{ "bomFormat": "CycloneDX", "specVersion": "1.7", "serialNumber": "urn:uuid:8b104890-71a5-4873-bf96-b34fd14b2a7f", "version": 1, "metadata": { "timestamp": "2026-09-29T16:22:10Z", "tools": { "components": [ { "group": "@cyclonedx", "name": "cdxgen", "version": "12.8.5", "purl": "pkg:npm/%40cyclonedx/cdxgen@12.8.5", "type": "application", "bom-ref": "pkg:npm/@cyclonedx/cdxgen@12.8.5", "publisher": "OWASP Foundation", "authors": [ { "name": "OWASP Foundation" } ] } ] }, "authors": [ { "name": "OWASP Foundation" } ], "lifecycles": [ { "phase": "pre-build" } ], "component": { "name": "create-expo", "group": "", "version": "5.1.4", "description": "Create universal Expo apps", "purl": "pkg:npm/create-expo@5.1.4", "bom-ref": "pkg:npm/create-expo@5.1.4", "author": "Evan Bacon (https://github.com/evanbacon)", "properties": [ { "name": "cdx:npm:bin", "value": "./bin/create-expo.js" }, { "name": "cdx:npm:has_binary", "value": "true" }, { "name": "cdx:npm:scripts", "value": "prebuild, build, prebuild:prod, build:prod, clean, lint, format, depscheck, typecheck, test, test:e2e, sync-agent-templates, prepublishOnly" }, { "name": "cdx:npm:buildScripts", "value": "build, build:prod" }, { "name": "cdx:license:category", "value": "Permissive" } ], "type": "application", "licenses": [ { "license": { "id": "BSD-3-Clause", "url": "https://opensource.org/licenses/BSD-3-Clause", "properties": [ { "name": "cdx:license:category", "value": "Permissive" }, { "name": "cdx:license:foss", "value": "true" }, { "name": "cdx:license:osiApproved", "value": "true" }, { "name": "cdx:license:fsfLibre", "value": "true" }, { "name": "cdx:license:deprecated", "value": "false" } ] } } ], "externalReferences": [ { "type": "website", "url": "https://docs.expo.dev" }, { "type": "vcs", "url": "https://github.com/expo/expo.git" } ] }, "properties": [ { "name": "cdx:bom:componentTypes", "value": "npm" }, { "name": "cdx:bom:componentNamespaces", "value": "@expo\\n@octokit\\n@types\\n@vercel" }, { "name": "cdx:bom:componentSrcFiles", "value": "node_modules/@expo/config/package.json\\nnode_modules/@expo/json-file/package.json\\nnode_modules/@expo/package-manager/package.json\\nnode_modules/@expo/spawn-async/package.json\\nnode_modules/@octokit/types/package.json\\nnode_modules/@types/debug/package.json\\nnode_modules/@types/getenv/package.json\\nnode_modules/@types/node/package.json\\nnode_modules/@types/picomatch/package.json\\nnode_modules/@types/prompts/package.json\\nnode_modules/@vercel/ncc/package.json\\nnode_modules/arg/package.json\\nnode_modules/chalk/package.json\\nnode_modules/debug/package.json\\nnode_modules/expo-module-scripts/package.json\\nnode_modules/getenv/package.json\\nnode_modules/glob/package.json\\nnode_modules/memfs/package.json\\nnode_modules/multitars/package.json\\nnode_modules/nock/package.json\\nnode_modules/ora/package.json\\nnode_modules/picomatch/package.json\\nnode_modules/prompts/package.json\\nnode_modules/resolve-workspace-root/package.json\\nnode_modules/slugify/package.json\\nnode_modules/update-check/package.json" } ] }, "components": [ { "authors": [ { "name": "leo" } ], "group": "", "name": "update-check", "version": "1.5.4", "description": "Minimalistic update notifications for command line interfaces", "scope": "required", "licenses": [ { "license": { "id": "MIT", "url": "https://opensource.org/licenses/MIT", "properties": [ { "name": "cdx:license:category", "value": "Permissive" }, { "name": "cdx:license:foss", "value": "true" }, { "name": "cdx:license:osiApproved", "value": "true" }, { "name": "cdx:license:fsfLibre", "value": "true" }, { "name": "cdx:license:deprecated", "value": "false" } ] } } ], "purl": "pkg:npm/update-check@1.5.4", "type": "library", "bom-ref": "pkg:npm/update-check@1.5.4", "properties": [ { "name": "SrcFile", "value": "node_modules/update-check/package.json" }, { "name": "ImportedModules", "value": "update-check" }, { "name": "cdx:license:category", "value": "Permissive" } ], "evidence": { "identity": [ { "field": "purl", "confidence": 0.7, "methods": [ { "technique": "manifest-analysis", "confidence": 0.7, "value": "node_modules/update-check/package.json" } ], "concludedValue": "node_modules/update-check/package.json" } ], "occurrences": [ { "location": "src/utils/update-check.ts", "line": 