hash alg="SHA-1">7430e8e54a40da01156ca30aaec1a381ce536069</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/feature-policy@0.3.0</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://helmetjs.github.io/docs/feature-policy/</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/helmetjs/feature-policy/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git://github.com/helmetjs/feature-policy.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/helmet-crossdomain@0.4.0">
            <name>helmet-crossdomain</name>
            <version>0.4.0</version>
            <description>
                <![CDATA[Set the X-Permitted-Cross-Domain-Policies header in Express apps]]>
            </description>
            <hashes>
                <hash alg="SHA-1">5f1fe5a836d0325f1da0a78eaa5fd8429078894e</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/helmet-crossdomain@0.4.0</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://helmetjs.github.io/docs/crossdomain/</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/helmetjs/crossdomain/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git://github.com/helmetjs/crossdomain.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/helmet-csp@2.10.0">
            <name>helmet-csp</name>
            <version>2.10.0</version>
            <description>
                <![CDATA[Content Security Policy middleware.]]>
            </description>
            <hashes>
                <hash alg="SHA-1">685dde1747bc16c5e28ad9d91e229a69f0a85e84</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/helmet-csp@2.10.0</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://helmetjs.github.io/docs/csp/</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/helmetjs/csp/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git://github.com/helmetjs/csp.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/bowser@2.9.0">
            <name>bowser</name>
            <version>2.9.0</version>
            <description>
                <![CDATA[Lightweight browser detector]]>
            </description>
            <hashes>
                <hash alg="SHA-1">3bed854233b419b9a7422d9ee3e85504373821c9</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/bowser@2.9.0</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/lancedikson/bowser</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/lancedikson/bowser/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git+https://github.com/lancedikson/bowser.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/camelize@1.0.0">
            <name>camelize</name>
            <version>1.0.0</version>
            <description>
                <![CDATA[recursively transform key strings to camel-case]]>
            </description>
            <hashes>
                <hash alg="SHA-1">164a5483e630fa4321e5af07020e531831b2609b</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/camelize@1.0.0</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/substack/camelize</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/substack/camelize/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git://github.com/substack/camelize.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/content-security-policy-builder@2.1.0">
            <name>content-security-policy-builder</name>
            <version>2.1.0</version>
            <description>
                <![CDATA[Build Content Security Policy directives.]]>
            </description>
            <hashes>
                <hash alg="SHA-1">0a2364d769a3d7014eec79ff7699804deb8cfcbb</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/content-security-policy-builder@2.1.0</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/helmetjs/content-security-policy-builder</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/helmetjs/content-security-policy-builder/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git://github.com/helmetjs/content-security-policy-builder.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/dasherize@2.0.0">
            <name>dasherize</name>
            <version>2.0.0</version>
            <description>
                <![CDATA[recursively transform key strings to dash-case]]>
            </description>
            <hashes>
                <hash alg="SHA-1">6d809c9cd0cf7bb8952d80fc84fa13d47ddb1308</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/dasherize@2.0.0</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/shahata/dasherize</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/shahata/dasherize/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git://github.com/shahata/dasherize.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/hide-powered-by@1.1.0">
            <name>hide-powered-by</name>
            <version>1.1.0</version>
            <description>
                <![CDATA[Middleware to remove the X-Powered-By header]]>
            </description>
            <hashes>
                <hash alg="SHA-1">be3ea9cab4bdb16f8744be873755ca663383fa7a</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/hide-powered-by@1.1.0</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://helmetjs.github.io/docs/hide-powered-by/</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/helmetjs/hide-powered-by/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git://github.com/helmetjs/hide-powered-by.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/hpkp@2.0.0">
            <name>hpkp</name>
            <version>2.0.0</version>
            <description>
                <![CDATA[HTTP Public Key Pinning (HPKP) middleware]]>
            </description>
            <hashes>
                <hash alg="SHA-1">10e142264e76215a5d30c44ec43de64dee6d1672</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/hpkp@2.0.0</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/helmetjs/hpkp#readme</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/helmetjs/hpkp/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git://github.com/helmetjs/hpkp.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/hsts@2.2.0">
            <name>hsts</name>
            <version>2.2.0</version>
            <description>
                <![CDATA[HTTP Strict Transport Security middleware.]]>
            </description>
            <hashes>
                <hash alg="SHA-1">09119d42f7a8587035d027dda4522366fe75d964</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/hsts@2.2.0</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://helmetjs.github.io/docs/hsts/</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/helmetjs/hsts/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git://github.com/helmetjs/hsts.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/nocache@2.1.0">
            <name>nocache</name>
            <version>2.1.0</version>
            <description>
                <![CDATA[Middleware to destroy caching]]>
            </description>
            <hashes>
                <hash alg="SHA-1">120c9ffec43b5729b1d5de88cd71aa75a0ba491f</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/nocache@2.1.0</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://helmetjs.github.io/docs/nocache/</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/helmetjs/nocache/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git://github.com/helmetjs/nocache.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/referrer-policy@1.2.0">
            <name>referrer-policy</name>
            <version>1.2.0</version>
            <description>
                <![CDATA[Middleware to set the Referrer-Policy HTTP header]]>
            </description>
            <hashes>
                <hash alg="SHA-1">b99cfb8b57090dc454895ef897a4cc35ef67a98e</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/referrer-policy@1.2.0</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://helmetjs.github.io/docs/referrer-policy/</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/helmetjs/referrer-policy/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git://github.com/helmetjs/referrer-policy.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/x-xss-protection@1.3.0">
            <name>x-xss-protection</name>
            <version>1.3.0</version>
            <description>
                <![CDATA[Middleware to set the X-XSS-Protection header]]>
            </description>
            <hashes>
                <hash alg="SHA-1">3e3a8dd638da80421b0e9fff11a2dbe168f6d52c</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/x-xss-protection@1.3.0</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://helmetjs.github.io/docs/xss-filter/</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/helmetjs/x-xss-protection/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git://github.com/helmetjs/x-xss-protection.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/html-entities@1.3.1">
            <name>html-entities</name>
            <version>1.3.1</version>
            <description>
                <![CDATA[Faster HTML entities encode/decode library.]]>
            </description>
            <hashes>
                <hash alg="SHA-1">fb9a1a4b5b14c5daba82d3e34c6ae4fe701a0e44</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/html-entities@1.3.1</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/mdevils/node-html-entities#readme</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/mdevils/node-html-entities/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git+https://github.com/mdevils/node-html-entities.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/i18n@0.8.6">
            <name>i18n</name>
            <version>0.8.6</version>
            <description>
                <![CDATA[lightweight translation module with dynamic json storage]]>
            </description>
            <hashes>
                <hash alg="SHA-1">9608c58bfb8e29db34aa9a09e37dccb9b5666e01</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/i18n@0.8.6</purl>
            <externalReferences>
                <reference type="website">
                    <url>http://github.com/mashpie/i18n-node</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/mashpie/i18n-node/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git+ssh://git@github.com/mashpie/i18n-node.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/make-plural@6.2.1">
            <name>make-plural</name>
            <version>6.2.1</version>
            <description>
                <![CDATA[Unicode CLDR pluralization rules as JavaScript functions]]>
            </description>
            <hashes>
                <hash alg="SHA-1">2790af1d05fb2fc35a111ce759ffdb0aca1339a3</hash>
            </hashes>
            <licenses>
                <license>
                    <id>ISC</id>
                </license>
            </licenses>
            <purl>pkg:npm/make-plural@6.2.1</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/eemeli/make-plural#readme</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/eemeli/make-plural/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git+https://github.com/eemeli/make-plural.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/math-interval-parser@2.0.1">
            <name>math-interval-parser</name>
            <version>2.0.1</version>
            <description>
                <![CDATA[Parse math interval]]>
            </description>
            <hashes>
                <hash alg="SHA-1">e22cd6d15a0a7f4c03aec560db76513da615bed4</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/math-interval-parser@2.0.1</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/Semigradsky/math-interval-parser#readme</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/Semigradsky/math-interval-parser/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git+https://github.com/Semigradsky/math-interval-parser.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/messageformat@2.3.0">
            <name>messageformat</name>
            <version>2.3.0</version>
            <description>
                <![CDATA[PluralFormat and SelectFormat Message and i18n Tool - A JavaScript Implemenation of the ICU standards.]]>
            </description>
            <hashes>
                <hash alg="SHA-1">de263c49029d5eae65d7ee25e0754f57f425ad91</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/messageformat@2.3.0</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://messageformat.github.io/messageformat/</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/messageformat/messageformat/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git+https://github.com/messageformat/messageformat.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/make-plural@4.3.0">
            <name>make-plural</name>
            <version>4.3.0</version>
            <description>
                <![CDATA[Translates Unicode CLDR pluralization rules to executable JavaScript]]>
            </description>
            <hashes>
                <hash alg="SHA-1">f23de08efdb0cac2e0c9ba9f315b0dff6b4c2735</hash>
            </hashes>
            <licenses>
                <license>
                    <id>ISC</id>
                </license>
            </licenses>
            <purl>pkg:npm/make-plural@4.3.0</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/eemeli/make-plural#readme</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/eemeli/make-plural/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git+https://github.com/eemeli/make-plural.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/messageformat-formatters@2.0.1">
            <name>messageformat-formatters</name>
            <version>2.0.1</version>
            <description>
                <![CDATA[Formatters for messageformat]]>
            </description>
            <hashes>
                <hash alg="SHA-1">0492c1402a48775f751c9b17c0354e92be012b08</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/messageformat-formatters@2.0.1</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://messageformat.github.io/</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/messageformat/messageformat/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git+https://github.com/messageformat/messageformat.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/messageformat-parser@4.1.3">
            <name>messageformat-parser</name>
            <version>4.1.3</version>
            <description>
                <![CDATA[A PEG.js parser for ICU MessageFormat strings]]>
            </description>
            <hashes>
                <hash alg="SHA-1">b824787f57fcda7d50769f5b63e8d4fda68f5b9e</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/messageformat-parser@4.1.3</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://messageformat.github.io/</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/messageformat/messageformat/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git+https://github.com/messageformat/messageformat.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/mustache@4.0.1">
            <name>mustache</name>
            <version>4.0.1</version>
            <description>
                <![CDATA[Logic-less {{mustache}} templates with JavaScript]]>
            </description>
            <hashes>
                <hash alg="SHA-1">d99beb031701ad433338e7ea65e0489416c854a2</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/mustache@4.0.1</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/janl/mustache.js</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/janl/mustache.js/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git+https://github.com/janl/mustache.js.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/is-docker@2.0.0">
            <name>is-docker</name>
            <version>2.0.0</version>
            <description>
                <![CDATA[Check if the process is running inside a Docker container]]>
            </description>
            <hashes>
                <hash alg="SHA-1">2cb0df0e75e2d064fe1864c37cdeacb7b2dcf25b</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/is-docker@2.0.0</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/sindresorhus/is-docker#readme</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/sindresorhus/is-docker/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git+https://github.com/sindresorhus/is-docker.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/is-heroku@2.0.0">
            <name>is-heroku</name>
            <version>2.0.0</version>
            <description>
                <![CDATA[Check if your code is running on Heroku]]>
            </description>
            <hashes>
                <hash alg="SHA-1">6482d1e861435103ae9f69e66f9bd28eb4ea0bca</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/is-heroku@2.0.0</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/sindresorhus/is-heroku#readme</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/sindresorhus/is-heroku/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git+https://github.com/sindresorhus/is-heroku.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/jsonwebtoken@0.4.0">
            <name>jsonwebtoken</name>
            <version>0.4.0</version>
            <description>
                <![CDATA[JSON Web Token implementation (symmetric and asymmetric)]]>
            </description>
            <hashes>
                <hash alg="SHA-1">7dfa44ac8a588e16e0453c81f11ab6addd0742fe</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/jsonwebtoken@0.4.0</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/auth0/node-jsonwebtoken#readme</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/auth0/node-jsonwebtoken/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git+https://github.com/auth0/node-jsonwebtoken.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/jssha@2.4.2">
            <name>jssha</name>
            <version>2.4.2</version>
            <description>
                <![CDATA[jsSHA is a JavaScript implementation of the complete Secure Hash Standard family (SHA-1, SHA-224, SHA3-224, SHA-256, SHA3-256, SHA-384, SHA3-384, SHA-512, SHA3-512, SHAKE128, and SHAKE256) as well as HMAC]]>
            </description>
            <hashes>
                <hash alg="SHA-1">d950b095634928bd6b2bda1d42da9a3a762d65e9</hash>
            </hashes>
            <licenses>
                <license>
                    <id>BSD-3-Clause</id>
                </license>
            </licenses>
            <purl>pkg:npm/jssha@2.4.2</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/Caligatio/jsSHA</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/Caligatio/jsSHA/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git+https://github.com/Caligatio/jsSHA.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/libxmljs2@0.25.5">
            <name>libxmljs2</name>
            <version>0.25.5</version>
            <description>
                <![CDATA[libxml bindings for v8 javascript engine]]>
            </description>
            <hashes>
                <hash alg="SHA-1">71f491af11a9df29e04648ea46b14a41b256fe66</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/libxmljs2@0.25.5</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/marudor/libxmljs2#readme</url>
                </reference>
                <reference type="issue-tracker">
                    <url>http://github.com/marudor/libxmljs2/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git+ssh://git@github.com/marudor/libxmljs2.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/bindings@1.5.0">
            <name>bindings</name>
            <version>1.5.0</version>
            <description>
                <![CDATA[Helper module for loading your native module's .node file]]>
            </description>
            <hashes>
                <hash alg="SHA-1">10353c9e945334bc0511a6d90b38fbc7c9c504df</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/bindings@1.5.0</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/TooTallNate/node-bindings</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/TooTallNate/node-bindings/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git://github.com/TooTallNate/node-bindings.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/file-uri-to-path@1.0.0">
            <name>file-uri-to-path</name>
            <version>1.0.0</version>
            <description>
                <![CDATA[Convert a file: URI to a file path]]>
            </description>
            <hashes>
                <hash alg="SHA-1">553a7b8446ff6f684359c445f1e37a05dacc33dd</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/file-uri-to-path@1.0.0</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/TooTallNate/file-uri-to-path</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/TooTallNate/file-uri-to-path/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git://github.com/TooTallNate/file-uri-to-path.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/nan@2.14.1">
            <name>nan</name>
            <version>2.14.1</version>
            <description>
                <![CDATA[Native Abstractions for Node.js: C++ header for Node 0.8 -> 14 compatibility]]>
            </description>
            <hashes>
                <hash alg="SHA-1">d7be34dfa3105b91494c3147089315eff8874b01</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/nan@2.14.1</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/nodejs/nan#readme</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/nodejs/nan/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git://github.com/nodejs/nan.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/node-pre-gyp@0.15.0">
            <name>node-pre-gyp</name>
            <version>0.15.0</version>
            <description>
                <![CDATA[Node.js native addon binary install tool]]>
            </description>
            <hashes>
                <hash alg="SHA-1">c2fc383276b74c7ffa842925241553e8b40f1087</hash>
            </hashes>
            <licenses>
                <license>
                    <id>BSD-3-Clause</id>
                </license>
            </licenses>
            <purl>pkg:npm/node-pre-gyp@0.15.0</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/mapbox/node-pre-gyp#readme</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/mapbox/node-pre-gyp/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git://github.com/mapbox/node-pre-gyp.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/detect-libc@1.0.3">
            <name>detect-libc</name>
            <version>1.0.3</version>
            <description>
                <![CDATA[Node.js module to detect the C standard library (libc) implementation family and version]]>
            </description>
            <hashes>
                <hash alg="SHA-1">fa137c4bd698edf55cd5cd02ac559f91a4c4ba9b</hash>
            </hashes>
            <licenses>
                <license>
                    <id>Apache-2.0</id>
                </license>
            </licenses>
            <purl>pkg:npm/detect-libc@1.0.3</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/lovell/detect-libc#readme</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/lovell/detect-libc/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git://github.com/lovell/detect-libc.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/mkdirp@0.5.5">
            <name>mkdirp</name>
            <version>0.5.5</version>
            <description>
                <![CDATA[Recursively mkdir, like `mkdir -p`]]>
            </description>
            <hashes>
                <hash alg="SHA-1">d91cefd62d1436ca0f41620e251288d420099def</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/mkdirp@0.5.5</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/substack/node-mkdirp#readme</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/substack/node-mkdirp/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git+https://github.com/substack/node-mkdirp.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/needle@2.5.0">
            <name>needle</name>
            <version>2.5.0</version>
            <description>
                <![CDATA[The leanest and most handsome HTTP client in the Nodelands.]]>
            </description>
            <hashes>
                <hash alg="SHA-1">e6fc4b3cc6c25caed7554bd613a5cf0bac8c31c0</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/needle@2.5.0</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/tomas/needle#readme</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/tomas/needle/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git+https://github.com/tomas/needle.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/debug@3.2.6">
            <name>debug</name>
            <version>3.2.6</version>
            <description>
                <![CDATA[small debugging utility]]>
            </description>
            <hashes>
                <hash alg="SHA-1">e83d17de16d8a7efb7717edbe5fb10135eee629b</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/debug@3.2.6</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/visionmedia/debug#readme</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/visionmedia/debug/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git://github.com/visionmedia/debug.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/ms@2.1.2">
            <name>ms</name>
            <version>2.1.2</version>
            <description>
                <![CDATA[Tiny millisecond conversion utility]]>
            </description>
            <hashes>
                <hash alg="SHA-1">d09d1f357b443f493382a8eb3ccd183872ae6009</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/ms@2.1.2</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/zeit/ms#readme</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/zeit/ms/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git+https://github.com/zeit/ms.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/sax@1.2.4">
            <name>sax</name>
            <version>1.2.4</version>
            <description>
                <![CDATA[An evented streaming XML parser in JavaScript]]>
            </description>
            <hashes>
                <hash alg="SHA-1">2816234e2378bddc4e5354fab5caa895df7100d9</hash>
            </hashes>
            <licenses>
                <license>
                    <id>ISC</id>
                </license>
            </licenses>
            <purl>pkg:npm/sax@1.2.4</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/isaacs/sax-js#readme</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/isaacs/sax-js/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git://github.com/isaacs/sax-js.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/npm-packlist@1.4.8">
            <name>npm-packlist</name>
            <version>1.4.8</version>
            <description>
                <![CDATA[Get a list of the files to add from a folder into an npm package]]>
            </description>
            <hashes>
                <hash alg="SHA-1">56ee6cc135b9f98ad3d51c1c95da22bbb9b2ef3e</hash>
            </hashes>
            <licenses>
                <license>
                    <id>ISC</id>
                </license>
            </licenses>
            <purl>pkg:npm/npm-packlist@1.4.8</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://www.npmjs.com/package/npm-packlist</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/npm/npm-packlist/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git+https://github.com/npm/npm-packlist.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/ignore-walk@3.0.3">
            <name>ignore-walk</name>
            <version>3.0.3</version>
            <description>
                <![CDATA[Nested/recursive `.gitignore`/`.npmignore` parsing and filtering.]]>
            </description>
            <hashes>
                <hash alg="SHA-1">017e2447184bfeade7c238e4aefdd1e8f95b1e37</hash>
            </hashes>
            <licenses>
                <license>
                    <id>ISC</id>
                </license>
            </licenses>
            <purl>pkg:npm/ignore-walk@3.0.3</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/isaacs/ignore-walk#readme</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/isaacs/ignore-walk/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git+https://github.com/isaacs/ignore-walk.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/npm-bundled@1.1.1">
            <name>npm-bundled</name>
            <version>1.1.1</version>
            <description>
                <![CDATA[list things in node_modules that are bundledDependencies, or transitive dependencies thereof]]>
            </description>
            <hashes>
                <hash alg="SHA-1">1edd570865a94cdb1bc8220775e29466c9fb234b</hash>
            </hashes>
            <licenses>
                <license>
                    <id>ISC</id>
                </license>
            </licenses>
            <purl>pkg:npm/npm-bundled@1.1.1</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/npm/npm-bundled#readme</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/npm/npm-bundled/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git+https://github.com/npm/npm-bundled.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/npm-normalize-package-bin@1.0.1">
            <name>npm-normalize-package-bin</name>
            <version>1.0.1</version>
            <description>
                <![CDATA[Turn any flavor of allowable package.json bin into a normalized object]]>
            </description>
            <hashes>
                <hash alg="SHA-1">6e79a41f23fd235c0623218228da7d9c23b8f6e2</hash>
            </hashes>
            <licenses>
                <license>
                    <id>ISC</id>
                </license>
            </licenses>
            <purl>pkg:npm/npm-normalize-package-bin@1.0.1</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/npm/npm-normalize-package-bin#readme</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/npm/npm-normalize-package-bin/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git+https://github.com/npm/npm-normalize-package-bin.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/npmlog@4.1.2">
            <name>npmlog</name>
            <version>4.1.2</version>
            <description>
                <![CDATA[logger for npm]]>
            </description>
            <hashes>
                <hash alg="SHA-1">08a7f2a8bf734604779a9efa4ad5cc717abb954b</hash>
            </hashes>
            <licenses>
                <license>
                    <id>ISC</id>
                </license>
            </licenses>
            <purl>pkg:npm/npmlog@4.1.2</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/npm/npmlog#readme</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/npm/npmlog/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git+https://github.com/npm/npmlog.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/are-we-there-yet@1.1.5">
            <name>are-we-there-yet</name>
            <version>1.1.5</version>
            <description>
                <![CDATA[Keep track of the overall completion of many disparate processes]]>
            </description>
            <hashes>
                <hash alg="SHA-1">4b35c2944f062a8bfcda66410760350fe9ddfc21</hash>
            </hashes>
            <licenses>
                <license>
                    <id>ISC</id>
                </license>
            </licenses>
            <purl>pkg:npm/are-we-there-yet@1.1.5</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/iarna/are-we-there-yet</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/iarna/are-we-there-yet/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git+https://github.com/iarna/are-we-there-yet.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/delegates@1.0.0">
            <name>delegates</name>
            <version>1.0.0</version>
            <description>
                <![CDATA[delegate methods and accessors to another property]]>
            </description>
            <hashes>
                <hash alg="SHA-1">84c6e159b81904fdca59a0ef44cd870d31250f9a</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/delegates@1.0.0</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/visionmedia/node-delegates#readme</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/visionmedia/node-delegates/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git+https://github.com/visionmedia/node-delegates.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/console-control-strings@1.1.0">
            <name>console-control-strings</name>
            <version>1.1.0</version>
            <description>
                <![CDATA[A library of cross-platform tested terminal/console command strings for doing things like color and cursor positioning.  This is a subset of both ansi and vt100.  All control codes included work on both Windows & Unix-like OSes, except where noted.]]>
            </description>
            <hashes>
                <hash alg="SHA-1">3d7cf4464db6446ea644bf4b39507f9851008e8e</hash>
            </hashes>
            <licenses>
                <license>
                    <id>ISC</id>
                </license>
            </licenses>
            <purl>pkg:npm/console-control-strings@1.1.0</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/iarna/console-control-strings#readme</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/iarna/console-control-strings/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git+https://github.com/iarna/console-control-strings.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/gauge@2.7.4">
            <name>gauge</name>
            <version>2.7.4</version>
            <description>
                <![CDATA[A terminal based horizontal guage]]>
            </description>
            <hashes>
                <hash alg="SHA-1">2c03405c7538c39d7eb37b317022e325fb018bf7</hash>
            </hashes>
            <licenses>
                <license>
                    <id>ISC</id>
                </license>
            </licenses>
            <purl>pkg:npm/gauge@2.7.4</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/iarna/gauge</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/iarna/gauge/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git+https://github.com/iarna/gauge.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/aproba@1.2.0">
            <name>aproba</name>
            <version>1.2.0</version>
            <description>
                <![CDATA[A ridiculously light-weight argument validator (now browser friendly)]]>
            </description>
            <hashes>
                <hash alg="SHA-1">6802e6264efd18c790a1b0d517f0f2627bf2c94a</hash>
            </hashes>
            <licenses>
                <license>
                    <id>ISC</id>
                </license>
            </licenses>
            <purl>pkg:npm/aproba@1.2.0</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/iarna/aproba</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/iarna/aproba/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git+https://github.com/iarna/aproba.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/has-unicode@2.0.1">
            <name>has-unicode</name>
            <version>2.0.1</version>
            <description>
                <![CDATA[Try to guess if your terminal supports unicode]]>
            </description>
            <hashes>
                <hash alg="SHA-1">e0e6fe6a28cf51138855e086d1691e771de2a8b9</hash>
            </hashes>
            <licenses>
                <license>
                    <id>ISC</id>
                </license>
            </licenses>
            <purl>pkg:npm/has-unicode@2.0.1</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/iarna/has-unicode</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/iarna/has-unicode/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git+https://github.com/iarna/has-unicode.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/signal-exit@3.0.3">
            <name>signal-exit</name>
            <version>3.0.3</version>
            <description>
                <![CDATA[when you want to fire an event no matter how a process exits.]]>
            </description>
            <hashes>
                <hash alg="SHA-1">a1410c2edd8f077b08b4e253c8eacfcaf057461c</hash>
            </hashes>
            <licenses>
                <license>
                    <id>ISC</id>
                </license>
            </licenses>
            <purl>pkg:npm/signal-exit@3.0.3</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/tapjs/signal-exit</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/tapjs/signal-exit/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git+https://github.com/tapjs/signal-exit.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/string-width@1.0.2">
            <name>string-width</name>
            <version>1.0.2</version>
            <description>
                <![CDATA[Get the visual width of a string - the number of columns required to display it]]>
            </description>
            <hashes>
                <hash alg="SHA-1">118bdf5b8cdc51a2a7e70d211e07e2b0b9b107d3</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/string-width@1.0.2</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/sindresorhus/string-width#readme</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/sindresorhus/string-width/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git+https://github.com/sindresorhus/string-width.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/code-point-at@1.1.0">
            <name>code-point-at</name>
            <version>1.1.0</version>
            <description>
                <![CDATA[ES2015 `String#codePointAt()` ponyfill]]>
            </description>
            <hashes>
                <hash alg="SHA-1">0d070b4d043a5bea33a2f1a40e2edb3d9a4ccf77</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/code-point-at@1.1.0</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/sindresorhus/code-point-at#readme</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/sindresorhus/code-point-at/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git+https://github.com/sindresorhus/code-point-at.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/is-fullwidth-code-point@1.0.0">
            <name>is-fullwidth-code-point</name>
            <version>1.0.0</version>
            <description>
                <![CDATA[Check if the character represented by a given Unicode code point is fullwidth]]>
            </description>
            <hashes>
                <hash alg="SHA-1">ef9e31386f031a7f0d643af82fde50c457ef00cb</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/is-fullwidth-code-point@1.0.0</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/sindresorhus/is-fullwidth-code-point#readme</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/sindresorhus/is-fullwidth-code-point/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git+https://github.com/sindresorhus/is-fullwidth-code-point.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/number-is-nan@1.0.1">
            <name>number-is-nan</name>
            <version>1.0.1</version>
            <description>
                <![CDATA[ES2015 Number.isNaN() ponyfill]]>
            </description>
            <hashes>
                <hash alg="SHA-1">097b602b53422a522c1afb8790318336941a011d</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/number-is-nan@1.0.1</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/sindresorhus/number-is-nan#readme</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/sindresorhus/number-is-nan/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git+https://github.com/sindresorhus/number-is-nan.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/wide-align@1.1.3">
            <name>wide-align</name>
            <version>1.1.3</version>
            <description>
                <![CDATA[A wide-character aware text alignment function for use on the console or with fixed width fonts.]]>
            </description>
            <hashes>
                <hash alg="SHA-1">ae074e6bdc0c14a431e804e624549c633b000457</hash>
            </hashes>
            <licenses>
                <license>
                    <id>ISC</id>
                </license>
            </licenses>
            <purl>pkg:npm/wide-align@1.1.3</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/iarna/wide-align#readme</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/iarna/wide-align/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git+https://github.com/iarna/wide-align.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/string-width@2.1.1">
            <name>string-width</name>
            <version>2.1.1</version>
            <description>
                <![CDATA[Get the visual width of a string - the number of columns required to display it]]>
            </description>
            <hashes>
                <hash alg="SHA-1">ab93f27a8dc13d28cac815c462143a6d9012ae9e</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/string-width@2.1.1</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/sindresorhus/string-width#readme</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/sindresorhus/string-width/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git+https://github.com/sindresorhus/string-width.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/strip-ansi@4.0.0">
            <name>strip-ansi</name>
            <version>4.0.0</version>
            <description>
                <![CDATA[Strip ANSI escape codes]]>
            </description>
            <hashes>
                <hash alg="SHA-1">a8479022eb1ac368a871389b635262c505ee368f</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/strip-ansi@4.0.0</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/chalk/strip-ansi#readme</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/chalk/strip-ansi/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git+https://github.com/chalk/strip-ansi.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/ansi-regex@3.0.0">
            <name>ansi-regex</name>
            <version>3.0.0</version>
            <description>
                <![CDATA[Regular expression for matching ANSI escape codes]]>
            </description>
            <hashes>
                <hash alg="SHA-1">ed0317c322064f79466c02966bddb605ab37d998</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/ansi-regex@3.0.0</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/chalk/ansi-regex#readme</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/chalk/ansi-regex/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git+https://github.com/chalk/ansi-regex.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/rc@1.2.8">
            <name>rc</name>
            <version>1.2.8</version>
            <description>
                <![CDATA[hardwired configuration loader]]>
            </description>
            <hashes>
                <hash alg="SHA-1">cd924bf5200a075b83c188cd6b9e211b7fc0d3ed</hash>
            </hashes>
            <licenses>
                <license>
                    <name>(BSD-2-Clause OR MIT OR Apache-2.0)</name>
                </license>
            </licenses>
            <purl>pkg:npm/rc@1.2.8</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/dominictarr/rc#readme</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/dominictarr/rc/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git+https://github.com/dominictarr/rc.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/deep-extend@0.6.0">
            <name>deep-extend</name>
            <version>0.6.0</version>
            <description>
                <![CDATA[Recursive object extending]]>
            </description>
            <hashes>
                <hash alg="SHA-1">c4fa7c95404a17a9c3e8ca7e1537312b736330ac</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/deep-extend@0.6.0</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/unclechu/node-deep-extend</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/unclechu/node-deep-extend/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git://github.com/unclechu/node-deep-extend.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/strip-json-comments@2.0.1">
            <name>strip-json-comments</name>
            <version>2.0.1</version>
            <description>
                <![CDATA[Strip comments from JSON. Lets you use comments in your JSON files!]]>
            </description>
            <hashes>
                <hash alg="SHA-1">3c531942e908c2697c0ec344858c286c7ca0a60a</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/strip-json-comments@2.0.1</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/sindresorhus/strip-json-comments#readme</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/sindresorhus/strip-json-comments/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git+https://github.com/sindresorhus/strip-json-comments.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/rimraf@2.7.1">
            <name>rimraf</name>
            <version>2.7.1</version>
            <description>
                <![CDATA[A deep deletion module for node (like `rm -rf`)]]>
            </description>
            <hashes>
                <hash alg="SHA-1">35797f13a7fdadc566142c29d4f07ccad483e3ec</hash>
            </hashes>
            <licenses>
                <license>
                    <id>ISC</id>
                </license>
            </licenses>
            <purl>pkg:npm/rimraf@2.7.1</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/isaacs/rimraf#readme</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/isaacs/rimraf/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git://github.com/isaacs/rimraf.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/tar@4.4.13">
            <name>tar</name>
            <version>4.4.13</version>
            <description>
                <![CDATA[tar for node]]>
            </description>
            <hashes>
                <hash alg="SHA-1">43b364bc52888d555298637b10d60790254ab525</hash>
            </hashes>
            <licenses>
                <license>
                    <id>ISC</id>
                </license>
            </licenses>
            <purl>pkg:npm/tar@4.4.13</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/npm/node-tar#readme</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/npm/node-tar/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git+https://github.com/npm/node-tar.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/chownr@1.1.4">
            <name>chownr</name>
            <version>1.1.4</version>
            <description>
                <![CDATA[like `chown -R`]]>
            </description>
            <hashes>
                <hash alg="SHA-1">6fc9d7b42d32a583596337666e7d08084da2cc6b</hash>
            </hashes>
            <licenses>
                <license>
                    <id>ISC</id>
                </license>
            </licenses>
            <purl>pkg:npm/chownr@1.1.4</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/isaacs/chownr#readme</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/isaacs/chownr/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git://github.com/isaacs/chownr.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/fs-minipass@1.2.7">
            <name>fs-minipass</name>
            <version>1.2.7</version>
            <description>
                <![CDATA[fs read and write streams based on minipass]]>
            </description>
            <hashes>
                <hash alg="SHA-1">ccff8570841e7fe4265693da88936c55aed7f7c7</hash>
            </hashes>
            <licenses>
                <license>
                    <id>ISC</id>
                </license>
            </licenses>
            <purl>pkg:npm/fs-minipass@1.2.7</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/npm/fs-minipass#readme</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/npm/fs-minipass/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git+https://github.com/npm/fs-minipass.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/minipass@2.9.0">
            <name>minipass</name>
            <version>2.9.0</version>
            <description>
                <![CDATA[minimal implementation of a PassThrough stream]]>
            </description>
            <hashes>
                <hash alg="SHA-1">e713762e7d3e32fed803115cf93e04bca9fcc9a6</hash>
            </hashes>
            <licenses>
                <license>
                    <id>ISC</id>
                </license>
            </licenses>
            <purl>pkg:npm/minipass@2.9.0</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/isaacs/minipass#readme</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/isaacs/minipass/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git+https://github.com/isaacs/minipass.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/yallist@3.1.1">
            <name>yallist</name>
            <version>3.1.1</version>
            <description>
                <![CDATA[Yet Another Linked List]]>
            </description>
            <hashes>
                <hash alg="SHA-1">dbb7daf9bfd8bac9ab45ebf602b8cbad0d5d08fd</hash>
            </hashes>
            <licenses>
                <license>
                    <id>ISC</id>
                </license>
            </licenses>
            <purl>pkg:npm/yallist@3.1.1</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/isaacs/yallist#readme</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/isaacs/yallist/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git+https://github.com/isaacs/yallist.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/minizlib@1.3.3">
            <name>minizlib</name>
            <version>1.3.3</version>
            <description>
                <![CDATA[A small fast zlib stream built on [minipass](http://npm.im/minipass) and Node.js's zlib binding.]]>
            </description>
            <hashes>
                <hash alg="SHA-1">2290de96818a34c29551c8a8d301216bd65a861d</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/minizlib@1.3.3</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/isaacs/minizlib#readme</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/isaacs/minizlib/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git+https://github.com/isaacs/minizlib.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/marsdb@0.6.11">
            <name>marsdb</name>
            <version>0.6.11</version>
            <description>
                <![CDATA[MarsDB is a lightweight client-side MongoDB-like database, Promise based, written in ES6]]>
            </description>
            <hashes>
                <hash alg="SHA-1">005b4af67e41df4efe73efed577adf29135d9712</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/marsdb@0.6.11</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/c58/marsdb</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/c58/marsdb/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git+ssh://git@github.com/c58/marsdb.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/check-types@6.0.0">
            <name>check-types</name>
            <version>6.0.0</version>
            <description>
                <![CDATA[A little library for asserting types and values.]]>
            </description>
            <hashes>
                <hash alg="SHA-1">de12a2ffc295df40b3afca2bcfeb831bc5f5edf0</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/check-types@6.0.0</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/philbooth/check-types.js</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/philbooth/check-types.js/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git+https://github.com/philbooth/check-types.js.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/double-ended-queue@0.9.7">
            <name>double-ended-queue</name>
            <version>0.9.7</version>
            <description>
                <![CDATA[Extremely fast double-ended queue implementation]]>
            </description>
            <hashes>
                <hash alg="SHA-1">8ae0a7265df66cdc3f07dce558e9716adb586ab8</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/double-ended-queue@0.9.7</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/petkaantonov/deque</url>
                </reference>
                <reference type="issue-tracker">
                    <url>http://github.com/petkaantonov/deque/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git://github.com/petkaantonov/deque.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/eventemitter3@1.1.1">
            <name>eventemitter3</name>
            <version>1.1.1</version>
            <description>
                <![CDATA[EventEmitter3 focuses on performance while maintaining a Node.js AND browser compatible interface.]]>
            </description>
            <hashes>
                <hash alg="SHA-1">47786bdaa087caf7b1b75e73abc5c7d540158cd0</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/eventemitter3@1.1.1</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/primus/eventemitter3#readme</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/primus/eventemitter3/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git://github.com/primus/eventemitter3.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/fast.js@0.1.1">
            <name>fast.js</name>
            <version>0.1.1</version>
            <description>
                <![CDATA[Faster user-land reimplementations of native functions with extra helpers.]]>
            </description>
            <hashes>
                <hash alg="SHA-1">7c024d55ae144882fbcee44b79005fe2dcabd9fe</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/fast.js@0.1.1</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/codemix/fast.js</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/codemix/fast.js/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git+ssh://git@github.com/codemix/fast.js.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/geojson-utils@1.1.0">
            <name>geojson-utils</name>
            <version>1.1.0</version>
            <description>
                <![CDATA[GeoJSON Utilities for JavaScript]]>
            </description>
            <hashes>
                <hash alg="SHA-1">e8ffb4c81c0a75b3e306f5187265d6f23040f50b</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/geojson-utils@1.1.0</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/maxogden/geojson-js-utils#readme</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/maxogden/geojson-js-utils/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git://github.com/maxogden/geojson-js-utils.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/invariant@2.2.4">
            <name>invariant</name>
            <version>2.2.4</version>
            <description>
                <![CDATA[invariant]]>
            </description>
            <hashes>
                <hash alg="SHA-1">610f3c92c9359ce1db616e538008d23ff35158e6</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/invariant@2.2.4</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/zertosh/invariant#readme</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/zertosh/invariant/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git+https://github.com/zertosh/invariant.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/loose-envify@1.4.0">
            <name>loose-envify</name>
            <version>1.4.0</version>
            <description>
                <![CDATA[Fast (and loose) selective `process.env` replacer using js-tokens instead of an AST]]>
            </description>
            <hashes>
                <hash alg="SHA-1">71ee51fa7be4caec1a63839f7e682d8132d30caf</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/loose-envify@1.4.0</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/zertosh/loose-envify</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/zertosh/loose-envify/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git://github.com/zertosh/loose-envify.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/js-tokens@4.0.0">
            <name>js-tokens</name>
            <version>4.0.0</version>
            <description>
                <![CDATA[A regex that tokenizes JavaScript.]]>
            </description>
            <hashes>
                <hash alg="SHA-1">19203fb59991df98e3a287050d4647cdeaf32499</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/js-tokens@4.0.0</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/lydell/js-tokens#readme</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/lydell/js-tokens/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git+https://github.com/lydell/js-tokens.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/morgan@1.10.0">
            <name>morgan</name>
            <version>1.10.0</version>
            <description>
                <![CDATA[HTTP request logger middleware for node.js]]>
            </description>
            <hashes>
                <hash alg="SHA-1">091778abc1fc47cd3509824653dae1faab6b17d7</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/morgan@1.10.0</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/expressjs/morgan#readme</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/expressjs/morgan/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git+https://github.com/expressjs/morgan.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/basic-auth@2.0.1">
            <name>basic-auth</name>
            <version>2.0.1</version>
            <description>
                <![CDATA[node.js basic auth parser]]>
            </description>
            <hashes>
                <hash alg="SHA-1">b998279bf47ce38344b4f3cf916d4679bbf51e3a</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/basic-auth@2.0.1</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/jshttp/basic-auth#readme</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/jshttp/basic-auth/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git+https://github.com/jshttp/basic-auth.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/multer@1.4.2">
            <name>multer</name>
            <version>1.4.2</version>
            <description>
                <![CDATA[Middleware for handling `multipart/form-data`.]]>
            </description>
            <hashes>
                <hash alg="SHA-1">2f1f4d12dbaeeba74cb37e623f234bf4d3d2057a</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/multer@1.4.2</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/expressjs/multer#readme</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/expressjs/multer/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git+https://github.com/expressjs/multer.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/append-field@1.0.0">
            <name>append-field</name>
            <version>1.0.0</version>
            <description>
                <![CDATA[A [W3C HTML JSON forms spec](http://www.w3.org/TR/html-json-forms/) compliant field appender (for lack of a better name). Useful for people implementing `application/x-www-form-urlencoded` and `multipart/form-data` parsers.]]>
            </description>
            <hashes>
                <hash alg="SHA-1">1e3440e915f0b1203d23748e78edd7b9b5b43e56</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/append-field@1.0.0</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/LinusU/node-append-field#readme</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/LinusU/node-append-field/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git+ssh://git@github.com/LinusU/node-append-field.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/busboy@0.2.14">
            <name>busboy</name>
            <version>0.2.14</version>
            <description>
                <![CDATA[A streaming parser for HTML form data for node.js]]>
            </description>
            <hashes>
                <hash alg="SHA-1">6c2a622efcf47c57bbbe1e2a9c37ad36c7925453</hash>
            </hashes>
            <purl>pkg:npm/busboy@0.2.14</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/mscdex/busboy#readme</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/mscdex/busboy/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git+ssh://git@github.com/mscdex/busboy.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/dicer@0.2.5">
            <name>dicer</name>
            <version>0.2.5</version>
            <description>
                <![CDATA[A very fast streaming multipart parser for node.js]]>
            </description>
            <hashes>
                <hash alg="SHA-1">5996c086bb33218c812c090bddc09cd12facb70f</hash>
            </hashes>
            <purl>pkg:npm/dicer@0.2.5</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/mscdex/dicer#readme</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/mscdex/dicer/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git+ssh://git@github.com/mscdex/dicer.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/readable-stream@1.1.14">
            <name>readable-stream</name>
            <version>1.1.14</version>
            <description>
                <![CDATA[Streams3, a user-land copy of the stream library from Node.js v0.11.x]]>
            </description>
            <hashes>
                <hash alg="SHA-1">7cf4c54ef648e3813084c636dd2079e166c081d9</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/readable-stream@1.1.14</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/isaacs/readable-stream#readme</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/isaacs/readable-stream/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git://github.com/isaacs/readable-stream.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/isarray@0.0.1">
            <name>isarray</name>
            <version>0.0.1</version>
            <description>
                <![CDATA[Array#isArray for older browsers]]>
            </description>
            <hashes>
                <hash alg="SHA-1">8a18acfca9a8f4177e09abfc6038939b05d1eedf</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/isarray@0.0.1</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/juliangruber/isarray</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/juliangruber/isarray/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git://github.com/juliangruber/isarray.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/string_decoder@0.10.31">
            <name>string_decoder</name>
            <version>0.10.31</version>
            <description>
                <![CDATA[The string_decoder module from Node core]]>
            </description>
            <hashes>
                <hash alg="SHA-1">62e203bc41766c6c28c9fc84301dab1c5310fa94</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/string_decoder@0.10.31</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/rvagg/string_decoder</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/rvagg/string_decoder/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git://github.com/rvagg/string_decoder.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/streamsearch@0.1.2">
            <name>streamsearch</name>
            <version>0.1.2</version>
            <description>
                <![CDATA[Streaming Boyer-Moore-Horspool searching for node.js]]>
            </description>
            <hashes>
                <hash alg="SHA-1">808b9d0e56fc273d809ba57338e929919a1a9f1a</hash>
            </hashes>
            <purl>pkg:npm/streamsearch@0.1.2</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/mscdex/streamsearch#readme</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/mscdex/streamsearch/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git+ssh://git@github.com/mscdex/streamsearch.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/concat-stream@1.6.2">
            <name>concat-stream</name>
            <version>1.6.2</version>
            <description>
                <![CDATA[writable stream that concatenates strings or binary data and calls a callback with the result]]>
            </description>
            <hashes>
                <hash alg="SHA-1">904bdf194cd3122fc675c77fc4ac3d4ff0fd1a34</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/concat-stream@1.6.2</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/maxogden/concat-stream#readme</url>
                </reference>
                <reference type="issue-tracker">
                    <url>http://github.com/maxogden/concat-stream/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git+ssh://git@github.com/maxogden/concat-stream.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/buffer-from@1.1.1">
            <name>buffer-from</name>
            <version>1.1.1</version>
            <description>
                <![CDATA[A [ponyfill](https://ponyfill.com) for `Buffer.from`, uses native implementation if available.]]>
            </description>
            <hashes>
                <hash alg="SHA-1">32713bc028f75c02fdb710d7c7bcec1f2c6070ef</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/buffer-from@1.1.1</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/LinusU/buffer-from#readme</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/LinusU/buffer-from/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git+https://github.com/LinusU/buffer-from.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/typedarray@0.0.6">
            <name>typedarray</name>
            <version>0.0.6</version>
            <description>
                <![CDATA[TypedArray polyfill for old browsers]]>
            </description>
            <hashes>
                <hash alg="SHA-1">867ac74e3864187b1d3d47d996a78ec5c8830777</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/typedarray@0.0.6</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/substack/typedarray</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/substack/typedarray/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git://github.com/substack/typedarray.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/node-pre-gyp@0.14.0">
            <name>node-pre-gyp</name>
            <version>0.14.0</version>
            <description>
                <![CDATA[Node.js native addon binary install tool]]>
            </description>
            <hashes>
                <hash alg="SHA-1">9a0596533b877289bcad4e143982ca3d904ddc83</hash>
            </hashes>
            <licenses>
                <license>
                    <id>BSD-3-Clause</id>
                </license>
            </licenses>
            <purl>pkg:npm/node-pre-gyp@0.14.0</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/mapbox/node-pre-gyp#readme</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/mapbox/node-pre-gyp/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git://github.com/mapbox/node-pre-gyp.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/notevil@1.3.3">
            <name>notevil</name>
            <version>1.3.3</version>
            <description>
                <![CDATA[Evalulate javascript like the built-in eval() method but safely]]>
            </description>
            <hashes>
                <hash alg="SHA-1">56b8a935d8978e0c000749621aca3928b823cb01</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/notevil@1.3.3</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/mmckegg/notevil#readme</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/mmckegg/notevil/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git+https://github.com/mmckegg/notevil.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/esprima@1.0.4">
            <name>esprima</name>
            <version>1.0.4</version>
            <description>
                <![CDATA[ECMAScript parsing infrastructure for multipurpose analysis]]>
            </description>
            <hashes>
                <hash alg="SHA-1">9f557e08fc3b4d26ece9dd34f8fbf476b62585ad</hash>
            </hashes>
            <purl>pkg:npm/esprima@1.0.4</purl>
            <externalReferences>
                <reference type="website">
                    <url>http://esprima.org</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/ariya/esprima/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git+ssh://git@github.com/ariya/esprima.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/hoister@0.0.2">
            <name>hoister</name>
            <version>0.0.2</version>
            <description>
                <![CDATA[Put all function and variable declarations at the top of the scope in an AST]]>
            </description>
            <hashes>
                <hash alg="SHA-1">0d0d8b1ce0f191553e61afec654f6b180eb96e5d</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/hoister@0.0.2</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/mmckegg/hoister#readme</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/mmckegg/hoister/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git+https://github.com/mmckegg/hoister.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/otplib@11.0.1">
            <name>otplib</name>
            <version>11.0.1</version>
            <description>
                <![CDATA[HMAC-based (HOTP) and Time-based (TOTP) One-Time Password library]]>
            </description>
            <hashes>
                <hash alg="SHA-1">7d64aa87029f07c99c7f96819fb10cdb67dea886</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/otplib@11.0.1</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://yeojz.github.io/otplib</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/yeojz/otplib/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git+https://github.com/yeojz/otplib.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/thirty-two@1.0.2">
            <name>thirty-two</name>
            <version>1.0.2</version>
            <description>
                <![CDATA[Implementation RFC 3548 Base32 encoding/decoding for node.]]>
            </description>
            <hashes>
                <hash alg="SHA-1">4ca2fffc02a51290d2744b9e3f557693ca6b627a</hash>
            </hashes>
            <purl>pkg:npm/thirty-two@1.0.2</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/chrisumbel/thirty-two#readme</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/chrisumbel/thirty-two/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git://github.com/chrisumbel/thirty-two.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/pdfkit@0.11.0">
            <name>pdfkit</name>
            <version>0.11.0</version>
            <description>
                <![CDATA[A PDF generation library for Node.js]]>
            </description>
            <hashes>
                <hash alg="SHA-1">9cdb2fc42bd2913587fe3ddf48cc5bbb3c36f7de</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/pdfkit@0.11.0</purl>
            <externalReferences>
                <reference type="website">
                    <url>http://pdfkit.org/</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/foliojs/pdfkit/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git+https://github.com/foliojs/pdfkit.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/crypto-js@3.3.0">
            <name>crypto-js</name>
            <version>3.3.0</version>
            <description>
                <![CDATA[JavaScript library of crypto standards.]]>
            </description>
            <hashes>
                <hash alg="SHA-1">846dd1cce2f68aacfa156c8578f926a609b7976b</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/crypto-js@3.3.0</purl>
            <externalReferences>
                <reference type="website">
                    <url>http://github.com/brix/crypto-js</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/brix/crypto-js/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git+ssh://git@github.com/brix/crypto-js.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/fontkit@1.8.1">
            <name>fontkit</name>
            <version>1.8.1</version>
            <description>
                <![CDATA[An advanced font engine for Node and the browser]]>
            </description>
            <hashes>
                <hash alg="SHA-1">ae77485376f1096b45548bf6ced9a07af62a7846</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/fontkit@1.8.1</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/foliojs/fontkit#readme</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/foliojs/fontkit/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git://github.com/foliojs/fontkit.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/babel-runtime@6.26.0">
            <name>babel-runtime</name>
            <version>6.26.0</version>
            <description>
                <![CDATA[babel selfContained runtime]]>
            </description>
            <hashes>
                <hash alg="SHA-1">965c7058668e82b55d7bfe04ff2337bc8b5647fe</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/babel-runtime@6.26.0</purl>
            <externalReferences>
                <reference type="vcs">
                    <url>https://github.com/babel/babel/tree/master/packages/babel-runtime</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/core-js@2.6.11">
            <name>core-js</name>
            <version>2.6.11</version>
            <description>
                <![CDATA[Standard library]]>
            </description>
            <hashes>
                <hash alg="SHA-1">38831469f9922bded8ee21c9dc46985e0399308c</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/core-js@2.6.11</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/zloirock/core-js#readme</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/zloirock/core-js/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git+https://github.com/zloirock/core-js.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/regenerator-runtime@0.11.1">
            <name>regenerator-runtime</name>
            <version>0.11.1</version>
            <description>
                <![CDATA[Runtime for Regenerator-compiled generator and async functions.]]>
            </description>
            <hashes>
                <hash alg="SHA-1">be05ad7f9bf7d22e056f9726cee5017fbf19e2e9</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/regenerator-runtime@0.11.1</purl>
            <externalReferences>
                <reference type="vcs">
                    <url>https://github.com/facebook/regenerator/tree/master/packages/regenerator-runtime</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/brfs@2.0.2">
            <name>brfs</name>
            <version>2.0.2</version>
            <description>
                <![CDATA[browserify fs.readFileSync() static asset inliner]]>
            </description>
            <hashes>
                <hash alg="SHA-1">44237878fa82aa479ce4f5fe2c1796ec69f07845</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/brfs@2.0.2</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/substack/brfs</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/substack/brfs/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git://github.com/substack/brfs.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/quote-stream@1.0.2">
            <name>quote-stream</name>
            <version>1.0.2</version>
            <description>
                <![CDATA[transform a stream into a quoted string]]>
            </description>
            <hashes>
                <hash alg="SHA-1">84963f8c9c26b942e153feeb53aae74652b7e0b2</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/quote-stream@1.0.2</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/substack/quote-stream</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/substack/quote-stream/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git://github.com/substack/quote-stream.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/buffer-equal@0.0.1">
            <name>buffer-equal</name>
            <version>0.0.1</version>
            <description>
                <![CDATA[return whether two buffers are equal]]>
            </description>
            <hashes>
                <hash alg="SHA-1">91bc74b11ea405bc916bc6aa908faafa5b4aac4b</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/buffer-equal@0.0.1</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/substack/node-buffer-equal#readme</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/substack/node-buffer-equal/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git://github.com/substack/node-buffer-equal.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/through2@2.0.5">
            <name>through2</name>
            <version>2.0.5</version>
            <description>
                <![CDATA[A tiny wrapper around Node streams2 Transform to avoid explicit subclassing noise]]>
            </description>
            <hashes>
                <hash alg="SHA-1">01c1e39eb31d07cb7d03a96a70823260b23132cd</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/through2@2.0.5</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/rvagg/through2#readme</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/rvagg/through2/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git+https://github.com/rvagg/through2.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/static-module@3.0.4">