2 }, { "location": "src/utils/update-check.ts", "line": 19 } ] } }, { "authors": [ { "name": "Simeon Velichkov (https://simov.github.io)" } ], "group": "", "name": "slugify", "version": "1.6.8", "description": "Slugifies a String", "scope": "required", "licenses": [ { "license": { "id": "MIT", "url": "https://opensource.org/licenses/MIT", "properties": [ { "name": "cdx:license:category", "value": "Permissive" }, { "name": "cdx:license:foss", "value": "true" }, { "name": "cdx:license:osiApproved", "value": "true" }, { "name": "cdx:license:fsfLibre", "value": "true" }, { "name": "cdx:license:deprecated", "value": "false" } ] } } ], "purl": "pkg:npm/slugify@1.6.8", "externalReferences": [ { "type": "vcs", "url": "https://github.com/simov/slugify" }, { "type": "vcs", "url": "git+https://github.com/simov/slugify.git" } ], "type": "library", "bom-ref": "pkg:npm/slugify@1.6.8", "properties": [ { "name": "SrcFile", "value": "node_modules/slugify/package.json" }, { "name": "ImportedModules", "value": "slugify" }, { "name": "cdx:license:category", "value": "Permissive" } ], "evidence": { "identity": [ { "field": "purl", "confidence": 0.7, "methods": [ { "technique": "manifest-analysis", "confidence": 0.7, "value": "node_modules/slugify/package.json" } ], "concludedValue": "node_modules/slugify/package.json" } ], "occurrences": [ { "location": "src/createFileTransform.ts", "line": 4 }, { "location": "src/createFileTransform.ts", "line": 29 } ] } }, { "authors": [ { "name": "Cedric van Putten " } ], "group": "", "name": "resolve-workspace-root", "version": "2.0.1", "description": "Resolve the workspace root using bun, npm, pnpm, or yarn", "scope": "required", "licenses": [ { "license": { "id": "MIT", "url": "https://opensource.org/licenses/MIT", "properties": [ { "name": "cdx:license:category", "value": "Permissive" }, { "name": "cdx:license:foss", "value": "true" }, { "name": "cdx:license:osiApproved", "value": "true" }, { "name": "cdx:license:fsfLibre", "value": "true" }, { "name": "cdx:license:deprecated", "value": "false" } ] } } ], "purl": "pkg:npm/resolve-workspace-root@2.0.1", "externalReferences": [ { "type": "vcs", "url": "https://github.com/byCedric/resolve-workspace-root#readme" }, { "type": "vcs", "url": "git+https://github.com/byCedric/resolve-workspace-root.git" } ], "type": "library", "bom-ref": "pkg:npm/resolve-workspace-root@2.0.1", "properties": [ { "name": "SrcFile", "value": "node_modules/resolve-workspace-root/package.json" }, { "name": "ImportedModules", "value": "resolve-workspace-root,getWorkspaceGlobsAsync,resolve-workspace-root/getWorkspaceGlobsAsync" }, { "name": "cdx:license:category", "value": "Permissive" } ], "evidence": { "identity": [ { "field": "purl", "confidence": 0.7, "methods": [ { "technique": "manifest-analysis", "confidence": 0.7, "value": "node_modules/resolve-workspace-root/package.json" } ], "concludedValue": "node_modules/resolve-workspace-root/package.json" } ], "occurrences": [ { "location": "src/configureWorkspaces.ts", "line": 3 }, { "location": "src/configureWorkspaces.ts", "line": 28 } ] } }, { "authors": [ { "name": "Terkel Gjervig (https://terkel.com)" } ], "group": "", "name": "prompts", "version": "2.4.2", "description": "Lightweight, beautiful and user-friendly prompts", "scope": "required", "licenses": [ { "license": { "id": "MIT", "url": "https://opensource.org/licenses/MIT", "properties": [ { "name": "cdx:license:category", "value": "Permissive" }, { "name": "cdx:license:foss", "value": "true" }, { "name": "cdx:license:osiApproved", "value": "true" }, { "name": "cdx:license:fsfLibre", "value": "true" }, { "name": "cdx:license:deprecated", "value": "false" } ] } } ], "purl": "pkg:npm/prompts@2.4.2", "type": "library", "bom-ref": "pkg:npm/prompts@2.4.2", "properties": [ { "name": "SrcFile", "value": "node_modules/prompts/package.json" }, { "name": "ImportedModules", "value": "prompts" }, { "name": "cdx:license:category", "value": "Permissive" } ], "evidence": { "identity": [ { "field": "purl", "confidence": 0.7, "methods": [ { "technique": "manifest-analysis", "confidence": 0.7, "value": "node_modules/prompts/package.json" } ], "concludedValue": "node_modules/prompts/package.json" } ], "occurrences": [ { "location": "src/Examples.ts", "line": 5 }, { "location": "src/Examples.ts", "line": 95 }, { "location": "src/legacyTemplates.ts", "line": 2 }, { "location": "src/legacyTemplates.ts", "line": 42 }, { "location": "src/promptSdkVersion.ts", "line": 2 }, { "location": "src/promptSdkVersion.ts", "line": 171 }, { "location": "src/promptSdkVersion.ts", "line": 188 }, { "location": "src/resolveProjectRoot.ts", "line": 4 }, { "location": "src/resolveProjectRoot.ts", "line": 42 }, { "location": "src/utils/git.ts", "line": 3 }, { "location": "src/utils/git.ts", "line": 54 } ] } }, { "authors": [ { "name": "Jon Schlinkert (https://github.com/jonschlinkert)" } ], "group": "", "name": "picomatch", "version": "2.3.2", "description": "Blazing fast and accurate glob matcher written in JavaScript, with no dependencies and full support for standard and extended Bash glob features, including braces, extglobs, POSIX brackets, and regular expressions.", "scope": "required", "licenses": [ { "license": { "id": "MIT", "url": "https://opensource.org/licenses/MIT", "properties": [ { "name": "cdx:license:category", "value": "Permissive" }, { "name": "cdx:license:foss", "value": "true" }, { "name": "cdx:license:osiApproved", "value": "true" }, { "name": "cdx:license:fsfLibre", "value": "true" }, { "name": "cdx:license:deprecated", "value": "false" } ] } } ], "purl": "pkg:npm/picomatch@2.3.2", "externalReferences": [ { "type": "vcs", "url": "https://github.com/micromatch/picomatch" } ], "type": "library", "bom-ref": "pkg:npm/picomatch@2.3.2", "properties": [ { "name": "SrcFile", "value": "node_modules/picomatch/package.json" }, { "name": "ImportedModules", "value": "picomatch" }, { "name": "cdx:license:category", "value": "Permissive" } ], "evidence": { "identity": [ { "field": "purl", "confidence": 0.7, "methods": [ { "technique": "manifest-analysis", "confidence": 0.7, "value": "node_modules/picomatch/package.json" } ], "concludedValue": "node_modules/picomatch/package.json" } ], "occurrences": [ { "location": "src/createFileTransform.ts", "line": 3 }, { "location": "src/createFileTransform.ts", "line": 83 } ] } }, { "authors": [ { "name": "Sindre Sorhus (sindresorhus.com)" } ], "group": "", "name": "ora", "version": "3.4.0", "description": "Elegant terminal spinner", "scope": "required", "licenses": [ { "license": { "id": "MIT", "url": "https://opensource.org/licenses/MIT", "properties": [ { "name": "cdx:license:category", "value": "Permissive" }, { "name": "cdx:license:foss", "value": "true" }, { "name": "cdx:license:osiApproved", "value": "true" }, { "name": "cdx:license:fsfLibre", "value": "true" }, { "name": "cdx:license:deprecated", "value": "false" } ] } } ], "purl": "pkg:npm/ora@3.4.0", "type": "library", "bom-ref": "pkg:npm/ora@3.4.0", "properties": [ { "name": "SrcFile", "value": "node_modules/ora/package.json" }, { "name": "ImportedModules", "value": "ora,ora/Ora" }, { "name": "cdx:license:category", "value": "Permissive" } ], "evidence": { "identity": [ { "field": "purl", "confidence": 0.7, "methods": [ { "technique": "manifest-analysis", "confidence": 0.7, "value": "node_modules/ora/package.json" } ], "concludedValue": "node_modules/ora/package.json" } ], "occurrences": [ { "location": "src/Template.ts", "line": 8 }, { "location": "src/Template.ts", "line": 577 }, { "location": "src/utils/log.ts", "line": 1 }, { "location": "src/utils/log.ts", "line": 2 }, { "location": "src/utils/log.ts", "line": 15 } ] } }, { "authors": [ { "name": "Pedro Teixeira " } ], "group": "", "name": "nock", "version": "14.0.11", "description": "HTTP server mocking and expectations library for Node.js", "scope": "optional", "licenses": [ { "license": { "id": "MIT", "url": "https://opensource.org/licenses/MIT", "properties": [ { "name": "cdx:license:category", "value": "Permissive" }, { "name": "cdx:license:foss", "value": "true" }, { "name": "cdx:license:osiApproved", "value": "true" }, { "name": "cdx:license:fsfLibre", "value": "true" }, { "name": "cdx:license:deprecated", "value": "false" } ] } } ], "purl": "pkg:npm/nock@14.0.11", "externalReferences": [ { "type": "vcs", "url": "https://github.com/nock/nock.git" } ], "type": "library", "bom-ref": "pkg:npm/nock@14.0.11", "properties": [ { "name": "SrcFile", "value": "node_modules/nock/package.json" }, { "name": "cdx:license:category", "value": "Permissive" } ], "evidence": { "identity": [ { "field": "purl", "confidence": 0.7, "methods": [ { "technique": "manifest-analysis", "confidence": 0.7, "value": "node_modules/nock/package.json" } ], "concludedValue": "node_modules/nock/package.json" } ] } }, { "authors": [ { "name": "Phil Pluckthun " } ], "group": "", "name": "multitars", "version": "1.0.2", "description": "Multipart and Tar utilities for the Web Streams API", "scope": "required", "licenses": [ { "license": { "id": "MIT", "url": "https://opensource.org/licenses/MIT", "properties": [ { "name": "cdx:license:category", "value": "Permissive" }, { "name": "cdx:license:foss", "value": "true" }, { "name": "cdx:license:osiApproved", "value": "true" }, { "name": "cdx:license:fsfLibre", "value": "true" }, { "name": "cdx:license:deprecated", "value": "false" } ] } } ], "purl": "pkg:npm/multitars@1.0.2", "type": "library", "bom-ref": "pkg:npm/multitars@1.0.2", "properties": [ { "name": "SrcFile", "value": "node_modules/multitars/package.json" }, { "name": "ImportedModules", "value": "multitars,TarTypeFlag,multitars/TarTypeFlag,streamToAsyncIterable,multitars/streamToAsyncIterable,untar,multitars/untar" }, { "name": "cdx:license:category", "value": "Permissive" } ], "evidence": { "identity": [ { "field": "purl", "confidence": 0.7, "methods": [ { "technique": "manifest-analysis", "confidence": 0.7, "value": "node_modules/multitars/package.json" } ], "concludedValue": "node_modules/multitars/package.json" } ], "occurrences": [ { "location": "src/createFileTransform.ts", "line": 1 }, { "location": "src/utils/tar.ts", "line": 4 }, { "location": "src/utils/tar.ts", "line": 54 }, { "location": "src/utils/tar.ts", "line": 100 } ] }, "tags": [ "web" ] }, { "group": "", "name": "memfs", "version": "3.6.0", "description": "In-memory file-system with Node's fs API.", "scope": "optional", "licenses": [ { "license": { "id": "Unlicense", "url": "https://opensource.org/licenses/Unlicense", "properties": [ { "name": "cdx:license:category", "value": "Public Domain" }, { "name": "cdx:license:foss", "value": "true" }, { "name": "cdx:license:osiApproved", "value": "true" }, { "name": "cdx:license:fsfLibre", "value": "true" }, { "name": "cdx:license:deprecated", "value": "false" } ] } } ], "purl": "pkg:npm/memfs@3.6.0", "externalReferences": [ { "type": "vcs", "url": "https://github.com/streamich/memfs.git" } ], "type": "library", "bom-ref": "pkg:npm/memfs@3.6.0", "properties": [ { "name": "SrcFile", "value": "node_modules/memfs/package.json" }, { "name": "cdx:license:category", "value": "Public Domain" } ], "evidence": { "identity": [ { "field": "purl", "confidence": 0.7, "methods": [ { "technique": "manifest-analysis", "confidence": 0.7, "value": "node_modules/memfs/package.json" } ], "concludedValue": "node_modules/memfs/package.json" } ] }, "tags": [ "api" ] }, { "authors": [ { "name": "Isaac Z. Schlueter (https://blog.izs.me/)" } ], "group": "", "name": "glob", "version": "13.0.6", "description": "the most correct and second fastest glob implementation in JavaScript", "scope": "required", "licenses": [ { "license": { "id": "BlueOak-1.0.0", "url": "https://opensource.org/licenses/BlueOak-1.0.0", "properties": [ { "name": "cdx:license:category", "value": "Permissive" }, { "name": "cdx:license:foss", "value": "true" }, { "name": "cdx:license:osiApproved", "value": "true" }, { "name": "cdx:license:fsfLibre", "value": "false" }, { "name": "cdx:license:deprecated", "value": "false" } ] } } ], "purl": "pkg:npm/glob@13.0.6", "type": "library", "bom-ref": "pkg:npm/glob@13.0.6", "properties": [ { "name": "SrcFile", "value": "node_modules/glob/package.json" }, { "name": "ImportedModules", "value": "glob,glob/glob" }, { "name": "cdx:license:category", "value": "Permissive" } ], "evidence": { "identity": [ { "field": "purl", "confidence": 0.7, "methods": [ { "technique": "manifest-analysis", "confidence": 0.7, "value": "node_modules/glob/package.json" } ], "concludedValue": "node_modules/glob/package.json" } ], "occurrences": [ { "location": "src/Template.ts", "line": 7 }, { "location": "src/Template.ts", "line": 294 } ] } }, { "authors": [ { "name": "Christoph Tavan " } ], "group": "", "name": "getenv", "version": "2.0.0", "description": "Get