            <name>static-module</name>
            <version>3.0.4</version>
            <description>
                <![CDATA[convert module usage to inline expressions]]>
            </description>
            <hashes>
                <hash alg="SHA-1">bfbd1d1c38dd1fbbf0bb4af0c1b3ae18a93a2b68</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/static-module@3.0.4</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/substack/static-module</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/substack/static-module/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git://github.com/substack/static-module.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/acorn-node@1.8.2">
            <name>acorn-node</name>
            <version>1.8.2</version>
            <description>
                <![CDATA[the acorn javascript parser, preloaded with plugins for syntax parity with recent node versions]]>
            </description>
            <hashes>
                <hash alg="SHA-1">114c95d64539e53dede23de8b9d96df7c7ae2af8</hash>
            </hashes>
            <licenses>
                <license>
                    <id>Apache-2.0</id>
                </license>
            </licenses>
            <purl>pkg:npm/acorn-node@1.8.2</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/browserify/acorn-node</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/browserify/acorn-node/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git+https://github.com/browserify/acorn-node.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/acorn@7.3.1">
            <name>acorn</name>
            <version>7.3.1</version>
            <description>
                <![CDATA[ECMAScript parser]]>
            </description>
            <hashes>
                <hash alg="SHA-1">85010754db53c3fbaf3b9ea3e083aa5c5d147ffd</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/acorn@7.3.1</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/acornjs/acorn</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/acornjs/acorn/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git+https://github.com/acornjs/acorn.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/acorn-walk@7.2.0">
            <name>acorn-walk</name>
            <version>7.2.0</version>
            <description>
                <![CDATA[ECMAScript (ESTree) AST walker]]>
            </description>
            <hashes>
                <hash alg="SHA-1">0de889a601203909b0fbe07b8938dc21d2e967bc</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/acorn-walk@7.2.0</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/acornjs/acorn</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/acornjs/acorn/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git+https://github.com/acornjs/acorn.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/convert-source-map@1.7.0">
            <name>convert-source-map</name>
            <version>1.7.0</version>
            <description>
                <![CDATA[Converts a source-map from/to  different formats and allows adding/changing properties.]]>
            </description>
            <hashes>
                <hash alg="SHA-1">17a2cb882d7f77d3490585e2ce6c524424a3a442</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/convert-source-map@1.7.0</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/thlorenz/convert-source-map</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/thlorenz/convert-source-map/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git://github.com/thlorenz/convert-source-map.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/duplexer2@0.1.4">
            <name>duplexer2</name>
            <version>0.1.4</version>
            <description>
                <![CDATA[Like duplexer but using streams3]]>
            </description>
            <hashes>
                <hash alg="SHA-1">8b12dab878c0d69e3e7891051662a32fc6bddcc1</hash>
            </hashes>
            <licenses>
                <license>
                    <id>BSD-3-Clause</id>
                </license>
            </licenses>
            <purl>pkg:npm/duplexer2@0.1.4</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/deoxxa/duplexer2#readme</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/deoxxa/duplexer2/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git+https://github.com/deoxxa/duplexer2.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/escodegen@1.14.3">
            <name>escodegen</name>
            <version>1.14.3</version>
            <description>
                <![CDATA[ECMAScript code generator]]>
            </description>
            <hashes>
                <hash alg="SHA-1">4e7b81fba61581dc97582ed78cab7f0e8d63f503</hash>
            </hashes>
            <licenses>
                <license>
                    <id>BSD-2-Clause</id>
                </license>
            </licenses>
            <purl>pkg:npm/escodegen@1.14.3</purl>
            <externalReferences>
                <reference type="website">
                    <url>http://github.com/estools/escodegen</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/estools/escodegen/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git+ssh://git@github.com/estools/escodegen.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/estraverse@4.3.0">
            <name>estraverse</name>
            <version>4.3.0</version>
            <description>
                <![CDATA[ECMAScript JS AST traversal functions]]>
            </description>
            <hashes>
                <hash alg="SHA-1">398ad3f3c5a24948be7725e83d11a7de28cdbd1d</hash>
            </hashes>
            <licenses>
                <license>
                    <id>BSD-2-Clause</id>
                </license>
            </licenses>
            <purl>pkg:npm/estraverse@4.3.0</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/estools/estraverse</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/estools/estraverse/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git+ssh://git@github.com/estools/estraverse.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/esutils@2.0.3">
            <name>esutils</name>
            <version>2.0.3</version>
            <description>
                <![CDATA[utility box for ECMAScript language tools]]>
            </description>
            <hashes>
                <hash alg="SHA-1">74d2eb4de0b8da1293711910d50775b9b710ef64</hash>
            </hashes>
            <licenses>
                <license>
                    <id>BSD-2-Clause</id>
                </license>
            </licenses>
            <purl>pkg:npm/esutils@2.0.3</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/estools/esutils</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/estools/esutils/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git+ssh://git@github.com/estools/esutils.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/optionator@0.8.3">
            <name>optionator</name>
            <version>0.8.3</version>
            <description>
                <![CDATA[option parsing and help generation]]>
            </description>
            <hashes>
                <hash alg="SHA-1">84fa1d036fe9d3c7e21d99884b601167ec8fb495</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/optionator@0.8.3</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/gkz/optionator</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/gkz/optionator/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git://github.com/gkz/optionator.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/deep-is@0.1.3">
            <name>deep-is</name>
            <version>0.1.3</version>
            <description>
                <![CDATA[node's assert.deepEqual algorithm except for NaN being equal to NaN]]>
            </description>
            <hashes>
                <hash alg="SHA-1">b369d6fb5dbc13eecf524f91b070feedc357cf34</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/deep-is@0.1.3</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/thlorenz/deep-is#readme</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/thlorenz/deep-is/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git+ssh://git@github.com/thlorenz/deep-is.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/fast-levenshtein@2.0.6">
            <name>fast-levenshtein</name>
            <version>2.0.6</version>
            <description>
                <![CDATA[Efficient implementation of Levenshtein algorithm  with locale-specific collator support.]]>
            </description>
            <hashes>
                <hash alg="SHA-1">3d8a5c66883a16a30ca8643e851f19baa7797917</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/fast-levenshtein@2.0.6</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/hiddentao/fast-levenshtein#readme</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/hiddentao/fast-levenshtein/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git+https://github.com/hiddentao/fast-levenshtein.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/levn@0.3.0">
            <name>levn</name>
            <version>0.3.0</version>
            <description>
                <![CDATA[Light ECMAScript (JavaScript) Value Notation - human written, concise, typed, flexible]]>
            </description>
            <hashes>
                <hash alg="SHA-1">3b09924edf9f083c0490fdd4c0bc4421e04764ee</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/levn@0.3.0</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/gkz/levn</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/gkz/levn/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git://github.com/gkz/levn.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/prelude-ls@1.1.2">
            <name>prelude-ls</name>
            <version>1.1.2</version>
            <description>
                <![CDATA[prelude.ls is a functionally oriented utility library. It is powerful and flexible. Almost all of its functions are curried. It is written in, and is the recommended base library for, LiveScript.]]>
            </description>
            <hashes>
                <hash alg="SHA-1">21932a549f5e52ffd9a827f570e04be62a97da54</hash>
            </hashes>
            <purl>pkg:npm/prelude-ls@1.1.2</purl>
            <externalReferences>
                <reference type="website">
                    <url>http://preludels.com</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/gkz/prelude-ls/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git://github.com/gkz/prelude-ls.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/type-check@0.3.2">
            <name>type-check</name>
            <version>0.3.2</version>
            <description>
                <![CDATA[type-check allows you to check the types of JavaScript values at runtime with a Haskell like type syntax.]]>
            </description>
            <hashes>
                <hash alg="SHA-1">5884cab512cf1d355e3fb784f30804b2b520db72</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/type-check@0.3.2</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/gkz/type-check</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/gkz/type-check/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git://github.com/gkz/type-check.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/word-wrap@1.2.3">
            <name>word-wrap</name>
            <version>1.2.3</version>
            <description>
                <![CDATA[Wrap words to a specified length.]]>
            </description>
            <hashes>
                <hash alg="SHA-1">610636f6b1f703891bd34771ccb17fb93b47079c</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/word-wrap@1.2.3</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/jonschlinkert/word-wrap</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/jonschlinkert/word-wrap/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git+https://github.com/jonschlinkert/word-wrap.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/source-map@0.6.1">
            <name>source-map</name>
            <version>0.6.1</version>
            <description>
                <![CDATA[Generates and consumes source maps]]>
            </description>
            <hashes>
                <hash alg="SHA-1">74722af32e9614e9c287a8d0bbde48b5e2f1a263</hash>
            </hashes>
            <licenses>
                <license>
                    <id>BSD-3-Clause</id>
                </license>
            </licenses>
            <purl>pkg:npm/source-map@0.6.1</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/mozilla/source-map</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/mozilla/source-map/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git+ssh://git@github.com/mozilla/source-map.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/has@1.0.3">
            <name>has</name>
            <version>1.0.3</version>
            <description>
                <![CDATA[Object.prototype.hasOwnProperty.call shortcut]]>
            </description>
            <hashes>
                <hash alg="SHA-1">722d7cbfc1f6aa8241f16dd814e011e1f41e8796</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/has@1.0.3</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/tarruda/has</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/tarruda/has/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git://github.com/tarruda/has.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/function-bind@1.1.1">
            <name>function-bind</name>
            <version>1.1.1</version>
            <description>
                <![CDATA[Implementation of Function.prototype.bind]]>
            </description>
            <hashes>
                <hash alg="SHA-1">a56899d3ea3c9bab874bb9773b7c5ede92f4895d</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/function-bind@1.1.1</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/Raynos/function-bind</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/Raynos/function-bind/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git://github.com/Raynos/function-bind.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/magic-string@0.25.1">
            <name>magic-string</name>
            <version>0.25.1</version>
            <description>
                <![CDATA[Modify strings, generate sourcemaps]]>
            </description>
            <hashes>
                <hash alg="SHA-1">b1c248b399cd7485da0fe7385c2fc7011843266e</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/magic-string@0.25.1</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/rich-harris/magic-string#readme</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/rich-harris/magic-string/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git+https://github.com/rich-harris/magic-string.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/sourcemap-codec@1.4.8">
            <name>sourcemap-codec</name>
            <version>1.4.8</version>
            <description>
                <![CDATA[Encode/decode sourcemap mappings]]>
            </description>
            <hashes>
                <hash alg="SHA-1">ea804bd94857402e6992d05a38ef1ae35a9ab4c4</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/sourcemap-codec@1.4.8</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/Rich-Harris/sourcemap-codec</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/Rich-Harris/sourcemap-codec/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git+https://github.com/Rich-Harris/sourcemap-codec.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/merge-source-map@1.0.4">
            <name>merge-source-map</name>
            <version>1.0.4</version>
            <description>
                <![CDATA[Merge old source map and new source map in multi-transform flow]]>
            </description>
            <hashes>
                <hash alg="SHA-1">a5de46538dae84d4114cc5ea02b4772a6346701f</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/merge-source-map@1.0.4</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/keik/merge-source-map#readme</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/keik/merge-source-map/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git+https://github.com/keik/merge-source-map.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/object-inspect@1.8.0">
            <name>object-inspect</name>
            <version>1.8.0</version>
            <description>
                <![CDATA[string representations of objects in node and the browser]]>
            </description>
            <hashes>
                <hash alg="SHA-1">df807e5ecf53a609cc6bfe93eac3cc7be5b3a9d0</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/object-inspect@1.8.0</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/inspect-js/object-inspect</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/inspect-js/object-inspect/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git://github.com/inspect-js/object-inspect.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/scope-analyzer@2.1.1">
            <name>scope-analyzer</name>
            <version>2.1.1</version>
            <description>
                <![CDATA[simple scope analysis for javascript ASTs]]>
            </description>
            <hashes>
                <hash alg="SHA-1">5156c27de084d74bf75af9e9506aaf95c6e73dd6</hash>
            </hashes>
            <licenses>
                <license>
                    <id>Apache-2.0</id>
                </license>
            </licenses>
            <purl>pkg:npm/scope-analyzer@2.1.1</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/goto-bus-stop/scope-analyzer</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/goto-bus-stop/scope-analyzer/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git+https://github.com/goto-bus-stop/scope-analyzer.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/array-from@2.1.1">
            <name>array-from</name>
            <version>2.1.1</version>
            <description>
                <![CDATA[A ponyfill for the ES 2015 (ES6) `Array.from()`.]]>
            </description>
            <hashes>
                <hash alg="SHA-1">cfe9d8c26628b9dc5aecc62a9f5d8f1f352c1195</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/array-from@2.1.1</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/studio-b12/array-from#readme</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/studio-b12/array-from/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git+ssh://git@github.com/studio-b12/array-from.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/dash-ast@1.0.0">
            <name>dash-ast</name>
            <version>1.0.0</version>
            <description>
                <![CDATA[walk an AST, quickly]]>
            </description>
            <hashes>
                <hash alg="SHA-1">12029ba5fb2f8aa6f0a861795b23c1b4b6c27d37</hash>
            </hashes>
            <licenses>
                <license>
                    <id>Apache-2.0</id>
                </license>
            </licenses>
            <purl>pkg:npm/dash-ast@1.0.0</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/goto-bus-stop/dash-ast</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/goto-bus-stop/dash-ast/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git+https://github.com/goto-bus-stop/dash-ast.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/es6-map@0.1.5">
            <name>es6-map</name>
            <version>0.1.5</version>
            <description>
                <![CDATA[ECMAScript6 Map polyfill]]>
            </description>
            <hashes>
                <hash alg="SHA-1">9136e0503dcc06a301690f0bb14ff4e364e949f0</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/es6-map@0.1.5</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/medikoo/es6-map#readme</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/medikoo/es6-map/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git://github.com/medikoo/es6-map.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/d@1.0.1">
            <name>d</name>
            <version>1.0.1</version>
            <description>
                <![CDATA[Property descriptor factory]]>
            </description>
            <hashes>
                <hash alg="SHA-1">8698095372d58dbee346ffd0c7093f99f8f9eb5a</hash>
            </hashes>
            <licenses>
                <license>
                    <id>ISC</id>
                </license>
            </licenses>
            <purl>pkg:npm/d@1.0.1</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/medikoo/d#readme</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/medikoo/d/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git://github.com/medikoo/d.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/es5-ext@0.10.53">
            <name>es5-ext</name>
            <version>0.10.53</version>
            <description>
                <![CDATA[ECMAScript extensions and shims]]>
            </description>
            <hashes>
                <hash alg="SHA-1">93c5a3acfdbef275220ad72644ad02ee18368de1</hash>
            </hashes>
            <licenses>
                <license>
                    <id>ISC</id>
                </license>
            </licenses>
            <purl>pkg:npm/es5-ext@0.10.53</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/medikoo/es5-ext#readme</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/medikoo/es5-ext/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git+https://github.com/medikoo/es5-ext.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/es6-iterator@2.0.3">
            <name>es6-iterator</name>
            <version>2.0.3</version>
            <description>
                <![CDATA[Iterator abstraction based on ES6 specification]]>
            </description>
            <hashes>
                <hash alg="SHA-1">a7de889141a05a94b0854403b2d0a0fbfa98f3b7</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/es6-iterator@2.0.3</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/medikoo/es6-iterator#readme</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/medikoo/es6-iterator/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git://github.com/medikoo/es6-iterator.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/es6-symbol@3.1.3">
            <name>es6-symbol</name>
            <version>3.1.3</version>
            <description>
                <![CDATA[ECMAScript 6 Symbol polyfill]]>
            </description>
            <hashes>
                <hash alg="SHA-1">bad5d3c1bcdac28269f4cb331e431c78ac705d18</hash>
            </hashes>
            <licenses>
                <license>
                    <id>ISC</id>
                </license>
            </licenses>
            <purl>pkg:npm/es6-symbol@3.1.3</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/medikoo/es6-symbol#readme</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/medikoo/es6-symbol/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git://github.com/medikoo/es6-symbol.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/ext@1.4.0">
            <name>ext</name>
            <version>1.4.0</version>
            <description>
                <![CDATA[JavaScript utilities with respect to emerging standard]]>
            </description>
            <hashes>
                <hash alg="SHA-1">89ae7a07158f79d35517882904324077e4379244</hash>
            </hashes>
            <licenses>
                <license>
                    <id>ISC</id>
                </license>
            </licenses>
            <purl>pkg:npm/ext@1.4.0</purl>
            <externalReferences>
                <reference type="vcs">
                    <url>https://github.com/medikoo/es5-ext/tree/ext</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/type@2.0.0">
            <name>type</name>
            <version>2.0.0</version>
            <description>
                <![CDATA[Runtime validation and processing of JavaScript types]]>
            </description>
            <hashes>
                <hash alg="SHA-1">5f16ff6ef2eb44f260494dae271033b29c09a9c3</hash>
            </hashes>
            <licenses>
                <license>
                    <id>ISC</id>
                </license>
            </licenses>
            <purl>pkg:npm/type@2.0.0</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/medikoo/type#readme</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/medikoo/type/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git+https://github.com/medikoo/type.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/next-tick@1.0.0">
            <name>next-tick</name>
            <version>1.0.0</version>
            <description>
                <![CDATA[Environment agnostic nextTick polyfill]]>
            </description>
            <hashes>
                <hash alg="SHA-1">ca86d1fe8828169b0120208e3dc8424b9db8342c</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/next-tick@1.0.0</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/medikoo/next-tick#readme</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/medikoo/next-tick/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git://github.com/medikoo/next-tick.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/type@1.2.0">
            <name>type</name>
            <version>1.2.0</version>
            <description>
                <![CDATA[Runtime validation and processing of JavaScript types]]>
            </description>
            <hashes>
                <hash alg="SHA-1">848dd7698dafa3e54a6c479e759c4bc3f18847a0</hash>
            </hashes>
            <licenses>
                <license>
                    <id>ISC</id>
                </license>
            </licenses>
            <purl>pkg:npm/type@1.2.0</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/medikoo/type#readme</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/medikoo/type/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git+https://github.com/medikoo/type.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/es6-set@0.1.5">
            <name>es6-set</name>
            <version>0.1.5</version>
            <description>
                <![CDATA[ECMAScript6 Set polyfill]]>
            </description>
            <hashes>
                <hash alg="SHA-1">d2b3ec5d4d800ced818db538d28974db0a73ccb1</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/es6-set@0.1.5</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/medikoo/es6-set#readme</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/medikoo/es6-set/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git://github.com/medikoo/es6-set.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/es6-symbol@3.1.1">
            <name>es6-symbol</name>
            <version>3.1.1</version>
            <description>
                <![CDATA[ECMAScript 6 Symbol polyfill]]>
            </description>
            <hashes>
                <hash alg="SHA-1">bf00ef4fdab6ba1b46ecb7b629b4c7ed5715cc77</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/es6-symbol@3.1.1</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/medikoo/es6-symbol#readme</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/medikoo/es6-symbol/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git://github.com/medikoo/es6-symbol.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/event-emitter@0.3.5">
            <name>event-emitter</name>
            <version>0.3.5</version>
            <description>
                <![CDATA[Environment agnostic event emitter]]>
            </description>
            <hashes>
                <hash alg="SHA-1">df8c69eef1647923c7157b9ce83840610b02cc39</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/event-emitter@0.3.5</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/medikoo/event-emitter#readme</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/medikoo/event-emitter/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git://github.com/medikoo/event-emitter.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/estree-is-function@1.0.0">
            <name>estree-is-function</name>
            <version>1.0.0</version>
            <description>
                <![CDATA[check if an AST node is a function of some sort]]>
            </description>
            <hashes>
                <hash alg="SHA-1">c0adc29806d7f18a74db7df0f3b2666702e37ad2</hash>
            </hashes>
            <licenses>
                <license>
                    <id>Apache-2.0</id>
                </license>
            </licenses>
            <purl>pkg:npm/estree-is-function@1.0.0</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/goto-bus-stop/estree-is-function</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/goto-bus-stop/estree-is-function/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git+https://github.com/goto-bus-stop/estree-is-function.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/get-assigned-identifiers@1.2.0">
            <name>get-assigned-identifiers</name>
            <version>1.2.0</version>
            <description>
                <![CDATA[get a list of identifiers that are initialised by a JavaScript AST node.]]>
            </description>
            <hashes>
                <hash alg="SHA-1">6dbf411de648cbaf8d9169ebb0d2d576191e2ff1</hash>
            </hashes>
            <licenses>
                <license>
                    <id>Apache-2.0</id>
                </license>
            </licenses>
            <purl>pkg:npm/get-assigned-identifiers@1.2.0</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/goto-bus-stop/get-assigned-identifiers</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/goto-bus-stop/get-assigned-identifiers/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git+https://github.com/goto-bus-stop/get-assigned-identifiers.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/shallow-copy@0.0.1">
            <name>shallow-copy</name>
            <version>0.0.1</version>
            <description>
                <![CDATA[make a shallow copy of an object or array]]>
            </description>
            <hashes>
                <hash alg="SHA-1">415f42702d73d810330292cc5ee86eae1a11a170</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/shallow-copy@0.0.1</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/substack/shallow-copy</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/substack/shallow-copy/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git://github.com/substack/shallow-copy.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/static-eval@2.1.0">
            <name>static-eval</name>
            <version>2.1.0</version>
            <description>
                <![CDATA[evaluate statically-analyzable expressions]]>
            </description>
            <hashes>
                <hash alg="SHA-1">a16dbe54522d7fa5ef1389129d813fd47b148014</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/static-eval@2.1.0</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/browserify/static-eval</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/browserify/static-eval/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git://github.com/browserify/static-eval.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/brotli@1.3.2">
            <name>brotli</name>
            <version>1.3.2</version>
            <description>
                <![CDATA[A port of the Brotli compression algorithm as used in WOFF2]]>
            </description>
            <hashes>
                <hash alg="SHA-1">525a9cad4fcba96475d7d388f6aecb13eed52f46</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/brotli@1.3.2</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/devongovett/brotli.js</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/devongovett/brotli.js/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git+https://github.com/devongovett/brotli.js.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/browserify-optional@1.0.1">
            <name>browserify-optional</name>
            <version>1.0.1</version>
            <description>
                <![CDATA[A browserify transform that allows optional dependencies in try..catch blocks]]>
            </description>
            <hashes>
                <hash alg="SHA-1">1e13722cfde0d85f121676c2a72ced533a018869</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/browserify-optional@1.0.1</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/devongovett/browserify-optional</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/devongovett/browserify-optional/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git://github.com/devongovett/browserify-optional.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/ast-transform@0.0.0">
            <name>ast-transform</name>
            <version>0.0.0</version>
            <description>
                <![CDATA[Convenience wrapper for performing AST transformations with browserify transform streams]]>
            </description>
            <hashes>
                <hash alg="SHA-1">74944058887d8283e189d954600947bc98fe0062</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/ast-transform@0.0.0</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/hughsk/ast-transform</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/hughsk/ast-transform/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git://github.com/hughsk/ast-transform.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/escodegen@1.2.0">
            <name>escodegen</name>
            <version>1.2.0</version>
            <description>
                <![CDATA[ECMAScript code generator]]>
            </description>
            <hashes>
                <hash alg="SHA-1">09de7967791cc958b7f89a2ddb6d23451af327e1</hash>
            </hashes>
            <purl>pkg:npm/escodegen@1.2.0</purl>
            <externalReferences>
                <reference type="website">
                    <url>http://github.com/Constellation/escodegen</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/Constellation/escodegen/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git+ssh://git@github.com/Constellation/escodegen.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/estraverse@1.5.1">
            <name>estraverse</name>
            <version>1.5.1</version>
            <description>
                <![CDATA[ECMAScript JS AST traversal functions]]>
            </description>
            <hashes>
                <hash alg="SHA-1">867a3e8e58a9f84618afb6c2ddbcd916b7cbaf71</hash>
            </hashes>
            <purl>pkg:npm/estraverse@1.5.1</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/Constellation/estraverse</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/Constellation/estraverse/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git+ssh://git@github.com/Constellation/estraverse.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/esutils@1.0.0">
            <name>esutils</name>
            <version>1.0.0</version>
            <description>
                <![CDATA[utility box for ECMAScript language tools]]>
            </description>
            <hashes>
                <hash alg="SHA-1">8151d358e20c8acc7fb745e7472c0025fe496570</hash>
            </hashes>
            <purl>pkg:npm/esutils@1.0.0</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/Constellation/esutils</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/Constellation/esutils/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git+ssh://git@github.com/Constellation/esutils.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/source-map@0.1.43">
            <name>source-map</name>
            <version>0.1.43</version>
            <description>
                <![CDATA[Generates and consumes source maps]]>
            </description>
            <hashes>
                <hash alg="SHA-1">c24bc146ca517c1471f5dacbe2571b2b7f9e3346</hash>
            </hashes>
            <purl>pkg:npm/source-map@0.1.43</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/mozilla/source-map</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/mozilla/source-map/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git+ssh://git@github.com/mozilla/source-map.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/amdefine@1.0.1">
            <name>amdefine</name>
            <version>1.0.1</version>
            <description>
                <![CDATA[Provide AMD's define() API for declaring modules in the AMD format]]>
            </description>
            <hashes>
                <hash alg="SHA-1">4a5282ac164729e93619bcfd3ad151f817ce91f5</hash>
            </hashes>
            <licenses>
                <license>
                    <name>BSD-3-Clause OR MIT</name>
                </license>
            </licenses>
            <purl>pkg:npm/amdefine@1.0.1</purl>
            <externalReferences>
                <reference type="website">
                    <url>http://github.com/jrburke/amdefine</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/jrburke/amdefine/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git+https://github.com/jrburke/amdefine.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/ast-types@0.7.8">
            <name>ast-types</name>
            <version>0.7.8</version>
            <description>
                <![CDATA[Esprima-compatible implementation of the Mozilla JS Parser API]]>
            </description>
            <hashes>
                <hash alg="SHA-1">902d2e0d60d071bdcd46dc115e1809ed11c138a9</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/ast-types@0.7.8</purl>
            <externalReferences>
                <reference type="website">
                    <url>http://github.com/benjamn/ast-types</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/benjamn/ast-types/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git://github.com/benjamn/ast-types.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/browser-resolve@1.11.3">
            <name>browser-resolve</name>
            <version>1.11.3</version>
            <description>
                <![CDATA[resolve which handles browser field support in package.json]]>
            </description>
            <hashes>
                <hash alg="SHA-1">9b7cbb3d0f510e4cb86bdbd796124d28b5890af6</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/browser-resolve@1.11.3</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/shtylman/node-browser-resolve#readme</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/shtylman/node-browser-resolve/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git://github.com/shtylman/node-browser-resolve.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/resolve@1.1.7">
            <name>resolve</name>
            <version>1.1.7</version>
            <description>
                <![CDATA[resolve like require.resolve() on behalf of files asynchronously and synchronously]]>
            </description>
            <hashes>
                <hash alg="SHA-1">203114d82ad2c5ed9e8e0411b3932875e889e97b</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/resolve@1.1.7</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/substack/node-resolve#readme</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/substack/node-resolve/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git://github.com/substack/node-resolve.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/clone@1.0.4">
            <name>clone</name>
            <version>1.0.4</version>
            <description>
                <![CDATA[deep cloning of objects and arrays]]>
            </description>
            <hashes>
                <hash alg="SHA-1">da309cc263df15994c688ca902179ca3c7cd7c7e</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/clone@1.0.4</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/pvorb/node-clone#readme</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/pvorb/node-clone/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git://github.com/pvorb/node-clone.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/deep-equal@1.1.1">
            <name>deep-equal</name>
            <version>1.1.1</version>
            <description>
                <![CDATA[node's assert.deepEqual algorithm]]>
            </description>
            <hashes>
                <hash alg="SHA-1">b5c98c942ceffaf7cb051e24e1434a25a2e6076a</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/deep-equal@1.1.1</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/substack/node-deep-equal#readme</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/substack/node-deep-equal/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git+ssh://git@github.com/substack/node-deep-equal.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/is-arguments@1.0.4">
            <name>is-arguments</name>
            <version>1.0.4</version>
            <description>
                <![CDATA[Is this an arguments object? It's a harder question than you think.]]>
            </description>
            <hashes>
                <hash alg="SHA-1">3faf966c7cba0ff437fb31f6250082fcf0448cf3</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/is-arguments@1.0.4</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/ljharb/is-arguments</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/ljharb/is-arguments/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git://github.com/ljharb/is-arguments.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/is-date-object@1.0.2">
            <name>is-date-object</name>
            <version>1.0.2</version>
            <description>
                <![CDATA[Is this value a JS Date object? This module works cross-realm/iframe, and despite ES6 @@toStringTag.]]>
            </description>
            <hashes>
                <hash alg="SHA-1">bda736f2cd8fd06d32844e7743bfa7494c3bfd7e</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/is-date-object@1.0.2</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/ljharb/is-date-object#readme</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/ljharb/is-date-object/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git://github.com/ljharb/is-date-object.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/is-regex@1.1.0">
            <name>is-regex</name>
            <version>1.1.0</version>
            <description>
                <![CDATA[Is this value a JS regex? Works cross-realm/iframe, and despite ES6 @@toStringTag]]>
            </description>
            <hashes>
                <hash alg="SHA-1">ece38e389e490df0dc21caea2bd596f987f767ff</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/is-regex@1.1.0</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/ljharb/is-regex</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/ljharb/is-regex/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git://github.com/ljharb/is-regex.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/has-symbols@1.0.1">
            <name>has-symbols</name>
            <version>1.0.1</version>
            <description>
                <![CDATA[Determine if the JS environment has Symbol support. Supports spec, or shams.]]>
            </description>
            <hashes>
                <hash alg="SHA-1">9f5214758a44196c406d9bd76cebf81ec2dd31e8</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/has-symbols@1.0.1</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/ljharb/has-symbols#readme</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/ljharb/has-symbols/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git://github.com/ljharb/has-symbols.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/object-is@1.1.2">
            <name>object-is</name>
            <version>1.1.2</version>
            <description>
                <![CDATA[ES2015-compliant shim for Object.is - differentiates between -0 and +0]]>
            </description>
            <hashes>
                <hash alg="SHA-1">c5d2e87ff9e119f78b7a088441519e2eec1573b6</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/object-is@1.1.2</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/es-shims/object-is</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/es-shims/object-is/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git://github.com/es-shims/object-is.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/define-properties@1.1.3">
            <name>define-properties</name>
            <version>1.1.3</version>
            <description>
                <![CDATA[Define multiple non-enumerable properties at once. Uses `Object.defineProperty` when available; falls back to standard assignment in older engines.]]>
            </description>
            <hashes>
                <hash alg="SHA-1">cf88da6cbee26fe6db7094f61d870cbd84cee9f1</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/define-properties@1.1.3</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/ljharb/define-properties#readme</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/ljharb/define-properties/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git://github.com/ljharb/define-properties.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/object-keys@1.1.1">
            <name>object-keys</name>
            <version>1.1.1</version>
            <description>
                <![CDATA[An Object.keys replacement, in case Object.keys is not available. From https://github.com/es-shims/es5-shim]]>
            </description>
            <hashes>
                <hash alg="SHA-1">1c47f272df277f3b1daf061677d9c82e2322c60e</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/object-keys@1.1.1</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/ljharb/object-keys#readme</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/ljharb/object-keys/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git://github.com/ljharb/object-keys.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/es-abstract@1.17.6">
            <name>es-abstract</name>
            <version>1.17.6</version>
            <description>
                <![CDATA[ECMAScript spec abstract operations.]]>
            </description>
            <hashes>
                <hash alg="SHA-1">9142071707857b2cacc7b89ecb670316c3e2d52a</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/es-abstract@1.17.6</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/ljharb/es-abstract#readme</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/ljharb/es-abstract/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git://github.com/ljharb/es-abstract.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/es-to-primitive@1.2.1">
            <name>es-to-primitive</name>
            <version>1.2.1</version>
            <description>
                <![CDATA[ECMAScript “ToPrimitive” algorithm. Provides ES5 and ES2015 versions.]]>
            </description>
            <hashes>
                <hash alg="SHA-1">e55cd4c9cdc188bcefb03b366c736323fc5c898a</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/es-to-primitive@1.2.1</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/ljharb/es-to-primitive#readme</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/ljharb/es-to-primitive/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git://github.com/ljharb/es-to-primitive.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/is-callable@1.2.0">
            <name>is-callable</name>
            <version>1.2.0</version>
            <description>
                <![CDATA[Is this JS value callable? Works with Functions and GeneratorFunctions, despite ES6 @@toStringTag.]]>
            </description>
            <hashes>
                <hash alg="SHA-1">83336560b54a38e35e3a2df7afd0454d691468bb</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/is-callable@1.2.0</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/ljharb/is-callable#readme</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/ljharb/is-callable/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git://github.com/ljharb/is-callable.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/is-symbol@1.0.3">
            <name>is-symbol</name>
            <version>1.0.3</version>
            <description>
                <![CDATA[Determine if a value is an ES6 Symbol or not.]]>
            </description>
            <hashes>
                <hash alg="SHA-1">38e1014b9e6329be0de9d24a414fd7441ec61937</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/is-symbol@1.0.3</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/inspect-js/is-symbol#readme</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/inspect-js/is-symbol/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git://github.com/inspect-js/is-symbol.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/object.assign@4.1.0">
            <name>object.assign</name>
            <version>4.1.0</version>
            <description>
                <![CDATA[ES6 spec-compliant Object.assign shim. From https://github.com/es-shims/es6-shim]]>
            </description>
            <hashes>
                <hash alg="SHA-1">968bf1100d7956bb3ca086f006f846b3bc4008da</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/object.assign@4.1.0</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/ljharb/object.assign#readme</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/ljharb/object.assign/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git://github.com/ljharb/object.assign.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/string.prototype.trimend@1.0.1">
            <name>string.prototype.trimend</name>
            <version>1.0.1</version>
            <description>
                <![CDATA[ES2019 spec-compliant String.prototype.trimEnd shim.]]>
            </description>
            <hashes>
                <hash alg="SHA-1">85812a6b847ac002270f5808146064c995fb6913</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/string.prototype.trimend@1.0.1</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/es-shims/String.prototype.trimEnd#readme</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/es-shims/String.prototype.trimEnd/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git://github.com/es-shims/String.prototype.trimEnd.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/string.prototype.trimstart@1.0.1">
            <name>string.prototype.trimstart</name>
            <version>1.0.1</version>
            <description>
                <![CDATA[ES2019 spec-compliant String.prototype.trimStart shim.]]>
            </description>
            <hashes>
                <hash alg="SHA-1">14af6d9f34b053f7cfc89b72f8f2ee14b9039a54</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/string.prototype.trimstart@1.0.1</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/es-shims/String.prototype.trimStart#readme</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/es-shims/String.prototype.trimStart/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git://github.com/es-shims/String.prototype.trimStart.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/regexp.prototype.flags@1.3.0">
            <name>regexp.prototype.flags</name>
            <version>1.3.0</version>
            <description>
                <![CDATA[ES6 spec-compliant RegExp.prototype.flags shim.]]>
            </description>
            <hashes>
                <hash alg="SHA-1">7aba89b3c13a64509dabcf3ca8d9fbb9bdf5cb75</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/regexp.prototype.flags@1.3.0</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/es-shims/RegExp.prototype.flags#readme</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/es-shims/RegExp.prototype.flags/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git://github.com/es-shims/RegExp.prototype.flags.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/dfa@1.2.0">
            <name>dfa</name>
            <version>1.2.0</version>
            <description>
                <![CDATA[A state machine compiler]]>
            </description>
            <hashes>
                <hash alg="SHA-1">96ac3204e2d29c49ea5b57af8d92c2ae12790657</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/dfa@1.2.0</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/devongovett/dfa#readme</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/devongovett/dfa/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git+ssh://git@github.com/devongovett/dfa.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/restructure@0.5.4">
            <name>restructure</name>
            <version>0.5.4</version>
            <description>
                <![CDATA[Declaratively encode and decode binary data]]>
            </description>
            <hashes>
                <hash alg="SHA-1">f54e7dd563590fb34fd6bf55876109aeccb28de8</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/restructure@0.5.4</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/devongovett/restructure</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/devongovett/restructure/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git://github.com/devongovett/restructure.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/tiny-inflate@1.0.3">
            <name>tiny-inflate</name>
            <version>1.0.3</version>
            <description>
                <![CDATA[A tiny inflate implementation]]>
            </description>
            <hashes>
                <hash alg="SHA-1">122715494913a1805166aaf7c93467933eea26c4</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/tiny-inflate@1.0.3</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/devongovett/tiny-inflate</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/devongovett/tiny-inflate/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git://github.com/devongovett/tiny-inflate.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/unicode-properties@1.3.1">
            <name>unicode-properties</name>
            <version>1.3.1</version>
            <description>
                <![CDATA[Provides fast access to unicode character properties]]>
            </description>
            <hashes>
                <hash alg="SHA-1">cc642b6314bde2c691d65dd94cece09ed84f1282</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/unicode-properties@1.3.1</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/devongovett/unicode-properties</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/devongovett/unicode-properties/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git://github.com/devongovett/unicode-properties.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/unicode-trie@2.0.0">
            <name>unicode-trie</name>
            <version>2.0.0</version>
            <description>
                <![CDATA[Unicode Trie data structure for fast character metadata lookup, ported from ICU]]>
            </description>
            <hashes>
                <hash alg="SHA-1">8fd8845696e2e14a8b67d78fa9e0dd2cad62fec8</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/unicode-trie@2.0.0</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/devongovett/unicode-trie</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/devongovett/unicode-trie/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git://github.com/devongovett/unicode-trie.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/pako@0.2.9">
            <name>pako</name>
            <version>0.2.9</version>
            <description>
                <![CDATA[zlib port to javascript - fast, modularized, with browser support]]>
            </description>
            <hashes>
                <hash alg="SHA-1">f3f7522f4ef782348da8161bad9ecfd51bf83a75</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/pako@0.2.9</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/nodeca/pako</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/nodeca/pako/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git+https://github.com/nodeca/pako.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/unicode-trie@0.3.1">
            <name>unicode-trie</name>
            <version>0.3.1</version>
            <description>
                <![CDATA[Unicode Trie data structure for fast character metadata lookup, ported from ICU]]>
            </description>
            <hashes>
                <hash alg="SHA-1">d671dddd89101a08bac37b6a5161010602052085</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/unicode-trie@0.3.1</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/devongovett/unicode-trie</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/devongovett/unicode-trie/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git://github.com/devongovett/unicode-trie.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/linebreak@1.0.2">
            <name>linebreak</name>
            <version>1.0.2</version>
            <description>
                <![CDATA[An implementation of the Unicode Line Breaking Algorithm (UAX #14)]]>
            </description>
            <hashes>
                <hash alg="SHA-1">4b5781733e9a9eb2849dba2f963e47c887f8aa06</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/linebreak@1.0.2</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/devongovett/linebreaker</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/devongovett/linebreaker/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git+https://github.com/devongovett/linebreaker.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/base64-js@0.0.8">
            <name>base64-js</name>
            <version>0.0.8</version>
            <description>
                <![CDATA[Base64 encoding/decoding in pure JS]]>
            </description>
            <hashes>
                <hash alg="SHA-1">1101e9544f4a76b1bc3b26d452ca96d7a35e7978</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/base64-js@0.0.8</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/beatgammit/base64-js#readme</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/beatgammit/base64-js/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git://github.com/beatgammit/base64-js.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/unicode-trie@1.0.0">
            <name>unicode-trie</name>
            <version>1.0.0</version>
            <description>
                <![CDATA[Unicode Trie data structure for fast character metadata lookup, ported from ICU]]>
            </description>
            <hashes>
                <hash alg="SHA-1">f649afdca127135edb55ca0ad7c8c60656d92ad1</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/unicode-trie@1.0.0</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/devongovett/unicode-trie</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/devongovett/unicode-trie/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git://github.com/devongovett/unicode-trie.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/png-js@1.0.0">
            <name>png-js</name>
            <version>1.0.0</version>
            <description>
                <![CDATA[A PNG decoder in JavaScript]]>
            </description>
            <hashes>
                <hash alg="SHA-1">e5484f1e8156996e383aceebb3789fd75df1874d</hash>
            </hashes>
            <purl>pkg:npm/png-js@1.0.0</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/devongovett/png.js#readme</url>
                </reference>
                <reference type="issue-tracker">
                    <url>http://github.com/devongovett/png.js/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git+https://github.com/devongovett/png.js.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/portscanner@2.2.0">
            <name>portscanner</name>
            <version>2.2.0</version>
            <description>
                <![CDATA[Asynchronous port scanner for Node.js]]>
            </description>
            <hashes>
                <hash alg="SHA-1">6059189b3efa0965c9d96a56b958eb9508411cf1</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/portscanner@2.2.0</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/baalexander/node-portscanner</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/baalexander/node-portscanner/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git://github.com/baalexander/node-portscanner.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/is-number-like@1.0.8">
            <name>is-number-like</name>
            <version>1.0.8</version>
            <description>
                <![CDATA[Checks whether provided parameter looks like a number]]>
            </description>
            <hashes>
                <hash alg="SHA-1">2e129620b50891042e44e9bbbb30593e75cfbbe3</hash>
            </hashes>
            <licenses>
                <license>
                    <id>ISC</id>
                </license>
            </licenses>
            <purl>pkg:npm/is-number-like@1.0.8</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/vigour-io/is-number-like#readme</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/vigour-io/is-number-like/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git+https://github.com/vigour-io/is-number-like.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/lodash.isfinite@3.3.2">
            <name>lodash.isfinite</name>
            <version>3.3.2</version>
            <description>
                <![CDATA[The lodash method `_.isFinite` exported as a module.]]>
            </description>
            <hashes>
                <hash alg="SHA-1">fb89b65a9a80281833f0b7478b3a5104f898ebb3</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/lodash.isfinite@3.3.2</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://lodash.com/</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/lodash/lodash/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git+https://github.com/lodash/lodash.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/prom-client@11.5.3">
            <name>prom-client</name>
            <version>11.5.3</version>
            <description>
                <![CDATA[Client for prometheus]]>
            </description>
            <hashes>
                <hash alg="SHA-1">5fedfce1083bac6c2b223738e966d0e1643756f8</hash>
            </hashes>
            <licenses>
                <license>
                    <id>Apache-2.0</id>
                </license>
            </licenses>
            <purl>pkg:npm/prom-client@11.5.3</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/siimon/prom-client</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/siimon/prom-client/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git+ssh://git@github.com/siimon/prom-client.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/tdigest@0.1.1">
            <name>tdigest</name>
            <version>0.1.1</version>
            <description>
                <![CDATA[javascript implementation of Dunning's T-Digest for streaming quantile approximation]]>
            </description>
            <hashes>
                <hash alg="SHA-1">2e3cb2c39ea449e55d1e6cd91117accca4588021</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/tdigest@0.1.1</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/welch/tdigest</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/welch/tdigest/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git+https://github.com/welch/tdigest.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/bintrees@1.0.1">
            <name>bintrees</name>
            <version>1.0.1</version>
            <description>
                <![CDATA[Binary Search Trees]]>
            </description>
            <hashes>
                <hash alg="SHA-1">0e655c9b9c2435eaab68bf4027226d2b55a34524</hash>
            </hashes>
            <purl>pkg:npm/bintrees@1.0.1</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/vadimg/js_bintrees#readme</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/vadimg/js_bintrees/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git://github.com/vadimg/js_bintrees.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/pug@2.0.4">
            <name>pug</name>
            <version>2.0.4</version>
            <description>
                <![CDATA[A clean, whitespace-sensitive template language for writing HTML]]>
            </description>
            <hashes>
                <hash alg="SHA-1">ee7682ec0a60494b38d48a88f05f3b0ac931377d</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/pug@2.0.4</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://pugjs.org</url>
                </reference>
                <reference type="vcs">
                    <url>https://github.com/pugjs/pug/tree/master/packages/pug</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/pug-code-gen@2.0.2">
            <name>pug-code-gen</name>
            <version>2.0.2</version>
            <description>
                <![CDATA[Default code-generator for pug.  It generates HTML via a JavaScript template function.]]>
            </description>
            <hashes>
                <hash alg="SHA-1">ad0967162aea077dcf787838d94ed14acb0217c2</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/pug-code-gen@2.0.2</purl>
            <externalReferences>
                <reference type="vcs">
                    <url>https://github.com/pugjs/pug/tree/master/packages/pug-code-gen</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/constantinople@3.1.2">
            <name>constantinople</name>
            <version>3.1.2</version>
            <description>
                <![CDATA[Determine whether a JavaScript expression evaluates to a constant (using acorn)]]>
            </description>
            <hashes>
                <hash alg="SHA-1">d45ed724f57d3d10500017a7d3a889c1381ae647</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/constantinople@3.1.2</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/ForbesLindesay/constantinople#readme</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/ForbesLindesay/constantinople/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git+https://github.com/ForbesLindesay/constantinople.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/%40types/babel-types@7.0.8">
            <group>@types</group>
            <name>babel-types</name>
            <version>7.0.8</version>
            <description>
                <![CDATA[TypeScript definitions for babel-types]]>
            </description>
            <hashes>
                <hash alg="SHA-1">267f405bda841ffae731e7714166b88254cc3e19</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/%40types/babel-types@7.0.8</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/DefinitelyTyped/DefinitelyTyped#readme</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/DefinitelyTyped/DefinitelyTyped/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git+https://github.com/DefinitelyTyped/DefinitelyTyped.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/%40types/babylon@6.16.5">
            <group>@types</group>
            <name>babylon</name>
            <version>6.16.5</version>
            <description>
                <![CDATA[TypeScript definitions for babylon]]>
            </description>
            <hashes>
                <hash alg="SHA-1">1c5641db69eb8cdf378edd25b4be7754beeb48b4</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/%40types/babylon@6.16.5</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/DefinitelyTyped/DefinitelyTyped#readme</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/DefinitelyTyped/DefinitelyTyped/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git+https://github.com/DefinitelyTyped/DefinitelyTyped.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/babel-types@6.26.0">
            <name>babel-types</name>
            <version>6.26.0</version>
            <description>
                <![CDATA[Babel Types is a Lodash-esque utility library for AST nodes]]>
            </description>
            <hashes>
                <hash alg="SHA-1">a3b073f94ab49eb6fa55cd65227a334380632497</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/babel-types@6.26.0</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://babeljs.io/</url>
                </reference>
                <reference type="vcs">
                    <url>https://github.com/babel/babel/tree/master/packages/babel-types</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/to-fast-properties@1.0.3">
            <name>to-fast-properties</name>
            <version>1.0.3</version>
            <description>
                <![CDATA[Force V8 to use fast properties for an object]]>
            </description>
            <hashes>
                <hash alg="SHA-1">b83571fa4d8c25b82e231b06e3a3055de4ca1a47</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/to-fast-properties@1.0.3</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/sindresorhus/to-fast-properties#readme</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/sindresorhus/to-fast-properties/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git+https://github.com/sindresorhus/to-fast-properties.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/babylon@6.18.0">
            <name>babylon</name>
            <version>6.18.0</version>
            <description>
                <![CDATA[A JavaScript parser]]>
            </description>
            <hashes>
                <hash alg="SHA-1">af2f3b88fa6f5c1e4c634d1a0f8eac4f55b395e3</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/babylon@6.18.0</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://babeljs.io/</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/babel/babylon/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git+https://github.com/babel/babylon.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/doctypes@1.1.0">
            <name>doctypes</name>
            <version>1.1.0</version>
            <description>
                <![CDATA[Shorthands for commonly used doctypes]]>
            </description>
            <hashes>
                <hash alg="SHA-1">ea80b106a87538774e8a3a4a5afe293de489e0a9</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/doctypes@1.1.0</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/pugjs/doctypes#readme</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/pugjs/doctypes/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git+https://github.com/pugjs/doctypes.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/js-stringify@1.0.2">
            <name>js-stringify</name>
            <version>1.0.2</version>
            <description>
                <![CDATA[Stringify an object so it can be safely inlined in JavaScript code]]>
            </description>
            <hashes>
                <hash alg="SHA-1">1736fddfd9724f28a3682adc6230ae7e4e9679db</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/js-stringify@1.0.2</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/jadejs/js-stringify#readme</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/jadejs/js-stringify/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git+https://github.com/jadejs/js-stringify.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/pug-attrs@2.0.4">
            <name>pug-attrs</name>
            <version>2.0.4</version>
            <description>
                <![CDATA[Generate code for Pug attributes]]>
            </description>
            <hashes>
                <hash alg="SHA-1">b2f44c439e4eb4ad5d4ef25cac20d18ad28cc336</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/pug-attrs@2.0.4</purl>
            <externalReferences>
                <reference type="vcs">
                    <url>https://github.com/pugjs/pug/tree/master/packages/pug-attrs</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/pug-runtime@2.0.5">
            <name>pug-runtime</name>
            <version>2.0.5</version>
            <description>
                <![CDATA[The runtime components for the pug templating language]]>
            </description>
            <hashes>
                <hash alg="SHA-1">6da7976c36bf22f68e733c359240d8ae7a32953a</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/pug-runtime@2.0.5</purl>
            <externalReferences>
                <reference type="vcs">
                    <url>https://github.com/pugjs/pug/tree/master/packages/pug-runtime</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/pug-error@1.3.3">
            <name>pug-error</name>
            <version>1.3.3</version>
            <description>
                <![CDATA[Standard error objects for pug]]>
            </description>
            <hashes>
                <hash alg="SHA-1">f342fb008752d58034c185de03602dd9ffe15fa6</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/pug-error@1.3.3</purl>
            <externalReferences>
                <reference type="vcs">
                    <url>https://github.com/pugjs/pug/tree/master/packages/pug-error</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/void-elements@2.0.1">
            <name>void-elements</name>
            <version>2.0.1</version>
            <description>
                <![CDATA[Array of "void elements" defined by the HTML specification.]]>
            </description>
            <hashes>
                <hash alg="SHA-1">c066afb582bb1cb4128d60ea92392e94d5e9dbec</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/void-elements@2.0.1</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/hemanth/void-elements</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/hemanth/void-elements/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git+https://github.com/hemanth/void-elements.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/with@5.1.1">
            <name>with</name>
            <version>5.1.1</version>
            <description>
                <![CDATA[Compile time `with` for strict mode JavaScript]]>
            </description>
            <hashes>
                <hash alg="SHA-1">fa4daa92daf32c4ea94ed453c81f04686b575dfe</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/with@5.1.1</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/pugjs/with#readme</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/pugjs/with/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git+https://github.com/pugjs/with.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/acorn@3.3.0">
            <name>acorn</name>
            <version>3.3.0</version>
            <description>
                <![CDATA[ECMAScript parser]]>
            </description>
            <hashes>
                <hash alg="SHA-1">45e37fb39e8da3f25baee3ff5369e2bb5f22017a</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/acorn@3.3.0</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/ternjs/acorn</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/ternjs/acorn/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git+https://github.com/ternjs/acorn.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/acorn-globals@3.1.0">
            <name>acorn-globals</name>
            <version>3.1.0</version>
            <description>
                <![CDATA[Detect global variables in JavaScript using acorn]]>
            </description>
            <hashes>
                <hash alg="SHA-1">fd8270f71fbb4996b004fa880ee5d46573a731bf</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/acorn-globals@3.1.0</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/ForbesLindesay/acorn-globals#readme</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/ForbesLindesay/acorn-globals/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git+https://github.com/ForbesLindesay/acorn-globals.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/acorn@4.0.13">
            <name>acorn</name>
            <version>4.0.13</version>
            <description>
                <![CDATA[ECMAScript parser]]>
            </description>
            <hashes>
                <hash alg="SHA-1">105495ae5361d697bd195c825192e1ad7f253787</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/acorn@4.0.13</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/ternjs/acorn</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/ternjs/acorn/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git+https://github.com/ternjs/acorn.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/pug-filters@3.1.1">
            <name>pug-filters</name>
            <version>3.1.1</version>
            <description>
                <![CDATA[Code for processing filters in pug templates]]>
            </description>
            <hashes>
                <hash alg="SHA-1">ab2cc82db9eeccf578bda89130e252a0db026aa7</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/pug-filters@3.1.1</purl>
            <externalReferences>
                <reference type="vcs">
                    <url>https://github.com/pugjs/pug/tree/master/packages/pug-filters</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/clean-css@4.2.3">
            <name>clean-css</name>
            <version>4.2.3</version>
            <description>
                <![CDATA[A well-tested CSS minifier]]>
            </description>