and typecast environment variables.", "scope": "required", "licenses": [ { "license": { "id": "MIT", "url": "https://opensource.org/licenses/MIT", "properties": [ { "name": "cdx:license:category", "value": "Permissive" }, { "name": "cdx:license:foss", "value": "true" }, { "name": "cdx:license:osiApproved", "value": "true" }, { "name": "cdx:license:fsfLibre", "value": "true" }, { "name": "cdx:license:deprecated", "value": "false" } ] } } ], "purl": "pkg:npm/getenv@2.0.0", "externalReferences": [ { "type": "vcs", "url": "https://github.com/ctavan/node-getenv" }, { "type": "vcs", "url": "git://github.com/ctavan/node-getenv.git" } ], "type": "library", "bom-ref": "pkg:npm/getenv@2.0.0", "properties": [ { "name": "SrcFile", "value": "node_modules/getenv/package.json" }, { "name": "ImportedModules", "value": "getenv,boolish,getenv/boolish" }, { "name": "cdx:license:category", "value": "Permissive" } ], "evidence": { "identity": [ { "field": "purl", "confidence": 0.7, "methods": [ { "technique": "manifest-analysis", "confidence": 0.7, "value": "node_modules/getenv/package.json" } ], "concludedValue": "node_modules/getenv/package.json" } ], "occurrences": [ { "location": "src/index.ts", "line": 3 }, { "location": "src/index.ts", "line": 11 }, { "location": "src/utils/env.ts", "line": 1 }, { "location": "src/utils/env.ts", "line": 6 }, { "location": "src/utils/env.ts", "line": 10 }, { "location": "src/utils/env.ts", "line": 14 }, { "location": "src/utils/env.ts", "line": 18 }, { "location": "src/utils/env.ts", "line": 22 } ] } }, { "authors": [ { "name": "Expo" } ], "group": "", "name": "expo-module-scripts", "version": "56.0.4", "description": "A private package for various tasks for Expo module packages like compiling and testing", "scope": "required", "licenses": [ { "license": { "id": "MIT", "url": "https://opensource.org/licenses/MIT", "properties": [ { "name": "cdx:license:category", "value": "Permissive" }, { "name": "cdx:license:foss", "value": "true" }, { "name": "cdx:license:osiApproved", "value": "true" }, { "name": "cdx:license:fsfLibre", "value": "true" }, { "name": "cdx:license:deprecated", "value": "false" } ] } } ], "purl": "pkg:npm/expo-module-scripts@56.0.4", "externalReferences": [ { "type": "vcs", "url": "https://github.com/expo/expo/tree/main/packages/expo-module-scripts#readme" }, { "type": "vcs", "url": "git+https://github.com/expo/expo.git" } ], "type": "library", "bom-ref": "pkg:npm/expo-module-scripts@56.0.4", "properties": [ { "name": "SrcFile", "value": "node_modules/expo-module-scripts/package.json" }, { "name": "ExportedModules", "value": "expo-module-scripts/oxlint.config.base" }, { "name": "ImportedModules", "value": "expo-module-scripts/oxlint.config.base" }, { "name": "cdx:license:category", "value": "Permissive" } ], "evidence": { "identity": [ { "field": "purl", "confidence": 0.7, "methods": [ { "technique": "manifest-analysis", "confidence": 0.7, "value": "node_modules/expo-module-scripts/package.json" } ], "concludedValue": "node_modules/expo-module-scripts/package.json" } ], "occurrences": [ { "location": "oxlint.config.mjs", "line": 2 } ] } }, { "authors": [ { "name": "Josh Junon (https://github.com/qix-)" } ], "group": "", "name": "debug", "version": "4.4.3", "description": "Lightweight debugging utility for Node.js and the browser", "scope": "required", "licenses": [ { "license": { "id": "MIT", "url": "https://opensource.org/licenses/MIT", "properties": [ { "name": "cdx:license:category", "value": "Permissive" }, { "name": "cdx:license:foss", "value": "true" }, { "name": "cdx:license:osiApproved", "value": "true" }, { "name": "cdx:license:fsfLibre", "value": "true" }, { "name": "cdx:license:deprecated", "value": "false" } ] } } ], "purl": "pkg:npm/debug@4.4.3", "externalReferences": [ { "type": "vcs", "url": "git://github.com/debug-js/debug.git" } ], "type": "library", "bom-ref": "pkg:npm/debug@4.4.3", "properties": [ { "name": "SrcFile", "value": "node_modules/debug/package.json" }, { "name": "ImportedModules", "value": "debug" }, { "name": "cdx:license:category", "value": "Permissive" } ], "evidence": { "identity": [ { "field": "purl", "confidence": 0.7, "methods": [ { "technique": "manifest-analysis", "confidence": 