            <hashes>
                <hash alg="SHA-1">507b5de7d97b48ee53d84adb0160ff6216380f78</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/clean-css@4.2.3</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/jakubpawlowicz/clean-css</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/jakubpawlowicz/clean-css/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git+https://github.com/jakubpawlowicz/clean-css.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/jstransformer@1.0.0">
            <name>jstransformer</name>
            <version>1.0.0</version>
            <description>
                <![CDATA[Normalize the API of any jstransformer]]>
            </description>
            <hashes>
                <hash alg="SHA-1">ed8bf0921e2f3f1ed4d5c1a44f68709ed24722c3</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/jstransformer@1.0.0</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/jstransformers/jstransformer#readme</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/jstransformers/jstransformer/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git+https://github.com/jstransformers/jstransformer.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/is-promise@2.2.2">
            <name>is-promise</name>
            <version>2.2.2</version>
            <description>
                <![CDATA[Test whether an object looks like a promises-a+ promise]]>
            </description>
            <hashes>
                <hash alg="SHA-1">39ab959ccbf9a774cf079f7b40c7a26f763135f1</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/is-promise@2.2.2</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/then/is-promise#readme</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/then/is-promise/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git+https://github.com/then/is-promise.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/promise@7.3.1">
            <name>promise</name>
            <version>7.3.1</version>
            <description>
                <![CDATA[Bare bones Promises/A+ implementation]]>
            </description>
            <hashes>
                <hash alg="SHA-1">064b72602b18f90f29192b8b1bc418ffd1ebd3bf</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/promise@7.3.1</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/then/promise#readme</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/then/promise/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git+https://github.com/then/promise.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/asap@2.0.6">
            <name>asap</name>
            <version>2.0.6</version>
            <description>
                <![CDATA[High-priority task queue for Node.js and browsers]]>
            </description>
            <hashes>
                <hash alg="SHA-1">e50347611d7e690943208bbdafebcbc2fb866d46</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/asap@2.0.6</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/kriskowal/asap#readme</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/kriskowal/asap/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git+https://github.com/kriskowal/asap.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/pug-walk@1.1.8">
            <name>pug-walk</name>
            <version>1.1.8</version>
            <description>
                <![CDATA[Walk and transform a pug AST]]>
            </description>
            <hashes>
                <hash alg="SHA-1">b408f67f27912f8c21da2f45b7230c4bd2a5ea7a</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/pug-walk@1.1.8</purl>
            <externalReferences>
                <reference type="vcs">
                    <url>https://github.com/pugjs/pug/tree/master/packages/pug-walk</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/uglify-js@2.8.29">
            <name>uglify-js</name>
            <version>2.8.29</version>
            <description>
                <![CDATA[JavaScript parser, mangler/compressor and beautifier toolkit]]>
            </description>
            <hashes>
                <hash alg="SHA-1">29c5733148057bb4e1f75df35b7a9cb72e6a59dd</hash>
            </hashes>
            <licenses>
                <license>
                    <id>BSD-2-Clause</id>
                </license>
            </licenses>
            <purl>pkg:npm/uglify-js@2.8.29</purl>
            <externalReferences>
                <reference type="website">
                    <url>http://lisperator.net/uglifyjs</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/mishoo/UglifyJS2/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git+https://github.com/mishoo/UglifyJS2.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/yargs@3.10.0">
            <name>yargs</name>
            <version>3.10.0</version>
            <description>
                <![CDATA[Light-weight option parsing with an argv hash. No optstrings attached.]]>
            </description>
            <hashes>
                <hash alg="SHA-1">f7ee7bd857dd7c1d2d38c0e74efbd681d1431fd1</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/yargs@3.10.0</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/bcoe/yargs#readme</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/bcoe/yargs/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git+ssh://git@github.com/bcoe/yargs.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/camelcase@1.2.1">
            <name>camelcase</name>
            <version>1.2.1</version>
            <description>
                <![CDATA[Convert a dash/dot/underscore/space separated string to camelCase: foo-bar → fooBar]]>
            </description>
            <hashes>
                <hash alg="SHA-1">9bb5304d2e0b56698b2c758b08a3eaa9daa58a39</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/camelcase@1.2.1</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/sindresorhus/camelcase#readme</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/sindresorhus/camelcase/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git+https://github.com/sindresorhus/camelcase.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/cliui@2.1.0">
            <name>cliui</name>
            <version>2.1.0</version>
            <description>
                <![CDATA[easily create complex multi-column command-line-interfaces]]>
            </description>
            <hashes>
                <hash alg="SHA-1">4b475760ff80264c762c3a1719032e91c7fea0d1</hash>
            </hashes>
            <licenses>
                <license>
                    <id>ISC</id>
                </license>
            </licenses>
            <purl>pkg:npm/cliui@2.1.0</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/bcoe/cliui#readme</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/bcoe/cliui/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git+ssh://git@github.com/bcoe/cliui.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/center-align@0.1.3">
            <name>center-align</name>
            <version>0.1.3</version>
            <description>
                <![CDATA[Center-align the text in a string.]]>
            </description>
            <hashes>
                <hash alg="SHA-1">aa0d32629b6ee972200411cbd4461c907bc2b7ad</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/center-align@0.1.3</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/jonschlinkert/center-align</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/jonschlinkert/center-align/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git+https://github.com/jonschlinkert/center-align.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/align-text@0.1.4">
            <name>align-text</name>
            <version>0.1.4</version>
            <description>
                <![CDATA[Align the text in a string.]]>
            </description>
            <hashes>
                <hash alg="SHA-1">0cd90a561093f35d0a99256c22b7069433fad117</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/align-text@0.1.4</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/jonschlinkert/align-text</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/jonschlinkert/align-text/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git://github.com/jonschlinkert/align-text.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/longest@1.0.1">
            <name>longest</name>
            <version>1.0.1</version>
            <description>
                <![CDATA[Get the longest item in an array.]]>
            </description>
            <hashes>
                <hash alg="SHA-1">30a0b2da38f73770e8294a0d22e6625ed77d0097</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/longest@1.0.1</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/jonschlinkert/longest</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/jonschlinkert/longest/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git+https://github.com/jonschlinkert/longest.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/lazy-cache@1.0.4">
            <name>lazy-cache</name>
            <version>1.0.4</version>
            <description>
                <![CDATA[Cache requires to be lazy-loaded when needed.]]>
            </description>
            <hashes>
                <hash alg="SHA-1">a1d78fc3a50474cb80845d3b3b6e1da49a446e8e</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/lazy-cache@1.0.4</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/jonschlinkert/lazy-cache</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/jonschlinkert/lazy-cache/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git+https://github.com/jonschlinkert/lazy-cache.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/right-align@0.1.3">
            <name>right-align</name>
            <version>0.1.3</version>
            <description>
                <![CDATA[Right-align the text in a string.]]>
            </description>
            <hashes>
                <hash alg="SHA-1">61339b722fe6a3515689210d24e14c96148613ef</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/right-align@0.1.3</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/jonschlinkert/right-align</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/jonschlinkert/right-align/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git://github.com/jonschlinkert/right-align.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/wordwrap@0.0.2">
            <name>wordwrap</name>
            <version>0.0.2</version>
            <description>
                <![CDATA[Wrap those words. Show them at what columns to start and stop.]]>
            </description>
            <hashes>
                <hash alg="SHA-1">b79669bb42ecb409f83d583cad52ca17eaa1643f</hash>
            </hashes>
            <licenses>
                <license>
                    <name>MIT/X11</name>
                </license>
            </licenses>
            <purl>pkg:npm/wordwrap@0.0.2</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/substack/node-wordwrap#readme</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/substack/node-wordwrap/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git://github.com/substack/node-wordwrap.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/window-size@0.1.0">
            <name>window-size</name>
            <version>0.1.0</version>
            <description>
                <![CDATA[Reliable way to to get the height and width of the terminal/console in a node.js environment.]]>
            </description>
            <hashes>
                <hash alg="SHA-1">5438cd2ea93b202efa3a19fe8887aee7c94f9c9d</hash>
            </hashes>
            <purl>pkg:npm/window-size@0.1.0</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/jonschlinkert/window-size</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/jonschlinkert/window-size/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git+https://github.com/jonschlinkert/window-size.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/pug-lexer@4.1.0">
            <name>pug-lexer</name>
            <version>4.1.0</version>
            <description>
                <![CDATA[The pug lexer (takes a string and converts it to an array of tokens)]]>
            </description>
            <hashes>
                <hash alg="SHA-1">531cde48c7c0b1fcbbc2b85485c8665e31489cfd</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/pug-lexer@4.1.0</purl>
            <externalReferences>
                <reference type="vcs">
                    <url>https://github.com/pugjs/pug/tree/master/packages/pug-lexer</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/character-parser@2.2.0">
            <name>character-parser</name>
            <version>2.2.0</version>
            <description>
                <![CDATA[Parse JavaScript one character at a time to look for snippets in Templates.  This is not a validator, it's just designed to allow you to have sections of JavaScript delimited by brackets robustly.]]>
            </description>
            <hashes>
                <hash alg="SHA-1">c7ce28f36d4bcd9744e5ffc2c5fcde1c73261fc0</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/character-parser@2.2.0</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/ForbesLindesay/character-parser#readme</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/ForbesLindesay/character-parser/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git+https://github.com/ForbesLindesay/character-parser.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/is-expression@3.0.0">
            <name>is-expression</name>
            <version>3.0.0</version>
            <description>
                <![CDATA[Check if a string is a valid JavaScript expression]]>
            </description>
            <hashes>
                <hash alg="SHA-1">39acaa6be7fd1f3471dc42c7416e61c24317ac9f</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/is-expression@3.0.0</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/pugjs/is-expression#readme</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/pugjs/is-expression/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git+https://github.com/pugjs/is-expression.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/pug-linker@3.0.6">
            <name>pug-linker</name>
            <version>3.0.6</version>
            <description>
                <![CDATA[Link multiple pug ASTs together using include/extends]]>
            </description>
            <hashes>
                <hash alg="SHA-1">f5bf218b0efd65ce6670f7afc51658d0f82989fb</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/pug-linker@3.0.6</purl>
            <externalReferences>
                <reference type="vcs">
                    <url>https://github.com/pugjs/pug/tree/master/packages/pug-linker</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/pug-load@2.0.12">
            <name>pug-load</name>
            <version>2.0.12</version>
            <description>
                <![CDATA[The Pug loader is responsible for loading the depenendencies of a given Pug file.]]>
            </description>
            <hashes>
                <hash alg="SHA-1">d38c85eb85f6e2f704dea14dcca94144d35d3e7b</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/pug-load@2.0.12</purl>
            <externalReferences>
                <reference type="vcs">
                    <url>https://github.com/pugjs/pug/tree/master/packages/pug-load</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/pug-parser@5.0.1">
            <name>pug-parser</name>
            <version>5.0.1</version>
            <description>
                <![CDATA[The pug parser (takes an array of tokens and converts it to an abstract syntax tree)]]>
            </description>
            <hashes>
                <hash alg="SHA-1">03e7ada48b6840bd3822f867d7d90f842d0ffdc9</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/pug-parser@5.0.1</purl>
            <externalReferences>
                <reference type="vcs">
                    <url>https://github.com/pugjs/pug/tree/master/packages/pug-parser</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/token-stream@0.0.1">
            <name>token-stream</name>
            <version>0.0.1</version>
            <description>
                <![CDATA[Take an array of token and produce a more useful API to give to a parser]]>
            </description>
            <hashes>
                <hash alg="SHA-1">ceeefc717a76c4316f126d0b9dbaa55d7e7df01a</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/token-stream@0.0.1</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/jadejs/token-stream#readme</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/jadejs/token-stream/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git+https://github.com/jadejs/token-stream.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/pug-strip-comments@1.0.4">
            <name>pug-strip-comments</name>
            <version>1.0.4</version>
            <description>
                <![CDATA[Strip comments from a Pug token stream (from the lexer)]]>
            </description>
            <hashes>
                <hash alg="SHA-1">cc1b6de1f6e8f5931cf02ec66cdffd3f50eaf8a8</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/pug-strip-comments@1.0.4</purl>
            <externalReferences>
                <reference type="vcs">
                    <url>https://github.com/pugjs/pug/tree/master/packages/pug-strip-comments</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/replace@1.2.0">
            <name>replace</name>
            <version>1.2.0</version>
            <description>
                <![CDATA[Command line search and replace utility]]>
            </description>
            <hashes>
                <hash alg="SHA-1">a25da288841aab22f0f7e95dc1d249dbd2ed6e26</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/replace@1.2.0</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/ALMaclaine/replace#readme</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/ALMaclaine/replace/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git+https://github.com/ALMaclaine/replace.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/yargs@15.4.1">
            <name>yargs</name>
            <version>15.4.1</version>
            <description>
                <![CDATA[yargs the modern, pirate-themed, successor to optimist.]]>
            </description>
            <hashes>
                <hash alg="SHA-1">0d87a16de01aee9d8bec2bfbf74f67851730f4f8</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/yargs@15.4.1</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://yargs.js.org/</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/yargs/yargs/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git+https://github.com/yargs/yargs.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/cliui@6.0.0">
            <name>cliui</name>
            <version>6.0.0</version>
            <description>
                <![CDATA[easily create complex multi-column command-line-interfaces]]>
            </description>
            <hashes>
                <hash alg="SHA-1">511d702c0c4e41ca156d7d0e96021f23e13225b1</hash>
            </hashes>
            <licenses>
                <license>
                    <id>ISC</id>
                </license>
            </licenses>
            <purl>pkg:npm/cliui@6.0.0</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/yargs/cliui#readme</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/yargs/cliui/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git+ssh://git@github.com/yargs/cliui.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/string-width@4.2.0">
            <name>string-width</name>
            <version>4.2.0</version>
            <description>
                <![CDATA[Get the visual width of a string - the number of columns required to display it]]>
            </description>
            <hashes>
                <hash alg="SHA-1">952182c46cc7b2c313d1596e623992bd163b72b5</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/string-width@4.2.0</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/sindresorhus/string-width#readme</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/sindresorhus/string-width/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git+https://github.com/sindresorhus/string-width.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/emoji-regex@8.0.0">
            <name>emoji-regex</name>
            <version>8.0.0</version>
            <description>
                <![CDATA[A regular expression to match all Emoji-only symbols as per the Unicode Standard.]]>
            </description>
            <hashes>
                <hash alg="SHA-1">e818fd69ce5ccfcb404594f842963bf53164cc37</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/emoji-regex@8.0.0</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://mths.be/emoji-regex</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/mathiasbynens/emoji-regex/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git+https://github.com/mathiasbynens/emoji-regex.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/is-fullwidth-code-point@3.0.0">
            <name>is-fullwidth-code-point</name>
            <version>3.0.0</version>
            <description>
                <![CDATA[Check if the character represented by a given Unicode code point is fullwidth]]>
            </description>
            <hashes>
                <hash alg="SHA-1">f116f8064fe90b3f7844a38997c0b75051269f1d</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/is-fullwidth-code-point@3.0.0</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/sindresorhus/is-fullwidth-code-point#readme</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/sindresorhus/is-fullwidth-code-point/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git+https://github.com/sindresorhus/is-fullwidth-code-point.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/strip-ansi@6.0.0">
            <name>strip-ansi</name>
            <version>6.0.0</version>
            <description>
                <![CDATA[Strip ANSI escape codes from a string]]>
            </description>
            <hashes>
                <hash alg="SHA-1">0b1571dd7669ccd4f3e06e14ef1eed26225ae532</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/strip-ansi@6.0.0</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/chalk/strip-ansi#readme</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/chalk/strip-ansi/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git+https://github.com/chalk/strip-ansi.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/ansi-regex@5.0.0">
            <name>ansi-regex</name>
            <version>5.0.0</version>
            <description>
                <![CDATA[Regular expression for matching ANSI escape codes]]>
            </description>
            <hashes>
                <hash alg="SHA-1">388539f55179bf39339c81af30a654d69f87cb75</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/ansi-regex@5.0.0</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/chalk/ansi-regex#readme</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/chalk/ansi-regex/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git+https://github.com/chalk/ansi-regex.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/wrap-ansi@6.2.0">
            <name>wrap-ansi</name>
            <version>6.2.0</version>
            <description>
                <![CDATA[Wordwrap a string with ANSI escape codes]]>
            </description>
            <hashes>
                <hash alg="SHA-1">e9393ba07102e6c91a3b221478f0257cd2856e53</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/wrap-ansi@6.2.0</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/chalk/wrap-ansi#readme</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/chalk/wrap-ansi/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git+https://github.com/chalk/wrap-ansi.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/ansi-styles@4.2.1">
            <name>ansi-styles</name>
            <version>4.2.1</version>
            <description>
                <![CDATA[ANSI escape codes for styling strings in the terminal]]>
            </description>
            <hashes>
                <hash alg="SHA-1">90ae75c424d008d2624c5bf29ead3177ebfcf359</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/ansi-styles@4.2.1</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/chalk/ansi-styles#readme</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/chalk/ansi-styles/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git+https://github.com/chalk/ansi-styles.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/%40types/color-name@1.1.1">
            <group>@types</group>
            <name>color-name</name>
            <version>1.1.1</version>
            <description>
                <![CDATA[TypeScript definitions for color-name]]>
            </description>
            <hashes>
                <hash alg="SHA-1">1c1261bbeaa10a8055bbc5d8ab84b7b2afc846a0</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/%40types/color-name@1.1.1</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/DefinitelyTyped/DefinitelyTyped#readme</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/DefinitelyTyped/DefinitelyTyped/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git+https://github.com/DefinitelyTyped/DefinitelyTyped.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/color-convert@2.0.1">
            <name>color-convert</name>
            <version>2.0.1</version>
            <description>
                <![CDATA[Plain color conversion functions]]>
            </description>
            <hashes>
                <hash alg="SHA-1">72d3a68d598c9bdb3af2ad1e84f21d896abd4de3</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/color-convert@2.0.1</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/Qix-/color-convert#readme</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/Qix-/color-convert/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git+https://github.com/Qix-/color-convert.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/color-name@1.1.4">
            <name>color-name</name>
            <version>1.1.4</version>
            <description>
                <![CDATA[A list of color names and its values]]>
            </description>
            <hashes>
                <hash alg="SHA-1">c2a09a87acbde69543de6f63fa3995c826c536a2</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/color-name@1.1.4</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/colorjs/color-name</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/colorjs/color-name/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git+ssh://git@github.com/colorjs/color-name.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/find-up@4.1.0">
            <name>find-up</name>
            <version>4.1.0</version>
            <description>
                <![CDATA[Find a file or directory by walking up parent directories]]>
            </description>
            <hashes>
                <hash alg="SHA-1">97afe7d6cdc0bc5928584b7c8d7b16e8a9aa5d19</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/find-up@4.1.0</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/sindresorhus/find-up#readme</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/sindresorhus/find-up/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git+https://github.com/sindresorhus/find-up.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/locate-path@5.0.0">
            <name>locate-path</name>
            <version>5.0.0</version>
            <description>
                <![CDATA[Get the first path that exists on disk of multiple paths]]>
            </description>
            <hashes>
                <hash alg="SHA-1">1afba396afd676a6d42504d0a67a3a7eb9f62aa0</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/locate-path@5.0.0</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/sindresorhus/locate-path#readme</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/sindresorhus/locate-path/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git+https://github.com/sindresorhus/locate-path.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/p-locate@4.1.0">
            <name>p-locate</name>
            <version>4.1.0</version>
            <description>
                <![CDATA[Get the first fulfilled promise that satisfies the provided testing function]]>
            </description>
            <hashes>
                <hash alg="SHA-1">a3428bb7088b3a60292f66919278b7c297ad4f07</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/p-locate@4.1.0</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/sindresorhus/p-locate#readme</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/sindresorhus/p-locate/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git+https://github.com/sindresorhus/p-locate.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/path-exists@4.0.0">
            <name>path-exists</name>
            <version>4.0.0</version>
            <description>
                <![CDATA[Check if a path exists]]>
            </description>
            <hashes>
                <hash alg="SHA-1">513bdbe2d3b95d7762e8c1137efa195c6c61b5b3</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/path-exists@4.0.0</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/sindresorhus/path-exists#readme</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/sindresorhus/path-exists/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git+https://github.com/sindresorhus/path-exists.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/yargs-parser@18.1.3">
            <name>yargs-parser</name>
            <version>18.1.3</version>
            <description>
                <![CDATA[the mighty option parser used by yargs]]>
            </description>
            <hashes>
                <hash alg="SHA-1">be68c4975c6b2abf469236b0c870362fab09a7b0</hash>
            </hashes>
            <licenses>
                <license>
                    <id>ISC</id>
                </license>
            </licenses>
            <purl>pkg:npm/yargs-parser@18.1.3</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/yargs/yargs-parser#readme</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/yargs/yargs-parser/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git+https://github.com/yargs/yargs-parser.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/request@2.88.2">
            <name>request</name>
            <version>2.88.2</version>
            <description>
                <![CDATA[Simplified HTTP request client.]]>
            </description>
            <hashes>
                <hash alg="SHA-1">d73c918731cb5a87da047e207234146f664d12b3</hash>
            </hashes>
            <licenses>
                <license>
                    <id>Apache-2.0</id>
                </license>
            </licenses>
            <purl>pkg:npm/request@2.88.2</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/request/request#readme</url>
                </reference>
                <reference type="issue-tracker">
                    <url>http://github.com/request/request/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git+https://github.com/request/request.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/aws-sign2@0.7.0">
            <name>aws-sign2</name>
            <version>0.7.0</version>
            <description>
                <![CDATA[AWS signing. Originally pulled from LearnBoost/knox, maintained as vendor in request, now a standalone module.]]>
            </description>
            <hashes>
                <hash alg="SHA-1">b46e890934a9591f2d2f6f86d7e6a9f1b3fe76a8</hash>
            </hashes>
            <licenses>
                <license>
                    <id>Apache-2.0</id>
                </license>
            </licenses>
            <purl>pkg:npm/aws-sign2@0.7.0</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/mikeal/aws-sign#readme</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/mikeal/aws-sign/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git+https://github.com/mikeal/aws-sign.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/aws4@1.10.0">
            <name>aws4</name>
            <version>1.10.0</version>
            <description>
                <![CDATA[Signs and prepares requests using AWS Signature Version 4]]>
            </description>
            <hashes>
                <hash alg="SHA-1">a17b3a8ea811060e74d47d306122400ad4497ae2</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/aws4@1.10.0</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/mhart/aws4#readme</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/mhart/aws4/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git+https://github.com/mhart/aws4.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/caseless@0.12.0">
            <name>caseless</name>
            <version>0.12.0</version>
            <description>
                <![CDATA[Caseless object set/get/has, very useful when working with HTTP headers.]]>
            </description>
            <hashes>
                <hash alg="SHA-1">1b681c21ff84033c826543090689420d187151dc</hash>
            </hashes>
            <licenses>
                <license>
                    <id>Apache-2.0</id>
                </license>
            </licenses>
            <purl>pkg:npm/caseless@0.12.0</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/mikeal/caseless#readme</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/mikeal/caseless/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git+https://github.com/mikeal/caseless.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/combined-stream@1.0.8">
            <name>combined-stream</name>
            <version>1.0.8</version>
            <description>
                <![CDATA[A stream that emits multiple other streams one after another.]]>
            </description>
            <hashes>
                <hash alg="SHA-1">c3d45a8b34fd730631a110a8a2520682b31d5a7f</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/combined-stream@1.0.8</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/felixge/node-combined-stream</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/felixge/node-combined-stream/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git://github.com/felixge/node-combined-stream.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/delayed-stream@1.0.0">
            <name>delayed-stream</name>
            <version>1.0.0</version>
            <description>
                <![CDATA[Buffers events from a stream until you are ready to handle them.]]>
            </description>
            <hashes>
                <hash alg="SHA-1">df3ae199acadfb7d440aaae0b29e2272b24ec619</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/delayed-stream@1.0.0</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/felixge/node-delayed-stream</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/felixge/node-delayed-stream/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git://github.com/felixge/node-delayed-stream.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/forever-agent@0.6.1">
            <name>forever-agent</name>
            <version>0.6.1</version>
            <description>
                <![CDATA[HTTP Agent that keeps socket connections alive between keep-alive requests. Formerly part of mikeal/request, now a standalone module.]]>
            </description>
            <hashes>
                <hash alg="SHA-1">fbc71f0c41adeb37f96c577ad1ed42d8fdacca91</hash>
            </hashes>
            <licenses>
                <license>
                    <id>Apache-2.0</id>
                </license>
            </licenses>
            <purl>pkg:npm/forever-agent@0.6.1</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/mikeal/forever-agent#readme</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/mikeal/forever-agent/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git+https://github.com/mikeal/forever-agent.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/form-data@2.3.3">
            <name>form-data</name>
            <version>2.3.3</version>
            <description>
                <![CDATA[A library to create readable "multipart/form-data" streams. Can be used to submit forms and file uploads to other web applications.]]>
            </description>
            <hashes>
                <hash alg="SHA-1">dcce52c05f644f298c6a7ab936bd724ceffbf3a6</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/form-data@2.3.3</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/form-data/form-data#readme</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/form-data/form-data/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git://github.com/form-data/form-data.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/asynckit@0.4.0">
            <name>asynckit</name>
            <version>0.4.0</version>
            <description>
                <![CDATA[Minimal async jobs utility library, with streams support]]>
            </description>
            <hashes>
                <hash alg="SHA-1">c79ed97f7f34cb8f2ba1bc9790bcc366474b4b79</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/asynckit@0.4.0</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/alexindigo/asynckit#readme</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/alexindigo/asynckit/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git+https://github.com/alexindigo/asynckit.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/har-validator@5.1.3">
            <name>har-validator</name>
            <version>5.1.3</version>
            <description>
                <![CDATA[Extremely fast HTTP Archive (HAR) validator using JSON Schema]]>
            </description>
            <hashes>
                <hash alg="SHA-1">1ef89ebd3e4996557675eed9893110dc350fa080</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/har-validator@5.1.3</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/ahmadnassri/node-har-validator</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/ahmadnassri/node-har-validator/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git+https://github.com/ahmadnassri/node-har-validator.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/ajv@6.12.3">
            <name>ajv</name>
            <version>6.12.3</version>
            <description>
                <![CDATA[Another JSON Schema Validator]]>
            </description>
            <hashes>