0.7, "value": "node_modules/debug/package.json" } ], "concludedValue": "node_modules/debug/package.json" } ], "occurrences": [ { "location": "src/Examples.ts", "line": 17 }, { "location": "src/Template.ts", "line": 25 }, { "location": "src/cli.ts", "line": 11 }, { "location": "src/configureWorkspaces.ts", "line": 7 }, { "location": "src/createAsync.ts", "line": 44 }, { "location": "src/createFileTransform.ts", "line": 6 }, { "location": "src/index.ts", "line": 2 }, { "location": "src/index.ts", "line": 12 }, { "location": "src/index.ts", "line": 13 }, { "location": "src/promptSdkVersion.ts", "line": 10 }, { "location": "src/resolvePackageManager.ts", "line": 8 }, { "location": "src/utils/git.ts", "line": 8 }, { "location": "src/utils/github.ts", "line": 8 }, { "location": "src/utils/npm.ts", "line": 13 }, { "location": "src/utils/tar.ts", "line": 11 }, { "location": "src/utils/update-check.ts", "line": 14 } ] } }, { "group": "", "name": "chalk", "version": "4.1.2", "description": "Terminal string styling done right", "scope": "required", "licenses": [ { "license": { "id": "MIT", "url": "https://opensource.org/licenses/MIT", "properties": [ { "name": "cdx:license:category", "value": "Permissive" }, { "name": "cdx:license:foss", "value": "true" }, { "name": "cdx:license:osiApproved", "value": "true" }, { "name": "cdx:license:fsfLibre", "value": "true" }, { "name": "cdx:license:deprecated", "value": "false" } ] } } ], "purl": "pkg:npm/chalk@4.1.2", "type": "library", "bom-ref": "pkg:npm/chalk@4.1.2", "properties": [ { "name": "SrcFile", "value": "node_modules/chalk/package.json" }, { "name": "ImportedModules", "value": "chalk" }, { "name": "cdx:license:category", "value": "Permissive" } ], "evidence": { "identity": [ { "field": "purl", "confidence": 0.7, "methods": [ { "technique": "manifest-analysis", "confidence": 0.7, "value": "node_modules/chalk/package.json" } ], "concludedValue": "node_modules/chalk/package.json" } ], "occurrences": [ { "location": "src/Examples.ts", "line": 2 }, { "location": "src/Template.ts", "line": 5 }, { "location": "src/Template.ts", "line": 498 }, { "location": "src/Template.ts", "line": 507 }, { "location": "src/Template.ts", "line": 513 }, { "location": "src/Template.ts", "line": 520 }, { "location": "src/Template.ts", "line": 522 }, { "location": "src/Template.ts", "line": 546 }, { "location": "src/Template.ts", "line": 564 }, { "location": "src/Template.ts", "line": 578 }, { "location": "src/cli.ts", "line": 3 }, { "location": "src/createAsync.ts", "line": 2 }, { "location": "src/createAsync.ts", "line": 143 }, { "location": "src/createAsync.ts", "line": 237 }, { "location": "src/legacyTemplates.ts", "line": 1 }, { "location": "src/log.ts", "line": 1 }, { "location": "src/log.ts", "line": 12 }, { "location": "src/promptSdkVersion.ts", "line": 1 }, { "location": "src/promptSdkVersion.ts", "line": 133 }, { "location": "src/promptSdkVersion.ts", "line": 207 }, { "location": "src/promptSdkVersion.ts", "line": 212 }, { "location": "src/promptSdkVersion.ts", "line": 214 }, { "location": "src/promptSdkVersion.ts", "line": 217 }, { "location": "src/resolveProjectRoot.ts", "line": 1 }, { "location": "src/utils/args.ts", "line": 5 }, { "location": "src/utils/git.ts", "line": 2 }, { "location": "src/utils/git.ts", "line": 41 }, { "location": "src/utils/git.ts", "line": 49 }, { "location": "src/utils/git.ts", "line": 64 }, { "location": "src/utils/git.ts", "line": 68 }, { "location": "src/utils/git.ts", "line": 84 }, { "location": "src/utils/update-check.ts", "line": 1 } ] } }, { "authors": [ { "name": "Josh Junon " } ], "group": "", "name": "arg", "version": "5.0.2", "description": "Unopinionated, no-frills CLI argument parser", "scope": "required", "licenses": [ { "license": { "id": "MIT", "url": "https://opensource.org/licenses/MIT", "properties": [ { "name": "cdx:license:category", "value": "Permissive" }, { "name": "cdx:license:foss", "value": "true" }, { "name": "cdx:license:osiApproved", "value": "true" }, { "name": "cdx:license:fsfLibre", "value": "true" }, { "name": "cdx:license:deprecated", "value": "false" } ] } } ], "purl": "pkg:npm/arg@5.0.2", "type": "library", "bom-ref": "pkg:npm/arg@5.0.2", "properties": [ { "name": "SrcFile", "value": "node_modules/arg/package.json" }, { "name": "ImportedModules", "value": "arg,Spec,arg/Spec" }, { "name": "cdx:license:category", "value": "Permissive" } ], "evidence": { "identity": [ { "field": "purl", "confidence": 0.7, "methods": [ { "technique": "manifest-analysis", "confidence": 0.7, "value": "node_modules/arg/package.json" } ], "concludedValue": "node_modules/arg/package.json" } ], "occurrences": [ { "location": "src/cli.ts", "line": 2 }, { "location": "src/utils/args.ts", "line": 3 }, { "location": "src/utils/args.ts", "line": 4 }, { "location": "src/utils/args.ts", "line": 22 }, { "location": "src/utils/args.ts", "line": 138 } ] }, "tags": [ "cli" ] }, { "group": "@vercel", "name": "ncc", "version": "0.38.4", "description": "Simple CLI for compiling a Node.js module into a single file, together with all its dependencies, gcc-style.", "scope": "optional", "licenses": [ { "license": { "id": "MIT", "url": "https://opensource.org/licenses/MIT", "properties": [ { "name": "cdx:license:category", "value": "Permissive" }, { "name": "cdx:license:foss", "value": "true" }, { "name": "cdx:license:osiApproved", "value": "true" }, { "name": "cdx:license:fsfLibre", "value": "true" }, { "name": "cdx:license:deprecated", "value": "false" } ] } } ], "purl": "pkg:npm/%40vercel/ncc@0.38.4", "type": "library", "bom-ref": "pkg:npm/@vercel/ncc@0.38.4", "properties": [ { "name": "SrcFile", "value": "node_modules/@vercel/ncc/package.json" }, { "name": "cdx:license:category", "value": "Permissive" } ], "evidence": { "identity": [ { "field": "purl", "confidence": 0.7, "methods": [ { "technique": "manifest-analysis", "confidence": 0.7, "value": "node_modules/@vercel/ncc/package.json" } ], "concludedValue": "node_modules/@vercel/ncc/package.json" } ] }, "tags": [ "cli" ] }, { "group": "@types", "name": "prompts", "version": "2.0.14", "description": "TypeScript definitions for prompts", "scope": "required", "licenses": [ { "license": { "id": "MIT", "url": "https://opensource.org/licenses/MIT", "properties": [ { "name": "cdx:license:category", "value": "Permissive" }, { "name": "cdx:license:foss", "value": "true" }, { "name": "cdx:license:osiApproved", "value": "true" }, { "name": "cdx:license:fsfLibre", "value": "true" }, { "name": "cdx:license:deprecated", "value": "false" } ] } } ], "purl": "pkg:npm/%40types/prompts@2.0.14", "externalReferences": [ { "type": "vcs", "url": "https://github.com/DefinitelyTyped/DefinitelyTyped/tree/master/types/prompts" }, { "type": "vcs", "url": "https://github.com/DefinitelyTyped/DefinitelyTyped.git" } ], "type": "library", "bom-ref": "pkg:npm/@types/prompts@2.0.14", "properties": [ { "name": "SrcFile", "value": "node_modules/@types/prompts/package.json" }, { "name": "cdx:license:category", "value": "Permissive" } ], "evidence": { "identity": [ { "field": "purl", "confidence": 0.7, "methods": [ { "technique": "manifest-analysis", "confidence": 0.7, "value": "node_modules/@types/prompts/package.json" } ], "concludedValue": "node_modules/@types/prompts/package.json" } ] } }, { "group": "@types", "name": "picomatch", "version": "2.3.4", "description": "TypeScript definitions for picomatch", "scope": "required", "licenses": [ { "license": { "id": "MIT", "url": "https://opensource.org/licenses/MIT", "properties": [ { "name": "cdx:license:category", "value": "Permissive" }, { "name": "cdx:license:foss", "value": "true" }, { "name": "cdx:license:osiApproved", "value": "true" }, { "name": "cdx:license:fsfLibre", "value": "true" }, { "name": "cdx:license:deprecated", "value": "false" } ] } } ], "purl": "pkg:npm/%40types/picomatch@2.3.4", "externalReferences": [ { "type": "vcs", "url": "https://github.com/DefinitelyTyped/DefinitelyTyped/tree/master/types/picomatch" }, { "type": "vcs", "url": "https://github.com/DefinitelyTyped/DefinitelyTyped.git" } ], "type": "library", "bom-ref": "pkg:npm/@types/picomatch@2.3.4", "properties": [ { "name": "SrcFile", "value": "node_modules/@types/picomatch/package.json" }, { "name": "cdx:license:category", "value": "Permissive" } ], "evidence": { "identity": [ { "field": "purl", "confidence": 0.7, "methods": [ { "technique": "manifest-analysis", "confidence": 