                <hash alg="SHA-1">18c5af38a111ddeb4f2697bd78d68abc1cabd706</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/ajv@6.12.3</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/ajv-validator/ajv</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/ajv-validator/ajv/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git+https://github.com/ajv-validator/ajv.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/fast-deep-equal@3.1.3">
            <name>fast-deep-equal</name>
            <version>3.1.3</version>
            <description>
                <![CDATA[Fast deep equal]]>
            </description>
            <hashes>
                <hash alg="SHA-1">3a7d56b559d6cbc3eb512325244e619a65c6c525</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/fast-deep-equal@3.1.3</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/epoberezkin/fast-deep-equal#readme</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/epoberezkin/fast-deep-equal/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git+https://github.com/epoberezkin/fast-deep-equal.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/fast-json-stable-stringify@2.1.0">
            <name>fast-json-stable-stringify</name>
            <version>2.1.0</version>
            <description>
                <![CDATA[deterministic `JSON.stringify()` - a faster version of substack's json-stable-strigify without jsonify]]>
            </description>
            <hashes>
                <hash alg="SHA-1">874bf69c6f404c2b5d99c481341399fd55892633</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/fast-json-stable-stringify@2.1.0</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/epoberezkin/fast-json-stable-stringify</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/epoberezkin/fast-json-stable-stringify/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git://github.com/epoberezkin/fast-json-stable-stringify.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/json-schema-traverse@0.4.1">
            <name>json-schema-traverse</name>
            <version>0.4.1</version>
            <description>
                <![CDATA[Traverse JSON Schema passing each schema object to callback]]>
            </description>
            <hashes>
                <hash alg="SHA-1">69f6a87d9513ab8bb8fe63bdb0979c448e684660</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/json-schema-traverse@0.4.1</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/epoberezkin/json-schema-traverse#readme</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/epoberezkin/json-schema-traverse/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git+https://github.com/epoberezkin/json-schema-traverse.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/uri-js@4.2.2">
            <name>uri-js</name>
            <version>4.2.2</version>
            <description>
                <![CDATA[An RFC 3986/3987 compliant, scheme extendable URI/IRI parsing/validating/resolving library for JavaScript.]]>
            </description>
            <hashes>
                <hash alg="SHA-1">94c540e1ff772956e2299507c010aea6c8838eb0</hash>
            </hashes>
            <licenses>
                <license>
                    <id>BSD-2-Clause</id>
                </license>
            </licenses>
            <purl>pkg:npm/uri-js@4.2.2</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/garycourt/uri-js</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/garycourt/uri-js/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git+ssh://git@github.com/garycourt/uri-js.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/punycode@2.1.1">
            <name>punycode</name>
            <version>2.1.1</version>
            <description>
                <![CDATA[A robust Punycode converter that fully complies to RFC 3492 and RFC 5891, and works on nearly all JavaScript platforms.]]>
            </description>
            <hashes>
                <hash alg="SHA-1">b58b010ac40c22c5657616c8d2c2c02c7bf479ec</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/punycode@2.1.1</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://mths.be/punycode</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/bestiejs/punycode.js/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git+https://github.com/bestiejs/punycode.js.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/har-schema@2.0.0">
            <name>har-schema</name>
            <version>2.0.0</version>
            <description>
                <![CDATA[JSON Schema for HTTP Archive (HAR)]]>
            </description>
            <hashes>
                <hash alg="SHA-1">a94c2224ebcac04782a0d9035521f24735b7ec92</hash>
            </hashes>
            <licenses>
                <license>
                    <id>ISC</id>
                </license>
            </licenses>
            <purl>pkg:npm/har-schema@2.0.0</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/ahmadnassri/har-schema</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/ahmadnassri/har-schema/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git+https://github.com/ahmadnassri/har-schema.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/http-signature@1.2.0">
            <name>http-signature</name>
            <version>1.2.0</version>
            <description>
                <![CDATA[Reference implementation of Joyent's HTTP Signature scheme.]]>
            </description>
            <hashes>
                <hash alg="SHA-1">9aecd925114772f3d95b65a60abb8f7c18fbace1</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/http-signature@1.2.0</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/joyent/node-http-signature/</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/joyent/node-http-signature/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git://github.com/joyent/node-http-signature.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/assert-plus@1.0.0">
            <name>assert-plus</name>
            <version>1.0.0</version>
            <description>
                <![CDATA[Extra assertions on top of node's assert module]]>
            </description>
            <hashes>
                <hash alg="SHA-1">f12e0f3c5d77b0b1cdd9146942e4e96c1e4dd525</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/assert-plus@1.0.0</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/mcavage/node-assert-plus#readme</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/mcavage/node-assert-plus/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git+https://github.com/mcavage/node-assert-plus.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/jsprim@1.4.1">
            <name>jsprim</name>
            <version>1.4.1</version>
            <description>
                <![CDATA[utilities for primitive JavaScript types]]>
            </description>
            <hashes>
                <hash alg="SHA-1">313e66bc1e5cc06e438bc1b7499c2e5c56acb6a2</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/jsprim@1.4.1</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/joyent/node-jsprim#readme</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/joyent/node-jsprim/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git://github.com/joyent/node-jsprim.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/extsprintf@1.3.0">
            <name>extsprintf</name>
            <version>1.3.0</version>
            <description>
                <![CDATA[extended POSIX-style sprintf]]>
            </description>
            <hashes>
                <hash alg="SHA-1">96918440e3041a7a414f8c52e3c574eb3c3e1e05</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/extsprintf@1.3.0</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/davepacheco/node-extsprintf#readme</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/davepacheco/node-extsprintf/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git://github.com/davepacheco/node-extsprintf.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/json-schema@0.2.3">
            <name>json-schema</name>
            <version>0.2.3</version>
            <description>
                <![CDATA[JSON Schema validation and specifications]]>
            </description>
            <hashes>
                <hash alg="SHA-1">b480c892e59a2f05954ce727bd3f2a4e882f9e13</hash>
            </hashes>
            <purl>pkg:npm/json-schema@0.2.3</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/kriszyp/json-schema#readme</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/kriszyp/json-schema/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git+ssh://git@github.com/kriszyp/json-schema.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/verror@1.10.0">
            <name>verror</name>
            <version>1.10.0</version>
            <description>
                <![CDATA[richer JavaScript errors]]>
            </description>
            <hashes>
                <hash alg="SHA-1">3a105ca17053af55d6e270c1f8288682e18da400</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/verror@1.10.0</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/davepacheco/node-verror#readme</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/davepacheco/node-verror/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git://github.com/davepacheco/node-verror.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/sshpk@1.16.1">
            <name>sshpk</name>
            <version>1.16.1</version>
            <description>
                <![CDATA[A library for finding and using SSH public keys]]>
            </description>
            <hashes>
                <hash alg="SHA-1">fb661c0bef29b39db40769ee39fa70093d6f6877</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/sshpk@1.16.1</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/arekinath/node-sshpk#readme</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/arekinath/node-sshpk/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git+https://github.com/joyent/node-sshpk.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/asn1@0.2.4">
            <name>asn1</name>
            <version>0.2.4</version>
            <description>
                <![CDATA[Contains parsers and serializers for ASN.1 (currently BER only)]]>
            </description>
            <hashes>
                <hash alg="SHA-1">8d2475dfab553bb33e77b54e59e880bb8ce23136</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/asn1@0.2.4</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/joyent/node-asn1#readme</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/joyent/node-asn1/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git://github.com/joyent/node-asn1.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/bcrypt-pbkdf@1.0.2">
            <name>bcrypt-pbkdf</name>
            <version>1.0.2</version>
            <description>
                <![CDATA[Port of the OpenBSD bcrypt_pbkdf function to pure JS]]>
            </description>
            <hashes>
                <hash alg="SHA-1">a4301d389b6a43f9b67ff3ca11a3f6637e360e9e</hash>
            </hashes>
            <licenses>
                <license>
                    <id>BSD-3-Clause</id>
                </license>
            </licenses>
            <purl>pkg:npm/bcrypt-pbkdf@1.0.2</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/joyent/node-bcrypt-pbkdf#readme</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/joyent/node-bcrypt-pbkdf/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git://github.com/joyent/node-bcrypt-pbkdf.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/tweetnacl@0.14.5">
            <name>tweetnacl</name>
            <version>0.14.5</version>
            <description>
                <![CDATA[Port of TweetNaCl cryptographic library to JavaScript]]>
            </description>
            <hashes>
                <hash alg="SHA-1">5ae68177f192d4456269d108afa93ff8743f4f64</hash>
            </hashes>
            <licenses>
                <license>
                    <id>Unlicense</id>
                </license>
            </licenses>
            <purl>pkg:npm/tweetnacl@0.14.5</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://tweetnacl.js.org</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/dchest/tweetnacl-js/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git+https://github.com/dchest/tweetnacl-js.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/dashdash@1.14.1">
            <name>dashdash</name>
            <version>1.14.1</version>
            <description>
                <![CDATA[A light, featureful and explicit option parsing library.]]>
            </description>
            <hashes>
                <hash alg="SHA-1">853cfa0f7cbe2fed5de20326b8dd581035f6e2f0</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/dashdash@1.14.1</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/trentm/node-dashdash#readme</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/trentm/node-dashdash/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git://github.com/trentm/node-dashdash.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/ecc-jsbn@0.1.2">
            <name>ecc-jsbn</name>
            <version>0.1.2</version>
            <description>
                <![CDATA[ECC JS code based on JSBN]]>
            </description>
            <hashes>
                <hash alg="SHA-1">3a83a904e54353287874c564b7549386849a98c9</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/ecc-jsbn@0.1.2</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/quartzjer/ecc-jsbn</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/quartzjer/ecc-jsbn/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git+https://github.com/quartzjer/ecc-jsbn.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/jsbn@0.1.1">
            <name>jsbn</name>
            <version>0.1.1</version>
            <description>
                <![CDATA[The jsbn library is a fast, portable implementation of large-number math in pure JavaScript, enabling public-key crypto and other applications on desktop and mobile browsers.]]>
            </description>
            <hashes>
                <hash alg="SHA-1">a5e654c2e5a2deb5f201d96cefbca80c0ef2f513</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/jsbn@0.1.1</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/andyperlitch/jsbn#readme</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/andyperlitch/jsbn/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git+https://github.com/andyperlitch/jsbn.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/getpass@0.1.7">
            <name>getpass</name>
            <version>0.1.7</version>
            <description>
                <![CDATA[getpass for node.js]]>
            </description>
            <hashes>
                <hash alg="SHA-1">5eff8e3e684d569ae4cb2b1282604e8ba62149fa</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/getpass@0.1.7</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/arekinath/node-getpass#readme</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/arekinath/node-getpass/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git+https://github.com/arekinath/node-getpass.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/is-typedarray@1.0.0">
            <name>is-typedarray</name>
            <version>1.0.0</version>
            <description>
                <![CDATA[Detect whether or not an object is a Typed Array]]>
            </description>
            <hashes>
                <hash alg="SHA-1">e479c80858df0c1b11ddda6940f96011fcda4a9a</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/is-typedarray@1.0.0</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/hughsk/is-typedarray</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/hughsk/is-typedarray/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git://github.com/hughsk/is-typedarray.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/isstream@0.1.2">
            <name>isstream</name>
            <version>0.1.2</version>
            <description>
                <![CDATA[Determine if an object is a Stream]]>
            </description>
            <hashes>
                <hash alg="SHA-1">47e63f7af55afa6f92e1500e690eb8b8529c099a</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/isstream@0.1.2</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/rvagg/isstream</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/rvagg/isstream/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git+https://github.com/rvagg/isstream.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/json-stringify-safe@5.0.1">
            <name>json-stringify-safe</name>
            <version>5.0.1</version>
            <description>
                <![CDATA[Like JSON.stringify, but doesn't blow up on circular refs.]]>
            </description>
            <hashes>
                <hash alg="SHA-1">1296a2d58fd45f19a0f6ce01d65701e2c735b6eb</hash>
            </hashes>
            <licenses>
                <license>
                    <id>ISC</id>
                </license>
            </licenses>
            <purl>pkg:npm/json-stringify-safe@5.0.1</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/isaacs/json-stringify-safe</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/isaacs/json-stringify-safe/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git://github.com/isaacs/json-stringify-safe.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/oauth-sign@0.9.0">
            <name>oauth-sign</name>
            <version>0.9.0</version>
            <description>
                <![CDATA[OAuth 1 signing. Formerly a vendor lib in mikeal/request, now a standalone module.]]>
            </description>
            <hashes>
                <hash alg="SHA-1">47a7b016baa68b5fa0ecf3dee08a85c679ac6455</hash>
            </hashes>
            <licenses>
                <license>
                    <id>Apache-2.0</id>
                </license>
            </licenses>
            <purl>pkg:npm/oauth-sign@0.9.0</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/mikeal/oauth-sign#readme</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/mikeal/oauth-sign/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git+https://github.com/mikeal/oauth-sign.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/performance-now@2.1.0">
            <name>performance-now</name>
            <version>2.1.0</version>
            <description>
                <![CDATA[Implements performance.now (based on process.hrtime).]]>
            </description>
            <hashes>
                <hash alg="SHA-1">6309f4e0e5fa913ec1c69307ae364b4b377c9e7b</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/performance-now@2.1.0</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/braveg1rl/performance-now</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/braveg1rl/performance-now/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git://github.com/braveg1rl/performance-now.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/qs@6.5.2">
            <name>qs</name>
            <version>6.5.2</version>
            <description>
                <![CDATA[A querystring parser that supports nesting and arrays, with a depth limit]]>
            </description>
            <hashes>
                <hash alg="SHA-1">cb3ae806e8740444584ef154ce8ee98d403f3e36</hash>
            </hashes>
            <licenses>
                <license>
                    <id>BSD-3-Clause</id>
                </license>
            </licenses>
            <purl>pkg:npm/qs@6.5.2</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/ljharb/qs</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/ljharb/qs/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git+https://github.com/ljharb/qs.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/tough-cookie@2.5.0">
            <name>tough-cookie</name>
            <version>2.5.0</version>
            <description>
                <![CDATA[RFC6265 Cookies and Cookie Jar for node.js]]>
            </description>
            <hashes>
                <hash alg="SHA-1">cd9fb2a0aa1d5a12b473bd9fb96fa3dcff65ade2</hash>
            </hashes>
            <licenses>
                <license>
                    <id>BSD-3-Clause</id>
                </license>
            </licenses>
            <purl>pkg:npm/tough-cookie@2.5.0</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/salesforce/tough-cookie</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/salesforce/tough-cookie/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git://github.com/salesforce/tough-cookie.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/psl@1.8.0">
            <name>psl</name>
            <version>1.8.0</version>
            <description>
                <![CDATA[Domain name parser based on the Public Suffix List]]>
            </description>
            <hashes>
                <hash alg="SHA-1">9326f8bcfb013adcc005fdff056acce020e51c24</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/psl@1.8.0</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/lupomontero/psl#readme</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/lupomontero/psl/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git+ssh://git@github.com/lupomontero/psl.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/uuid@3.4.0">
            <name>uuid</name>
            <version>3.4.0</version>
            <description>
                <![CDATA[RFC4122 (v1, v4, and v5) UUIDs]]>
            </description>
            <hashes>
                <hash alg="SHA-1">b23e4358afa8a202fe7a100af1f5f883f02007ee</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/uuid@3.4.0</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/uuidjs/uuid#readme</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/uuidjs/uuid/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git+https://github.com/uuidjs/uuid.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/sanitize-filename@1.6.3">
            <name>sanitize-filename</name>
            <version>1.6.3</version>
            <description>
                <![CDATA[Sanitize a string for use as a filename]]>
            </description>
            <hashes>
                <hash alg="SHA-1">755ebd752045931977e30b2025d340d7c9090378</hash>
            </hashes>
            <licenses>
                <license>
                    <name>WTFPL OR ISC</name>
                </license>
            </licenses>
            <purl>pkg:npm/sanitize-filename@1.6.3</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/parshap/node-sanitize-filename#readme</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/parshap/node-sanitize-filename/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git+ssh://git@github.com/parshap/node-sanitize-filename.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/truncate-utf8-bytes@1.0.2">
            <name>truncate-utf8-bytes</name>
            <version>1.0.2</version>
            <description>
                <![CDATA[Truncate string to given length in bytes]]>
            </description>
            <hashes>
                <hash alg="SHA-1">405923909592d56f78a5818434b0b78489ca5f2b</hash>
            </hashes>
            <licenses>
                <license>
                    <id>WTFPL</id>
                </license>
            </licenses>
            <purl>pkg:npm/truncate-utf8-bytes@1.0.2</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/parshap/truncate-utf8-bytes#readme</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/parshap/truncate-utf8-bytes/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git+https://github.com/parshap/truncate-utf8-bytes.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/utf8-byte-length@1.0.4">
            <name>utf8-byte-length</name>
            <version>1.0.4</version>
            <description>
                <![CDATA[Get utf8 byte length of string]]>
            </description>
            <hashes>
                <hash alg="SHA-1">f45f150c4c66eee968186505ab93fcbb8ad6bf61</hash>
            </hashes>
            <licenses>
                <license>
                    <id>WTFPL</id>
                </license>
            </licenses>
            <purl>pkg:npm/utf8-byte-length@1.0.4</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/parshap/utf8-byte-length#readme</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/parshap/utf8-byte-length/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git+https://github.com/parshap/utf8-byte-length.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/sanitize-html@1.4.2">
            <name>sanitize-html</name>
            <version>1.4.2</version>
            <description>
                <![CDATA[Clean up user-submitted HTML, preserving whitelisted elements and whitelisted attributes on a per-element basis]]>
            </description>
            <hashes>
                <hash alg="SHA-1">0bcc3dc92ba79d8b5dbea8b851c13d50d5ed3d58</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/sanitize-html@1.4.2</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/punkave/sanitize-html#readme</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/punkave/sanitize-html/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git+https://github.com/punkave/sanitize-html.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/he@0.4.1">
            <name>he</name>
            <version>0.4.1</version>
            <description>
                <![CDATA[A robust HTML entities encoder/decoder with full Unicode support.]]>
            </description>
            <hashes>
                <hash alg="SHA-1">c86667614d2dd71bc737a197c760fb2eec8a1921</hash>
            </hashes>
            <purl>pkg:npm/he@0.4.1</purl>
            <externalReferences>
                <reference type="website">
                    <url>http://mths.be/he</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/mathiasbynens/he/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git+https://github.com/mathiasbynens/he.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/htmlparser2@3.3.0">
            <name>htmlparser2</name>
            <version>3.3.0</version>
            <description>
                <![CDATA[Fast & forgiving HTML/XML/RSS parser]]>
            </description>
            <hashes>
                <hash alg="SHA-1">cc70d05a59f6542e43f0e685c982e14c924a9efe</hash>
            </hashes>
            <purl>pkg:npm/htmlparser2@3.3.0</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/fb55/htmlparser2#readme</url>
                </reference>
                <reference type="issue-tracker">
                    <url>http://github.com/fb55/htmlparser2/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git://github.com/fb55/htmlparser2.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/domelementtype@1.3.1">
            <name>domelementtype</name>
            <version>1.3.1</version>
            <description>
                <![CDATA[all the types of nodes in htmlparser2's dom]]>
            </description>
            <hashes>
                <hash alg="SHA-1">d048c44b37b0d10a7f2a3d5fee3f4333d790481f</hash>
            </hashes>
            <licenses>
                <license>
                    <id>BSD-2-Clause</id>
                </license>
            </licenses>
            <purl>pkg:npm/domelementtype@1.3.1</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/fb55/domelementtype#readme</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/fb55/domelementtype/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git://github.com/fb55/domelementtype.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/domhandler@2.1.0">
            <name>domhandler</name>
            <version>2.1.0</version>
            <description>
                <![CDATA[handler for htmlparser2 that turns pages into a dom]]>
            </description>
            <hashes>
                <hash alg="SHA-1">d2646f5e57f6c3bab11cf6cb05d3c0acf7412594</hash>
            </hashes>
            <purl>pkg:npm/domhandler@2.1.0</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/fb55/domhandler#readme</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/fb55/domhandler/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git://github.com/fb55/domhandler.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/domutils@1.1.6">
            <name>domutils</name>
            <version>1.1.6</version>
            <description>
                <![CDATA[utilities for working with htmlparser2's dom]]>
            </description>
            <hashes>
                <hash alg="SHA-1">bddc3de099b9a2efacc51c623f28f416ecc57485</hash>
            </hashes>
            <purl>pkg:npm/domutils@1.1.6</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/FB55/domutils#readme</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/FB55/domutils/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git://github.com/FB55/domutils.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/readable-stream@1.0.34">
            <name>readable-stream</name>
            <version>1.0.34</version>
            <description>
                <![CDATA[Streams2, a user-land copy of the stream library from Node.js v0.10.x]]>
            </description>
            <hashes>
                <hash alg="SHA-1">125820e34bc842d2f2aaafafe4c2916ee32c157c</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/readable-stream@1.0.34</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/isaacs/readable-stream#readme</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/isaacs/readable-stream/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git://github.com/isaacs/readable-stream.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/lodash@2.4.2">
            <name>lodash</name>
            <version>2.4.2</version>
            <description>
                <![CDATA[A utility library delivering consistency, customization, performance, & extras.]]>
            </description>
            <hashes>
                <hash alg="SHA-1">fadd834b9683073da179b3eae6d9c0d15053f73e</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/lodash@2.4.2</purl>
            <externalReferences>
                <reference type="website">
                    <url>http://lodash.com/</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/lodash/lodash/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git+https://github.com/lodash/lodash.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/semver@7.3.2">
            <name>semver</name>
            <version>7.3.2</version>
            <description>
                <![CDATA[The semantic version parser used by npm.]]>
            </description>
            <hashes>
                <hash alg="SHA-1">604962b052b81ed0786aae84389ffba70ffd3938</hash>
            </hashes>
            <licenses>
                <license>
                    <id>ISC</id>
                </license>
            </licenses>
            <purl>pkg:npm/semver@7.3.2</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/npm/node-semver#readme</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/npm/node-semver/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git+https://github.com/npm/node-semver.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/sequelize@5.22.3">
            <name>sequelize</name>
            <version>5.22.3</version>
            <description>
                <![CDATA[Multi dialect ORM for Node.JS]]>
            </description>
            <hashes>
                <hash alg="SHA-1">7e7a92ddd355d883c9eb11cdb106d874d0d2636f</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/sequelize@5.22.3</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://sequelize.org/</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/sequelize/sequelize/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git+https://github.com/sequelize/sequelize.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/cls-bluebird@2.1.0">
            <name>cls-bluebird</name>
            <version>2.1.0</version>
            <description>
                <![CDATA[Make bluebird work with the continuation-local-storage module.]]>
            </description>
            <hashes>
                <hash alg="SHA-1">37ef1e080a8ffb55c2f4164f536f1919e7968aee</hash>
            </hashes>
            <licenses>
                <license>
                    <id>BSD-2-Clause</id>
                </license>
            </licenses>
            <purl>pkg:npm/cls-bluebird@2.1.0</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/TimBeyer/cls-bluebird#readme</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/TimBeyer/cls-bluebird/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git+https://github.com/TimBeyer/cls-bluebird.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/is-bluebird@1.0.2">
            <name>is-bluebird</name>
            <version>1.0.2</version>
            <description>
                <![CDATA[Is this a bluebird promise I see before me?]]>
            </description>
            <hashes>
                <hash alg="SHA-1">096439060f4aa411abee19143a84d6a55346d6e2</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/is-bluebird@1.0.2</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/overlookmotel/is-bluebird#readme</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/overlookmotel/is-bluebird/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git+https://github.com/overlookmotel/is-bluebird.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/shimmer@1.2.1">
            <name>shimmer</name>
            <version>1.2.1</version>
            <description>
                <![CDATA[Safe(r) monkeypatching for JavaScript.]]>
            </description>
            <hashes>
                <hash alg="SHA-1">610859f7de327b587efebf501fb43117f9aff337</hash>
            </hashes>
            <licenses>
                <license>
                    <id>BSD-2-Clause</id>
                </license>
            </licenses>
            <purl>pkg:npm/shimmer@1.2.1</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/othiym23/shimmer#readme</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/othiym23/shimmer/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git+https://github.com/othiym23/shimmer.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/debug@4.1.1">
            <name>debug</name>
            <version>4.1.1</version>
            <description>
                <![CDATA[small debugging utility]]>
            </description>
            <hashes>
                <hash alg="SHA-1">3b72260255109c6b589cee050f1d516139664791</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/debug@4.1.1</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/visionmedia/debug#readme</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/visionmedia/debug/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git://github.com/visionmedia/debug.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/moment-timezone@0.5.31">
            <name>moment-timezone</name>
            <version>0.5.31</version>
            <description>
                <![CDATA[Parse and display moments in any timezone.]]>
            </description>
            <hashes>
                <hash alg="SHA-1">9c40d8c5026f0c7ab46eda3d63e49c155148de05</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/moment-timezone@0.5.31</purl>
            <externalReferences>
                <reference type="website">
                    <url>http://momentjs.com/timezone/</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/moment/moment-timezone/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git+https://github.com/moment/moment-timezone.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/retry-as-promised@3.2.0">
            <name>retry-as-promised</name>
            <version>3.2.0</version>
            <description>
                <![CDATA[Retry a failed promise]]>
            </description>
            <hashes>
                <hash alg="SHA-1">769f63d536bec4783549db0777cb56dadd9d8543</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/retry-as-promised@3.2.0</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/mickhansen/retry-as-promised</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/mickhansen/retry-as-promised/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git+https://github.com/mickhansen/retry-as-promised.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/any-promise@1.3.0">
            <name>any-promise</name>
            <version>1.3.0</version>
            <description>
                <![CDATA[Resolve any installed ES6 compatible promise]]>
            </description>
            <hashes>
                <hash alg="SHA-1">abc6afeedcea52e809cdc0376aed3ce39635d17f</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/any-promise@1.3.0</purl>
            <externalReferences>
                <reference type="website">
                    <url>http://github.com/kevinbeaty/any-promise</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/kevinbeaty/any-promise/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git+https://github.com/kevinbeaty/any-promise.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/semver@6.3.0">
            <name>semver</name>
            <version>6.3.0</version>
            <description>
                <![CDATA[The semantic version parser used by npm.]]>
            </description>
            <hashes>
                <hash alg="SHA-1">ee0a64c8af5e8ceea67687b133761e1becbd1d3d</hash>
            </hashes>
            <licenses>
                <license>
                    <id>ISC</id>
                </license>
            </licenses>
            <purl>pkg:npm/semver@6.3.0</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/npm/node-semver#readme</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/npm/node-semver/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git+https://github.com/npm/node-semver.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/sequelize-pool@2.3.0">
            <name>sequelize-pool</name>
            <version>2.3.0</version>
            <description>
                <![CDATA[Resource pooling for Node.JS]]>
            </description>
            <hashes>
                <hash alg="SHA-1">64f1fe8744228172c474f530604b6133be64993d</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/sequelize-pool@2.3.0</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/sushantdhiman/sequelize-pool#readme</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/sushantdhiman/sequelize-pool/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git+ssh://git@github.com/sushantdhiman/sequelize-pool.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/toposort-class@1.0.1">
            <name>toposort-class</name>
            <version>1.0.1</version>
            <description>
                <![CDATA[Topological sort of directed acyclic graphs (like dependecy lists)]]>
            </description>
            <hashes>
                <hash alg="SHA-1">7ffd1f78c8be28c3ba45cd4e1a3f5ee193bd9988</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/toposort-class@1.0.1</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/gustavohenke/toposort#readme</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/gustavohenke/toposort/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git+https://github.com/gustavohenke/toposort.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/validator@10.11.0">
            <name>validator</name>
            <version>10.11.0</version>
            <description>
                <![CDATA[String validation and sanitization]]>
            </description>
            <hashes>
                <hash alg="SHA-1">003108ea6e9a9874d31ccc9e5006856ccd76b228</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/validator@10.11.0</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/chriso/validator.js</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/chriso/validator.js/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git+https://github.com/chriso/validator.js.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/wkx@0.4.8">
            <name>wkx</name>
            <version>0.4.8</version>
            <description>
                <![CDATA[A WKT/WKB/EWKT/EWKB/TWKB/GeoJSON parser and serializer]]>
            </description>
            <hashes>
                <hash alg="SHA-1">a092cf088d112683fdc7182fd31493b2c5820003</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/wkx@0.4.8</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/cschwarz/wkx#readme</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/cschwarz/wkx/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git+ssh://git@github.com/cschwarz/wkx.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/%40types/node@14.0.23">
            <group>@types</group>
            <name>node</name>
            <version>14.0.23</version>
            <description>
                <![CDATA[TypeScript definitions for Node.js]]>
            </description>
            <hashes>
                <hash alg="SHA-1">676fa0883450ed9da0bb24156213636290892806</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/%40types/node@14.0.23</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/DefinitelyTyped/DefinitelyTyped#readme</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/DefinitelyTyped/DefinitelyTyped/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git+https://github.com/DefinitelyTyped/DefinitelyTyped.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/sequelize-noupdate-attributes@1.0.0">
            <name>sequelize-noupdate-attributes</name>
            <version>1.0.0</version>
            <description>
                <![CDATA[A very simple Sequelize plugin which adds no update and readonly attributes support.]]>
            </description>
            <hashes>
                <hash alg="SHA-1">70ab724563742b2c6fbadc507c91c01041b5fb38</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/sequelize-noupdate-attributes@1.0.0</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/diosney/node-sequelize-noupdate-attributes</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/diosney/node-sequelize-noupdate-attributes/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git+https://github.com/diosney/node-sequelize-noupdate-attributes.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/serve-index@1.9.1">
            <name>serve-index</name>
            <version>1.9.1</version>
            <description>
                <![CDATA[Serve directory listings]]>
            </description>
            <hashes>
                <hash alg="SHA-1">d3768d69b1e7d82e5ce050fff5b453bea12a9239</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/serve-index@1.9.1</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/expressjs/serve-index#readme</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/expressjs/serve-index/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git+https://github.com/expressjs/serve-index.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/batch@0.6.1">
            <name>batch</name>
            <version>0.6.1</version>
            <description>
                <![CDATA[Simple async batch with concurrency control and progress reporting.]]>
            </description>
            <hashes>
                <hash alg="SHA-1">dc34314f4e679318093fc760272525f94bf25c16</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/batch@0.6.1</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/visionmedia/batch#readme</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/visionmedia/batch/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git+https://github.com/visionmedia/batch.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/http-errors@1.6.3">
            <name>http-errors</name>
            <version>1.6.3</version>
            <description>
                <![CDATA[Create HTTP error objects]]>
            </description>
            <hashes>
                <hash alg="SHA-1">8b55680bb4be283a0b5bf4ea2e38580be1d9320d</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/http-errors@1.6.3</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/jshttp/http-errors#readme</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/jshttp/http-errors/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git+https://github.com/jshttp/http-errors.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/setprototypeof@1.1.0">
            <name>setprototypeof</name>
            <version>1.1.0</version>
            <description>
                <![CDATA[A small polyfill for Object.setprototypeof]]>
            </description>
            <hashes>
                <hash alg="SHA-1">d0bd85536887b6fe7c0d818cb962d9d91c54e656</hash>
            </hashes>
            <licenses>
                <license>
                    <id>ISC</id>
                </license>
            </licenses>
            <purl>pkg:npm/setprototypeof@1.1.0</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/wesleytodd/setprototypeof</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/wesleytodd/setprototypeof/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git+https://github.com/wesleytodd/setprototypeof.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="framework" bom-ref="pkg:npm/socket.io@2.3.0">
            <name>socket.io</name>
            <version>2.3.0</version>
            <description>
                <![CDATA[node.js realtime framework server]]>
            </description>
            <hashes>
                <hash alg="SHA-1">cd762ed6a4faeca59bc1f3e243c0969311eb73fb</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/socket.io@2.3.0</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/socketio/socket.io#readme</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/socketio/socket.io/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git://github.com/socketio/socket.io.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/engine.io@3.4.2">
            <name>engine.io</name>
            <version>3.4.2</version>
            <description>
                <![CDATA[The realtime engine behind Socket.IO. Provides the foundation of a bidirectional connection between client and server]]>
            </description>
            <hashes>
                <hash alg="SHA-1">8fc84ee00388e3e228645e0a7d3dfaeed5bd122c</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/engine.io@3.4.2</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/socketio/engine.io</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/socketio/engine.io/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git+ssh://git@github.com/socketio/engine.io.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/base64id@2.0.0">
            <name>base64id</name>
            <version>2.0.0</version>
            <description>
                <![CDATA[Generates a base64 id]]>
            </description>
            <hashes>
                <hash alg="SHA-1">2770ac6bc47d312af97a8bf9a634342e0cd25cb6</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/base64id@2.0.0</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/faeldt/base64id#readme</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/faeldt/base64id/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git+https://github.com/faeldt/base64id.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/cookie@0.3.1">
            <name>cookie</name>
            <version>0.3.1</version>
            <description>
                <![CDATA[HTTP server cookie parsing and serialization]]>
            </description>
            <hashes>
                <hash alg="SHA-1">e7e0a1f9ef43b4c8ba925c5c5a96e806d16873bb</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/cookie@0.3.1</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/jshttp/cookie#readme</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/jshttp/cookie/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git+https://github.com/jshttp/cookie.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/engine.io-parser@2.2.0">
            <name>engine.io-parser</name>
            <version>2.2.0</version>
            <description>
                <![CDATA[Parser for the client for the realtime Engine]]>
            </description>
            <hashes>
                <hash alg="SHA-1">312c4894f57d52a02b420868da7b5c1c84af80ed</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/engine.io-parser@2.2.0</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/socketio/engine.io-parser</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/socketio/engine.io-parser/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git+ssh://git@github.com/socketio/engine.io-parser.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/after@0.8.2">
            <name>after</name>
            <version>0.8.2</version>
            <description>
                <![CDATA[after - tiny flow control]]>
            </description>
            <hashes>
                <hash alg="SHA-1">fedb394f9f0e02aa9768e702bda23b505fae7e1f</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/after@0.8.2</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/Raynos/after#readme</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/Raynos/after/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git://github.com/Raynos/after.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/arraybuffer.slice@0.0.7">
            <name>arraybuffer.slice</name>
            <version>0.0.7</version>
            <description>
                <![CDATA[Exports a function for slicing ArrayBuffers (no polyfilling)]]>
            </description>
            <hashes>
                <hash alg="SHA-1">3bbc4275dd584cc1b10809b89d4e8b63a69e7675</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/arraybuffer.slice@0.0.7</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/rase-/arraybuffer.slice</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/rase-/arraybuffer.slice/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git+ssh://git@github.com/rase-/arraybuffer.slice.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/base64-arraybuffer@0.1.5">
            <name>base64-arraybuffer</name>
            <version>0.1.5</version>
            <description>
                <![CDATA[Encode/decode base64 data into ArrayBuffers]]>
            </description>
            <hashes>
                <hash alg="SHA-1">73926771923b5a19747ad666aa5cd4bf9c6e9ce8</hash>
            </hashes>
            <purl>pkg:npm/base64-arraybuffer@0.1.5</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/niklasvh/base64-arraybuffer</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/niklasvh/base64-arraybuffer/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git+https://github.com/niklasvh/base64-arraybuffer.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/blob@0.0.5">
            <name>blob</name>
            <version>0.0.5</version>
            <description>
                <![CDATA[Abstracts out Blob and uses BlobBulder in cases where it is supported with any vendor prefix.]]>
            </description>
            <hashes>
                <hash alg="SHA-1">d680eeef25f8cd91ad533f5b01eed48e64caf683</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/blob@0.0.5</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/webmodules/blob</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/webmodules/blob/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git://github.com/webmodules/blob.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/has-binary2@1.0.3">
            <name>has-binary2</name>
            <version>1.0.3</version>
            <description>
                <![CDATA[A function that takes anything in javascript and returns true if its argument contains binary data.]]>
            </description>
            <hashes>
                <hash alg="SHA-1">7776ac627f3ea77250cfc332dab7ddf5e4f5d11d</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/has-binary2@1.0.3</purl>
        </component>
        <component type="library" bom-ref="pkg:npm/isarray@2.0.1">
            <name>isarray</name>
            <version>2.0.1</version>
            <description>
                <![CDATA[Array#isArray for older browsers]]>
            </description>
            <hashes>
                <hash alg="SHA-1">a37d94ed9cda2d59865c9f76fe596ee1f338741e</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/isarray@2.0.1</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/juliangruber/isarray</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/juliangruber/isarray/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git://github.com/juliangruber/isarray.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/ws@7.3.1">
            <name>ws</name>
            <version>7.3.1</version>
            <description>
                <![CDATA[Simple to use, blazing fast and thoroughly tested websocket client and server for Node.js]]>
            </description>
            <hashes>
                <hash alg="SHA-1">d0547bf67f7ce4f12a72dfe31262c68d7dc551c8</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/ws@7.3.1</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/websockets/ws</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/websockets/ws/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git+https://github.com/websockets/ws.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/socket.io-adapter@1.1.2">
            <name>socket.io-adapter</name>
            <version>1.1.2</version>
            <description>
                <![CDATA[default socket.io in-memory adapter]]>
            </description>
            <hashes>
                <hash alg="SHA-1">ab3f0d6f66b8fc7fca3959ab5991f82221789be9</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/socket.io-adapter@1.1.2</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/socketio/socket.io-adapter#readme</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/socketio/socket.io-adapter/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git://github.com/socketio/socket.io-adapter.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="framework" bom-ref="pkg:npm/socket.io-client@2.3.0">
            <name>socket.io-client</name>
            <version>2.3.0</version>
            <description>
                <![CDATA[[![Build Status](https://secure.travis-ci.org/socketio/socket.io-client.svg?branch=master)](http://travis-ci.org/socketio/socket.io-client) [![Dependency Status](https://david-dm.org/socketio/socket.io-client.svg)](https://david-dm.org/socketio/socket.io-client) [![devDependency Status](https://david-dm.org/socketio/socket.io-client/dev-status.svg)](https://david-dm.org/socketio/socket.io-client#info=devDependencies) [![NPM version](https://badge.fury.io/js/socket.io-client.svg)](https://www.npmjs.com/package/socket.io-client) ![Downloads](http://img.shields.io/npm/dm/socket.io-client.svg?style=flat) [![](http://slack.socket.io/badge.svg?)](http://slack.socket.io)]]>
            </description>
            <hashes>
                <hash alg="SHA-1">14d5ba2e00b9bcd145ae443ab96b3f86cbcc1bb4</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/socket.io-client@2.3.0</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/Automattic/socket.io-client#readme</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/Automattic/socket.io-client/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git+https://github.com/Automattic/socket.io-client.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/backo2@1.0.2">
            <name>backo2</name>
            <version>1.0.2</version>
            <description>
                <![CDATA[simple backoff based on segmentio/backo]]>
            </description>
            <hashes>
                <hash alg="SHA-1">31ab1ac8b129363463e35b3ebb69f4dfcfba7947</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/backo2@1.0.2</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/mokesmokes/backo#readme</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/mokesmokes/backo/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git+https://github.com/mokesmokes/backo.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/component-bind@1.0.0">
            <name>component-bind</name>
            <version>1.0.0</version>
            <description>
                <![CDATA[function binding utility]]>
            </description>
            <hashes>
                <hash alg="SHA-1">00c608ab7dcd93897c0009651b1d3a8e1e73bbd1</hash>
            </hashes>
            <purl>pkg:npm/component-bind@1.0.0</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/component/bind#readme</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/component/bind/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git+https://github.com/component/bind.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/component-emitter@1.2.1">
            <name>component-emitter</name>
            <version>1.2.1</version>
            <description>
                <![CDATA[Event emitter]]>
            </description>
            <hashes>
                <hash alg="SHA-1">137918d6d78283f7df7a6b7c5a63e140e69425e6</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/component-emitter@1.2.1</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/component/emitter#readme</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/component/emitter/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git+https://github.com/component/emitter.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/engine.io-client@3.4.3">
            <name>engine.io-client</name>
            <version>3.4.3</version>
            <description>
                <![CDATA[Client for the realtime Engine]]>
            </description>
            <hashes>
                <hash alg="SHA-1">192d09865403e3097e3575ebfeb3861c4d01a66c</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/engine.io-client@3.4.3</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/socketio/engine.io-client</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/socketio/engine.io-client/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git+https://github.com/socketio/engine.io-client.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/component-inherit@0.0.3">
            <name>component-inherit</name>
            <version>0.0.3</version>
            <description>
                <![CDATA[Prototype inheritance utility]]>
            </description>
            <hashes>
                <hash alg="SHA-1">645fc4adf58b72b649d5cae65135619db26ff143</hash>
            </hashes>
            <purl>pkg:npm/component-inherit@0.0.3</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/component/inherit#readme</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/component/inherit/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git+https://github.com/component/inherit.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/has-cors@1.1.0">
            <name>has-cors</name>
            <version>1.1.0</version>
            <description>
                <![CDATA[Detects support for Cross-Origin Resource Sharing]]>
            </description>
            <hashes>
                <hash alg="SHA-1">5e474793f7ea9843d1bb99c23eef49ff126fff39</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/has-cors@1.1.0</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/component/has-cors#readme</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/component/has-cors/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git://github.com/component/has-cors.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/indexof@0.0.1">
            <name>indexof</name>
            <version>0.0.1</version>
            <description>
                <![CDATA[Microsoft sucks]]>
            </description>
            <hashes>
                <hash alg="SHA-1">82dc336d232b9062179d05ab3293a66059fd435d</hash>
            </hashes>
            <purl>pkg:npm/indexof@0.0.1</purl>
        </component>
        <component type="library" bom-ref="pkg:npm/parseqs@0.0.5">
            <name>parseqs</name>
            <version>0.0.5</version>
            <description>
                <![CDATA[Provides methods for parsing a query string into an object, and vice versa.]]>
            </description>
            <hashes>
                <hash alg="SHA-1">d5208a3738e46766e291ba2ea173684921a8b89d</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/parseqs@0.0.5</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/get/querystring</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/get/querystring/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git+https://github.com/get/querystring.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/better-assert@1.0.2">
            <name>better-assert</name>
            <version>1.0.2</version>
            <description>
                <![CDATA[Better assertions for node, reporting the expr, filename, lineno etc]]>
            </description>
            <hashes>
                <hash alg="SHA-1">40866b9e1b9e0b55b481894311e68faffaebc522</hash>
            </hashes>
            <purl>pkg:npm/better-assert@1.0.2</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/visionmedia/better-assert#readme</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/visionmedia/better-assert/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git+https://github.com/visionmedia/better-assert.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/callsite@1.0.0">
            <name>callsite</name>
            <version>1.0.0</version>
            <description>
                <![CDATA[access to v8's CallSites]]>
            </description>
            <hashes>
                <hash alg="SHA-1">280398e5d664bd74038b6f0905153e6e8af1bc20</hash>
            </hashes>
            <purl>pkg:npm/callsite@1.0.0</purl>
        </component>
        <component type="library" bom-ref="pkg:npm/parseuri@0.0.5">
            <name>parseuri</name>
            <version>0.0.5</version>
            <description>
                <![CDATA[Method that parses a URI and returns an array of its components]]>
            </description>
            <hashes>
                <hash alg="SHA-1">80204a50d4dbb779bfdc6ebe2778d90e4bce320a</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/parseuri@0.0.5</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/get/parseuri</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/get/parseuri/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git+https://github.com/get/parseuri.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/ws@6.1.4">
            <name>ws</name>
            <version>6.1.4</version>
            <description>
                <![CDATA[Simple to use, blazing fast and thoroughly tested websocket client and server for Node.js]]>
            </description>
            <hashes>
                <hash alg="SHA-1">5b5c8800afab925e94ccb29d153c8d02c1776ef9</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/ws@6.1.4</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/websockets/ws</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/websockets/ws/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git+https://github.com/websockets/ws.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/async-limiter@1.0.1">
            <name>async-limiter</name>
            <version>1.0.1</version>
            <description>
                <![CDATA[asynchronous function queue with adjustable concurrency]]>
            </description>
            <hashes>
                <hash alg="SHA-1">dd379e94f0db8310b08291f9d64c3209766617fd</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/async-limiter@1.0.1</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/strml/async-limiter#readme</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/strml/async-limiter/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git+https://github.com/strml/async-limiter.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/xmlhttprequest-ssl@1.5.5">
            <name>xmlhttprequest-ssl</name>
            <version>1.5.5</version>
            <description>
                <![CDATA[XMLHttpRequest for Node]]>
            </description>
            <hashes>
                <hash alg="SHA-1">c2876b06168aadc40e57d97e81191ac8f4398b3e</hash>
            </hashes>
            <purl>pkg:npm/xmlhttprequest-ssl@1.5.5</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/mjwwit/node-XMLHttpRequest#readme</url>
                </reference>
                <reference type="issue-tracker">
                    <url>http://github.com/mjwwit/node-XMLHttpRequest/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git://github.com/mjwwit/node-XMLHttpRequest.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/yeast@0.1.2">
            <name>yeast</name>
            <version>0.1.2</version>
            <description>
                <![CDATA[Tiny but linear growing unique id generator]]>
            </description>
            <hashes>
                <hash alg="SHA-1">008e06d8094320c372dbc2f8ed76a0ca6c8ac419</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/yeast@0.1.2</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/unshiftio/yeast</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/unshiftio/yeast/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git+https://github.com/unshiftio/yeast.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/object-component@0.0.3">
            <name>object-component</name>
            <version>0.0.3</version>
            <description>
                <![CDATA[Object utils.]]>
            </description>
            <hashes>
                <hash alg="SHA-1">f0c69aa50efc95b866c186f400a33769cb2f1291</hash>
            </hashes>
            <purl>pkg:npm/object-component@0.0.3</purl>
        </component>
        <component type="library" bom-ref="pkg:npm/socket.io-parser@3.3.0">
            <name>socket.io-parser</name>
            <version>3.3.0</version>
            <description>
                <![CDATA[socket.io protocol parser]]>
            </description>
            <hashes>
                <hash alg="SHA-1">2b52a96a509fdf31440ba40fed6094c7d4f1262f</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/socket.io-parser@3.3.0</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/Automattic/socket.io-parser#readme</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/Automattic/socket.io-parser/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git+https://github.com/Automattic/socket.io-parser.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/debug@3.1.0">
            <name>debug</name>
            <version>3.1.0</version>
            <description>
                <![CDATA[small debugging utility]]>
            </description>
            <hashes>
                <hash alg="SHA-1">5bb5a0672628b64149566ba16819e61518c67261</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/debug@3.1.0</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/visionmedia/debug#readme</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/visionmedia/debug/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git://github.com/visionmedia/debug.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/to-array@0.1.4">
            <name>to-array</name>
            <version>0.1.4</version>
            <description>
                <![CDATA[Turn an array like into an array]]>
            </description>
            <hashes>
                <hash alg="SHA-1">17e6c11f73dd4f3d74cda7a4ff3238e9ad9bf890</hash>
            </hashes>
            <purl>pkg:npm/to-array@0.1.4</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/Raynos/to-array</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/Raynos/to-array/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git://github.com/Raynos/to-array.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/socket.io-parser@3.4.1">
            <name>socket.io-parser</name>
            <version>3.4.1</version>
            <description>
                <![CDATA[socket.io protocol parser]]>
            </description>
            <hashes>
                <hash alg="SHA-1">b06af838302975837eab2dc980037da24054d64a</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/socket.io-parser@3.4.1</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/socketio/socket.io-parser#readme</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/socketio/socket.io-parser/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git+https://github.com/socketio/socket.io-parser.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/sqlite3@4.2.0">
            <name>sqlite3</name>
            <version>4.2.0</version>
            <description>
                <![CDATA[Asynchronous, non-blocking SQLite3 bindings]]>
            </description>
            <hashes>
                <hash alg="SHA-1">49026d665e9fc4f922e56fb9711ba5b4c85c4901</hash>
            </hashes>
            <licenses>
                <license>
                    <id>BSD-3-Clause</id>
                </license>
            </licenses>
            <purl>pkg:npm/sqlite3@4.2.0</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/mapbox/node-sqlite3</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/mapbox/node-sqlite3/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git://github.com/mapbox/node-sqlite3.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/node-pre-gyp@0.11.0">
            <name>node-pre-gyp</name>
            <version>0.11.0</version>
            <description>
                <![CDATA[Node.js native addon binary install tool]]>
            </description>
            <hashes>
                <hash alg="SHA-1">db1f33215272f692cd38f03238e3e9b47c5dd054</hash>
            </hashes>
            <licenses>
                <license>
                    <id>BSD-3-Clause</id>
                </license>
            </licenses>
            <purl>pkg:npm/node-pre-gyp@0.11.0</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/mapbox/node-pre-gyp#readme</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/mapbox/node-pre-gyp/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git://github.com/mapbox/node-pre-gyp.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/svg-captcha@1.4.0">
            <name>svg-captcha</name>
            <version>1.4.0</version>
            <description>
                <![CDATA[generate svg captcha in node.js or express.js]]>
            </description>
            <hashes>
                <hash alg="SHA-1">32ead3c6463936c218bb3bc9ed04fea4eeffe492</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/svg-captcha@1.4.0</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/steambap/svg-captcha#readme</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/steambap/svg-captcha/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git+https://github.com/steambap/svg-captcha.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/opentype.js@0.7.3">
            <name>opentype.js</name>
            <version>0.7.3</version>
            <description>
                <![CDATA[OpenType font parser]]>
            </description>
            <hashes>
                <hash alg="SHA-1">40fb8ce18bfd60e74448efdfe442834098397aab</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/opentype.js@0.7.3</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/nodebox/opentype.js#readme</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/nodebox/opentype.js/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git://github.com/nodebox/opentype.js.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/swagger-ui-express@4.1.4">
            <name>swagger-ui-express</name>
            <version>4.1.4</version>
            <description>
                <![CDATA[Swagger UI Express]]>
            </description>
            <hashes>
                <hash alg="SHA-1">8b814ad998b850a1cf90e71808d6d0a8a8daf742</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/swagger-ui-express@4.1.4</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/scottie1984/swagger-ui-express</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/scottie1984/swagger-ui-express/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git+ssh://git@github.com/scottie1984/swagger-ui-express.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/swagger-ui-dist@3.28.0">
            <name>swagger-ui-dist</name>
            <version>3.28.0</version>
            <description>
                <![CDATA[[![NPM version](https://badge.fury.io/js/swagger-ui-dist.svg)](http://badge.fury.io/js/swagger-ui-dist)]]>
            </description>
            <hashes>
                <hash alg="SHA-1">7c30ece92f815c1f34de3d394e12983e97f3d421</hash>
            </hashes>
            <licenses>
                <license>
                    <id>Apache-2.0</id>
                </license>
            </licenses>
            <purl>pkg:npm/swagger-ui-dist@3.28.0</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/swagger-api/swagger-ui#readme</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/swagger-api/swagger-ui/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git+ssh://git@github.com/swagger-api/swagger-ui.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/unzipper@0.9.15">
            <name>unzipper</name>
            <version>0.9.15</version>
            <description>
                <![CDATA[Unzip cross-platform streaming API ]]>
            </description>
            <hashes>
                <hash alg="SHA-1">97d99203dad17698ee39882483c14e4845c7549c</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/unzipper@0.9.15</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/ZJONSSON/node-unzipper#readme</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/ZJONSSON/node-unzipper/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git+https://github.com/ZJONSSON/node-unzipper.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/big-integer@1.6.48">
            <name>big-integer</name>
            <version>1.6.48</version>
            <description>
                <![CDATA[An arbitrary length integer library for Javascript]]>
            </description>
            <hashes>
                <hash alg="SHA-1">8fd88bd1632cba4a1c8c3e3d7159f08bb95b4b9e</hash>
            </hashes>
            <licenses>
                <license>
                    <id>Unlicense</id>
                </license>
            </licenses>
            <purl>pkg:npm/big-integer@1.6.48</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/peterolson/BigInteger.js#readme</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/peterolson/BigInteger.js/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git+ssh://git@github.com/peterolson/BigInteger.js.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/binary@0.3.0">
            <name>binary</name>
            <version>0.3.0</version>
            <description>
                <![CDATA[Unpack multibyte binary values from buffers]]>
            </description>
            <hashes>
                <hash alg="SHA-1">9f60553bc5ce8c3386f3b553cff47462adecaa79</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/binary@0.3.0</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/substack/node-binary#readme</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/substack/node-binary/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git+ssh://git@github.com/substack/node-binary.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/buffers@0.1.1">
            <name>buffers</name>
            <version>0.1.1</version>
            <description>
                <![CDATA[Treat a collection of Buffers as a single contiguous partially mutable Buffer.]]>
            </description>
            <hashes>
                <hash alg="SHA-1">b24579c3bed4d6d396aeee6d9a8ae7f5482ab7bb</hash>
            </hashes>
            <purl>pkg:npm/buffers@0.1.1</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/substack/node-buffers#readme</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/substack/node-buffers/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git+ssh://git@github.com/substack/node-buffers.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/chainsaw@0.1.0">
            <name>chainsaw</name>
            <version>0.1.0</version>
            <description>
                <![CDATA[Build chainable fluent interfaces the easy way... with a freakin' chainsaw!]]>
            </description>
            <hashes>
                <hash alg="SHA-1">5eab50b28afe58074d0d58291388828b5e5fbc98</hash>
            </hashes>
            <licenses>
                <license>
                    <name>MIT/X11</name>
                </license>
            </licenses>
            <purl>pkg:npm/chainsaw@0.1.0</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/substack/node-chainsaw#readme</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/substack/node-chainsaw/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git+ssh://git@github.com/substack/node-chainsaw.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/traverse@0.3.9">
            <name>traverse</name>
            <version>0.3.9</version>
            <description>
                <![CDATA[Traverse and transform objects by visiting every node on a recursive walk]]>
            </description>
            <hashes>
                <hash alg="SHA-1">717b8f220cc0bb7b44e40514c22b2e8bbc70d8b9</hash>
            </hashes>
            <licenses>
                <license>
                    <name>MIT/X11</name>
                </license>
            </licenses>
            <purl>pkg:npm/traverse@0.3.9</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/substack/js-traverse#readme</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/substack/js-traverse/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git+ssh://git@github.com/substack/js-traverse.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/bluebird@3.4.7">
            <name>bluebird</name>
            <version>3.4.7</version>
            <description>
                <![CDATA[Full featured Promises/A+ implementation with exceptionally good performance]]>
            </description>
            <hashes>
                <hash alg="SHA-1">f72d760be09b7f76d08ed8fae98b289a8d05fab3</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/bluebird@3.4.7</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/petkaantonov/bluebird</url>
                </reference>
                <reference type="issue-tracker">
                    <url>http://github.com/petkaantonov/bluebird/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git://github.com/petkaantonov/bluebird.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/buffer-indexof-polyfill@1.0.1">
            <name>buffer-indexof-polyfill</name>
            <version>1.0.1</version>
            <description>
                <![CDATA[This is a polyfill for Buffer#indexOf introduced in NodeJS 4.0.]]>
            </description>
            <hashes>
                <hash alg="SHA-1">a9fb806ce8145d5428510ce72f278bb363a638bf</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/buffer-indexof-polyfill@1.0.1</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/sarosia/buffer-indexof-polyfill#readme</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/sarosia/buffer-indexof-polyfill/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git+https://github.com/sarosia/buffer-indexof-polyfill.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/fstream@1.0.12">
            <name>fstream</name>
            <version>1.0.12</version>
            <description>
                <![CDATA[Advanced file system stream things]]>
            </description>
            <hashes>
                <hash alg="SHA-1">4e8ba8ee2d48be4f7d0de505455548eae5932045</hash>
            </hashes>
            <licenses>
                <license>
                    <id>ISC</id>
                </license>
            </licenses>
            <purl>pkg:npm/fstream@1.0.12</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/npm/fstream#readme</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/npm/fstream/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git+https://github.com/npm/fstream.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/listenercount@1.0.1">
            <name>listenercount</name>
            <version>1.0.1</version>
            <description>
                <![CDATA[backwards compatible version of builtin events.listenercount]]>
            </description>
            <hashes>
                <hash alg="SHA-1">84c8a72ab59c4725321480c975e6508342e70937</hash>
            </hashes>
            <licenses>
                <license>
                    <id>ISC</id>
                </license>
            </licenses>
            <purl>pkg:npm/listenercount@1.0.1</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/jden/node-listenercount#readme</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/jden/node-listenercount/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git+ssh://git@github.com/jden/node-listenercount.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/setimmediate@1.0.5">
            <name>setimmediate</name>
            <version>1.0.5</version>
            <description>
                <![CDATA[A shim for the setImmediate efficient script yielding API]]>
            </description>
            <hashes>
                <hash alg="SHA-1">290cbb232e306942d7d7ea9b83732ab7856f8285</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/setimmediate@1.0.5</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/YuzuJS/setImmediate#readme</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/YuzuJS/setImmediate/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git+https://github.com/YuzuJS/setImmediate.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/winston@3.3.3">
            <name>winston</name>
            <version>3.3.3</version>
            <description>
                <![CDATA[A logger for just about everything.]]>
            </description>
            <hashes>
                <hash alg="SHA-1">ae6172042cafb29786afa3d09c8ff833ab7c9170</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/winston@3.3.3</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/winstonjs/winston#readme</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/winstonjs/winston/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git+https://github.com/winstonjs/winston.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/%40dabh/diagnostics@2.0.2">
            <group>@dabh</group>
            <name>diagnostics</name>
            <version>2.0.2</version>
            <description>
                <![CDATA[Tools for debugging your node.js modules and event loop]]>
            </description>
            <hashes>
                <hash alg="SHA-1">290d08f7b381b8f94607dc8f471a12c675f9db31</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/%40dabh/diagnostics@2.0.2</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/3rd-Eden/diagnostics</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/3rd-Eden/diagnostics/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git://github.com/3rd-Eden/diagnostics.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/colorspace@1.1.2">
            <name>colorspace</name>
            <version>1.1.2</version>
            <description>
                <![CDATA[Generate HEX colors for a given namespace.]]>
            </description>
            <hashes>
                <hash alg="SHA-1">e0128950d082b86a2168580796a0aa5d6c68d8c5</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/colorspace@1.1.2</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/3rd-Eden/colorspace</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/3rd-Eden/colorspace/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git+https://github.com/3rd-Eden/colorspace.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/color@3.0.0">
            <name>color</name>
            <version>3.0.0</version>
            <description>
                <![CDATA[Color conversion and manipulation with CSS string support]]>
            </description>
            <hashes>
                <hash alg="SHA-1">d920b4328d534a3ac8295d68f7bd4ba6c427be9a</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/color@3.0.0</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/Qix-/color#readme</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/Qix-/color/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git+https://github.com/Qix-/color.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/color-string@1.5.3">
            <name>color-string</name>
            <version>1.5.3</version>
            <description>
                <![CDATA[Parser and generator for CSS color strings]]>
            </description>
            <hashes>
                <hash alg="SHA-1">c9bbc5f01b58b5492f3d6857459cb6590ce204cc</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/color-string@1.5.3</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/Qix-/color-string#readme</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/Qix-/color-string/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git+https://github.com/Qix-/color-string.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/simple-swizzle@0.2.2">
            <name>simple-swizzle</name>
            <version>0.2.2</version>
            <description>
                <![CDATA[Simply swizzle your arguments]]>
            </description>
            <hashes>
                <hash alg="SHA-1">a4da6b635ffcccca33f70d17cb92592de95e557a</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/simple-swizzle@0.2.2</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/qix-/node-simple-swizzle#readme</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/qix-/node-simple-swizzle/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git+https://github.com/qix-/node-simple-swizzle.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/is-arrayish@0.3.2">
            <name>is-arrayish</name>
            <version>0.3.2</version>
            <description>
                <![CDATA[Determines if an object can be used as an array]]>
            </description>
            <hashes>
                <hash alg="SHA-1">4574a2ae56f7ab206896fb431eaeed066fdf8f03</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/is-arrayish@0.3.2</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/qix-/node-is-arrayish#readme</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/qix-/node-is-arrayish/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git+https://github.com/qix-/node-is-arrayish.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/text-hex@1.0.0">
            <name>text-hex</name>
            <version>1.0.0</version>
            <description>
                <![CDATA[Generate a hex color from the given text]]>
            </description>
            <hashes>
                <hash alg="SHA-1">69dc9c1b17446ee79a92bf5b884bb4b9127506f5</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/text-hex@1.0.0</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/3rd-Eden/text-hex</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/3rd-Eden/text-hex/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git+https://github.com/3rd-Eden/text-hex.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/enabled@2.0.0">
            <name>enabled</name>
            <version>2.0.0</version>
            <description>
                <![CDATA[Check if a certain debug flag is enabled.]]>
            </description>
            <hashes>
                <hash alg="SHA-1">f9dd92ec2d6f4bbc0d5d1e64e21d61cd4665e7c2</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/enabled@2.0.0</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/3rd-Eden/enabled#readme</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/3rd-Eden/enabled/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git://github.com/3rd-Eden/enabled.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/kuler@2.0.0">
            <name>kuler</name>
            <version>2.0.0</version>
            <description>
                <![CDATA[Color your terminal using CSS/hex color codes]]>
            </description>
            <hashes>
                <hash alg="SHA-1">e2c570a3800388fb44407e851531c1d670b061b3</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/kuler@2.0.0</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/3rd-Eden/kuler</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/3rd-Eden/kuler/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git+https://github.com/3rd-Eden/kuler.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/async@3.2.0">
            <name>async</name>
            <version>3.2.0</version>
            <description>
                <![CDATA[Higher-order functions and common patterns for asynchronous code]]>
            </description>
            <hashes>
                <hash alg="SHA-1">b3a2685c5ebb641d3de02d161002c60fc9f85720</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/async@3.2.0</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://caolan.github.io/async/</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/caolan/async/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git+https://github.com/caolan/async.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/is-stream@2.0.0">
            <name>is-stream</name>
            <version>2.0.0</version>
            <description>
                <![CDATA[Check if something is a Node.js stream]]>
            </description>
            <hashes>
                <hash alg="SHA-1">bde9c32680d6fae04129d6ac9d921ce7815f78e3</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/is-stream@2.0.0</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/sindresorhus/is-stream#readme</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/sindresorhus/is-stream/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git+https://github.com/sindresorhus/is-stream.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/logform@2.2.0">
            <name>logform</name>
            <version>2.2.0</version>
            <description>
                <![CDATA[An mutable object-based log format designed for chaining & objectMode streams.]]>
            </description>
            <hashes>
                <hash alg="SHA-1">40f036d19161fc76b68ab50fdc7fe495544492f2</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/logform@2.2.0</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/winstonjs/logform#readme</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/winstonjs/logform/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git+https://github.com/winstonjs/logform.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/fast-safe-stringify@2.0.7">
            <name>fast-safe-stringify</name>
            <version>2.0.7</version>
            <description>
                <![CDATA[Safely and quickly serialize JavaScript objects]]>
            </description>
            <hashes>
                <hash alg="SHA-1">124aa885899261f68aedb42a7c080de9da608743</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/fast-safe-stringify@2.0.7</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/davidmarkclements/fast-safe-stringify#readme</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/davidmarkclements/fast-safe-stringify/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git+https://github.com/davidmarkclements/fast-safe-stringify.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/fecha@4.2.0">
            <name>fecha</name>
            <version>4.2.0</version>
            <description>
                <![CDATA[Date formatting and parsing]]>
            </description>
            <hashes>
                <hash alg="SHA-1">3ffb6395453e3f3efff850404f0a59b6747f5f41</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/fecha@4.2.0</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/taylorhakes/fecha</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/taylorhakes/fecha/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git+https://taylorhakes@github.com/taylorhakes/fecha.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/triple-beam@1.3.0">
            <name>triple-beam</name>
            <version>1.3.0</version>
            <description>
                <![CDATA[Definitions of levels for logging purposes & shareable Symbol constants.]]>
            </description>
            <hashes>
                <hash alg="SHA-1">a595214c7298db8339eeeee083e4d10bd8cb8dd9</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/triple-beam@1.3.0</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/winstonjs/triple-beam#readme</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/winstonjs/triple-beam/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git+https://github.com/winstonjs/triple-beam.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/one-time@1.0.0">
            <name>one-time</name>
            <version>1.0.0</version>
            <description>
                <![CDATA[Run the supplied function exactly one time (once)]]>
            </description>
            <hashes>
                <hash alg="SHA-1">e06bc174aed214ed58edede573b433bbf827cb45</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/one-time@1.0.0</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/3rd-Eden/one-time#readme</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/3rd-Eden/one-time/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git+https://github.com/3rd-Eden/one-time.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/fn.name@1.1.0">
            <name>fn.name</name>
            <version>1.1.0</version>
            <description>
                <![CDATA[Extract names from functions]]>
            </description>
            <hashes>
                <hash alg="SHA-1">26cad8017967aea8731bc42961d04a3d5988accc</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/fn.name@1.1.0</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/3rd-Eden/fn.name</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/3rd-Eden/fn.name/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git+https://github.com/3rd-Eden/fn.name.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/readable-stream@3.6.0">
            <name>readable-stream</name>
            <version>3.6.0</version>
            <description>
                <![CDATA[Streams3, a user-land copy of the stream library from Node.js]]>
            </description>
            <hashes>
                <hash alg="SHA-1">337bbda3adc0706bd3e024426a286d4b4b2c9198</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/readable-stream@3.6.0</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/nodejs/readable-stream#readme</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/nodejs/readable-stream/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git://github.com/nodejs/readable-stream.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/stack-trace@0.0.10">
            <name>stack-trace</name>
            <version>0.0.10</version>
            <description>
                <![CDATA[Get v8 stack traces as an array of CallSite objects.]]>
            </description>
            <hashes>
                <hash alg="SHA-1">547c70b347e8d32b4e108ea1a2a159e5fdde19c0</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/stack-trace@0.0.10</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/felixge/node-stack-trace</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/felixge/node-stack-trace/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git://github.com/felixge/node-stack-trace.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/winston-transport@4.4.0">
            <name>winston-transport</name>
            <version>4.4.0</version>
            <description>
                <![CDATA[Base stream implementations for winston@3 and up.]]>
            </description>
            <hashes>
                <hash alg="SHA-1">17af518daa690d5b2ecccaa7acf7b20ca7925e59</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/winston-transport@4.4.0</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/winstonjs/winston-transport#readme</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/winstonjs/winston-transport/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git+ssh://git@github.com/winstonjs/winston-transport.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/yaml-schema-validator@1.2.2">
            <name>yaml-schema-validator</name>
            <version>1.2.2</version>
            <description>
                <![CDATA[Schema validator for yaml files]]>
            </description>
            <hashes>
                <hash alg="SHA-1">48d85ccda92fed3acc51cdf706530c2927e09807</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/yaml-schema-validator@1.2.2</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/ketanTechracers/schema-validator#readme</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/ketanTechracers/schema-validator/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git+https://github.com/ketanTechracers/schema-validator.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/commander@2.20.3">
            <name>commander</name>
            <version>2.20.3</version>
            <description>
                <![CDATA[the complete solution for node.js command-line programs]]>
            </description>
            <hashes>
                <hash alg="SHA-1">fd485e84c03eb4881c20722ba48035e8531aeb33</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/commander@2.20.3</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/tj/commander.js#readme</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/tj/commander.js/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git+https://github.com/tj/commander.js.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/validate@4.5.1">
            <name>validate</name>
            <version>4.5.1</version>
            <description>
                <![CDATA[Validate object properties in javascript.]]>
            </description>
            <hashes>
                <hash alg="SHA-1">ba36b8450b4bad4ccf52d666ba80abb2c01cace2</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/validate@4.5.1</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/eivindfjeldstad/validate#readme</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/eivindfjeldstad/validate/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git+https://github.com/eivindfjeldstad/validate.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/component-type@1.2.1">
            <name>component-type</name>
            <version>1.2.1</version>
            <description>
                <![CDATA[Cross-browser type assertions (less broken typeof)]]>
            </description>
            <hashes>
                <hash alg="SHA-1">8a47901700238e4fc32269771230226f24b415a9</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/component-type@1.2.1</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/component/type#readme</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/component/type/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git+https://github.com/component/type.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/eivindfjeldstad-dot@0.0.1">
            <name>eivindfjeldstad-dot</name>
            <version>0.0.1</version>
            <description>
                <![CDATA[Get and set object properties with dot notation]]>
            </description>
            <hashes>
                <hash alg="SHA-1">22fc976bfaf306e0839a31db8e8213480fafb893</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/eivindfjeldstad-dot@0.0.1</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/eivindfjeldstad/dot</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/eivindfjeldstad/dot/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git+https://github.com/eivindfjeldstad/dot.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/typecast@0.0.1">
            <name>typecast</name>
            <version>0.0.1</version>
            <description>
                <![CDATA[Simple typecasting]]>
            </description>
            <hashes>
                <hash alg="SHA-1">fffb75dcb6bdf1def8e293b6b6e893d6c1ed19de</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/typecast@0.0.1</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/eivindfjeldstad/typecast#readme</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/eivindfjeldstad/typecast/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git+https://github.com/eivindfjeldstad/typecast.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/z85@0.0.2">
            <name>z85</name>
            <version>0.0.2</version>
            <description>
                <![CDATA[ZeroMQ Base-85 Encoding]]>
            </description>
            <hashes>
                <hash alg="SHA-1">45d353b13e4ee3d376c3fbd37dcda85feed8b0d3</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/z85@0.0.2</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/msealand/z85.node</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/msealand/z85.node/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git+https://github.com/msealand/z85.node.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/expand-template@2.0.3">
            <name>expand-template</name>
            <version>2.0.3</version>
            <description>
                <![CDATA[Expand placeholders in a template string]]>
            </description>
            <hashes>
                <hash alg="SHA-1">6e14b3fcee0f3a6340ecb57d2e8918692052a47c</hash>
            </hashes>
            <licenses>
                <license>
                    <name>(MIT OR WTFPL)</name>
                </license>
            </licenses>
            <purl>pkg:npm/expand-template@2.0.3</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/ralphtheninja/expand-template</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/ralphtheninja/expand-template/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git+https://github.com/ralphtheninja/expand-template.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/github-from-package@0.0.0">
            <name>github-from-package</name>
            <version>0.0.0</version>
            <description>
                <![CDATA[return the github url from a package.json file]]>
            </description>
            <hashes>
                <hash alg="SHA-1">97fb5d96bfde8973313f20e8288ef9a167fa64ce</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/github-from-package@0.0.0</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/substack/github-from-package</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/substack/github-from-package/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git://github.com/substack/github-from-package.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/iltorb@2.4.5">
            <name>iltorb</name>
            <version>2.4.5</version>
            <description>
                <![CDATA[Brotli compression/decompression with native bindings]]>
            </description>
            <hashes>
                <hash alg="SHA-1">d64434b527099125c6839ed48b666247a172ef87</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/iltorb@2.4.5</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/nstepien/iltorb</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/nstepien/iltorb/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git://github.com/nstepien/iltorb.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/prebuild-install@5.3.5">
            <name>prebuild-install</name>
            <version>5.3.5</version>
            <description>
                <![CDATA[A command line tool to easily install prebuilt binaries for multiple version of node/iojs on a specific platform]]>
            </description>
            <hashes>
                <hash alg="SHA-1">e7e71e425298785ea9d22d4f958dbaccf8bb0e1b</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/prebuild-install@5.3.5</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/prebuild/prebuild-install</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/prebuild/prebuild-install/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git+https://github.com/prebuild/prebuild-install.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/napi-build-utils@1.0.2">
            <name>napi-build-utils</name>
            <version>1.0.2</version>
            <description>
                <![CDATA[A set of utilities to assist developers of tools that build N-API native add-ons]]>
            </description>
            <hashes>
                <hash alg="SHA-1">b1fddc0b2c46e380a0b7a76f984dd47c41a13806</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/napi-build-utils@1.0.2</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/inspiredware/napi-build-utils#readme</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/inspiredware/napi-build-utils/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git+https://github.com/inspiredware/napi-build-utils.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/node-abi@2.18.0">
            <name>node-abi</name>
            <version>2.18.0</version>
            <description>
                <![CDATA[Get the Node ABI for a given target and runtime, and vice versa.]]>
            </description>
            <hashes>
                <hash alg="SHA-1">1f5486cfd7d38bd4f5392fa44a4ad4d9a0dffbf4</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/node-abi@2.18.0</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/lgeiger/node-abi#readme</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/lgeiger/node-abi/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git+https://github.com/lgeiger/node-abi.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/noop-logger@0.1.1">
            <name>noop-logger</name>
            <version>0.1.1</version>
            <description>
                <![CDATA[A logger that does exactly nothing.]]>
            </description>
            <hashes>
                <hash alg="SHA-1">94a2b1633c4f1317553007d8966fd0e841b6a4c2</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/noop-logger@0.1.1</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/segmentio/noop-logger#readme</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/segmentio/noop-logger/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git://github.com/segmentio/noop-logger.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/pump@3.0.0">
            <name>pump</name>
            <version>3.0.0</version>
            <description>
                <![CDATA[pipe streams together and close all of them if one of them closes]]>
            </description>
            <hashes>
                <hash alg="SHA-1">b4a2116815bde2f4e1ea602354e8c75565107a64</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/pump@3.0.0</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/mafintosh/pump#readme</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/mafintosh/pump/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git://github.com/mafintosh/pump.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/simple-get@3.1.0">
            <name>simple-get</name>
            <version>3.1.0</version>
            <description>
                <![CDATA[Simplest way to make http get requests. Supports HTTPS, redirects, gzip/deflate, streams in < 100 lines.]]>
            </description>
            <hashes>
                <hash alg="SHA-1">b45be062435e50d159540b576202ceec40b9c6b3</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/simple-get@3.1.0</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/feross/simple-get</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/feross/simple-get/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git://github.com/feross/simple-get.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/decompress-response@4.2.1">
            <name>decompress-response</name>
            <version>4.2.1</version>
            <description>
                <![CDATA[Decompress a HTTP response if needed]]>
            </description>
            <hashes>
                <hash alg="SHA-1">414023cc7a302da25ce2ec82d0d5238ccafd8986</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/decompress-response@4.2.1</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/sindresorhus/decompress-response#readme</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/sindresorhus/decompress-response/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git+https://github.com/sindresorhus/decompress-response.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/mimic-response@2.1.0">
            <name>mimic-response</name>
            <version>2.1.0</version>
            <description>
                <![CDATA[Mimic a Node.js HTTP response stream]]>
            </description>
            <hashes>
                <hash alg="SHA-1">d13763d35f613d09ec37ebb30bac0469c0ee8f43</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/mimic-response@2.1.0</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/sindresorhus/mimic-response#readme</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/sindresorhus/mimic-response/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git+https://github.com/sindresorhus/mimic-response.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/simple-concat@1.0.0">
            <name>simple-concat</name>
            <version>1.0.0</version>
            <description>
                <![CDATA[Super-minimalist version of `concat-stream`. Less than 15 lines!]]>
            </description>
            <hashes>
                <hash alg="SHA-1">7344cbb8b6e26fb27d66b2fc86f9f6d5997521c6</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/simple-concat@1.0.0</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/feross/simple-concat</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/feross/simple-concat/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git://github.com/feross/simple-concat.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/tar-fs@2.1.0">
            <name>tar-fs</name>
            <version>2.1.0</version>
            <description>
                <![CDATA[filesystem bindings for tar-stream]]>
            </description>
            <hashes>
                <hash alg="SHA-1">d1cdd121ab465ee0eb9ccde2d35049d3f3daf0d5</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/tar-fs@2.1.0</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/mafintosh/tar-fs</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/mafintosh/tar-fs/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git+https://github.com/mafintosh/tar-fs.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/mkdirp-classic@0.5.3">
            <name>mkdirp-classic</name>
            <version>0.5.3</version>
            <description>
                <![CDATA[Mirror of mkdirp 0.5.2]]>
            </description>
            <hashes>
                <hash alg="SHA-1">fa10c9115cc6d8865be221ba47ee9bed78601113</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/mkdirp-classic@0.5.3</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/mafintosh/mkdirp-classic</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/mafintosh/mkdirp-classic/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git+https://github.com/mafintosh/mkdirp-classic.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/tar-stream@2.1.3">
            <name>tar-stream</name>
            <version>2.1.3</version>
            <description>
                <![CDATA[tar-stream is a streaming tar parser and generator and nothing else. It is streams2 and operates purely using streams which means you can easily extract/parse tarballs without ever hitting the file system.]]>
            </description>
            <hashes>
                <hash alg="SHA-1">1e2022559221b7866161660f118255e20fa79e41</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/tar-stream@2.1.3</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/mafintosh/tar-stream</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/mafintosh/tar-stream/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git+https://github.com/mafintosh/tar-stream.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/bl@4.0.2">
            <name>bl</name>
            <version>4.0.2</version>
            <description>
                <![CDATA[Buffer List: collect buffers and access with a standard readable Buffer interface, streamable too!]]>
            </description>
            <hashes>
                <hash alg="SHA-1">52b71e9088515d0606d9dd9cc7aa48dc1f98e73a</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/bl@4.0.2</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/rvagg/bl</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/rvagg/bl/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git+https://github.com/rvagg/bl.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/inherits@2.0.4">
            <name>inherits</name>
            <version>2.0.4</version>
            <description>
                <![CDATA[Browser-friendly inheritance fully compatible with standard node.js inherits()]]>
            </description>
            <hashes>
                <hash alg="SHA-1">0fa2c64f932917c3433a0ded55363aae37416b7c</hash>
            </hashes>
            <licenses>
                <license>
                    <id>ISC</id>
                </license>
            </licenses>
            <purl>pkg:npm/inherits@2.0.4</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/isaacs/inherits#readme</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/isaacs/inherits/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git://github.com/isaacs/inherits.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/which-pm-runs@1.0.0">
            <name>which-pm-runs</name>
            <version>1.0.0</version>
            <description>
                <![CDATA[Detects what package manager executes the process]]>
            </description>
            <hashes>
                <hash alg="SHA-1">670b3afbc552e0b55df6b7780ca74615f23ad1cb</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/which-pm-runs@1.0.0</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/zkochan/which-pm-runs#readme</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/zkochan/which-pm-runs/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git+https://github.com/zkochan/which-pm-runs.git</url>
                </reference>
            </externalReferences>
        </component>
        <component type="library" bom-ref="pkg:npm/uglify-to-browserify@1.0.2">
            <name>uglify-to-browserify</name>
            <version>1.0.2</version>
            <description>
                <![CDATA[A transform to make UglifyJS work in browserify.]]>
            </description>
            <hashes>
                <hash alg="SHA-1">6e0924d6bda6b5afe349e39a6d632850a0f882b7</hash>
            </hashes>
            <licenses>
                <license>
                    <id>MIT</id>
                </license>
            </licenses>
            <purl>pkg:npm/uglify-to-browserify@1.0.2</purl>
            <externalReferences>
                <reference type="website">
                    <url>https://github.com/ForbesLindesay/uglify-to-browserify#readme</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://github.com/ForbesLindesay/uglify-to-browserify/issues</url>
                </reference>
                <reference type="vcs">
                    <url>git+https://github.com/ForbesLindesay/uglify-to-browserify.git</url>
                </reference>
            </externalReferences>
        </component>
    </components>
</bom>