0.7, "value": "node_modules/@types/picomatch/package.json" } ], "concludedValue": "node_modules/@types/picomatch/package.json" } ] } }, { "group": "@types", "name": "node", "version": "22.20.1", "description": "TypeScript definitions for node", "scope": "excluded", "licenses": [ { "license": { "id": "MIT", "url": "https://opensource.org/licenses/MIT", "properties": [ { "name": "cdx:license:category", "value": "Permissive" }, { "name": "cdx:license:foss", "value": "true" }, { "name": "cdx:license:osiApproved", "value": "true" }, { "name": "cdx:license:fsfLibre", "value": "true" }, { "name": "cdx:license:deprecated", "value": "false" } ] } } ], "purl": "pkg:npm/%40types/node@22.20.1", "externalReferences": [ { "type": "vcs", "url": "https://github.com/DefinitelyTyped/DefinitelyTyped/tree/master/types/node" }, { "type": "vcs", "url": "https://github.com/DefinitelyTyped/DefinitelyTyped.git" } ], "type": "library", "bom-ref": "pkg:npm/@types/node@22.20.1", "properties": [ { "name": "SrcFile", "value": "node_modules/@types/node/package.json" }, { "name": "cdx:license:category", "value": "Permissive" } ], "evidence": { "identity": [ { "field": "purl", "confidence": 0.7, "methods": [ { "technique": "manifest-analysis", "confidence": 0.7, "value": "node_modules/@types/node/package.json" } ], "concludedValue": "node_modules/@types/node/package.json" } ] } }, { "group": "@types", "name": "getenv", "version": "1.0.3", "description": "TypeScript definitions for getenv", "scope": "required", "licenses": [ { "license": { "id": "MIT", "url": "https://opensource.org/licenses/MIT", "properties": [ { "name": "cdx:license:category", "value": "Permissive" }, { "name": "cdx:license:foss", "value": "true" }, { "name": "cdx:license:osiApproved", "value": "true" }, { "name": "cdx:license:fsfLibre", "value": "true" }, { "name": "cdx:license:deprecated", "value": "false" } ] } } ], "purl": "pkg:npm/%40types/getenv@1.0.3", "externalReferences": [ { "type": "vcs", "url": "https://github.com/DefinitelyTyped/DefinitelyTyped/tree/master/types/getenv" }, { "type": "vcs", "url": "https://github.com/DefinitelyTyped/DefinitelyTyped.git" } ], "type": "library", "bom-ref": "pkg:npm/@types/getenv@1.0.3", "properties": [ { "name": "SrcFile", "value": "node_modules/@types/getenv/package.json" }, { "name": "cdx:license:category", "value": "Permissive" } ], "evidence": { "identity": [ { "field": "purl", "confidence": 0.7, "methods": [ { "technique": "manifest-analysis", "confidence": 0.7, "value": "node_modules/@types/getenv/package.json" } ], "concludedValue": "node_modules/@types/getenv/package.json" } ] } }, { "group": "@types", "name": "debug", "version": "4.1.12", "description": "TypeScript definitions for debug", "scope": "required", "licenses": [ { "license": { "id": "MIT", "url": "https://opensource.org/licenses/MIT", "properties": [ { "name": "cdx:license:category", "value": "Permissive" }, { "name": "cdx:license:foss", "value": "true" }, { "name": "cdx:license:osiApproved", "value": "true" }, { "name": "cdx:license:fsfLibre", "value": "true" }, { "name": "cdx:license:deprecated", "value": "false" } ] } } ], "purl": "pkg:npm/%40types/debug@4.1.12", "externalReferences": [ { "type": "vcs", "url": "https://github.com/DefinitelyTyped/DefinitelyTyped/tree/master/types/debug" }, { "type": "vcs", "url": "https://github.com/DefinitelyTyped/DefinitelyTyped.git" } ], "type": "library", "bom-ref": "pkg:npm/@types/debug@4.1.12", "properties": [ { "name": "SrcFile", "value": "node_modules/@types/debug/package.json" }, { "name": "cdx:license:category", "value": "Permissive" } ], "evidence": { "identity": [ { "field": "purl", "confidence": 0.7, "methods": [ { "technique": "manifest-analysis", "confidence": 0.7, "value": "node_modules/@types/debug/package.json" } ], "concludedValue": "node_modules/@types/debug/package.json" } ] } }, { "authors": [ { "name": "Gregor Martynus (https://twitter.com/gr2m)" } ], "group": "@octokit", "name": "types", "version": "13.10.0", "description": "Shared TypeScript definitions for Octokit projects", "scope": "excluded", "licenses": [ { "license": { "id": "MIT", "url": "https://opensource.org/licenses/MIT", "properties": [ { "name": "cdx:license:category", "value": "Permissive" }, { "name": "cdx:license:foss", "value": "true" }, { "name": "cdx:license:osiApproved", "value": "true" }, { "name": "cdx:license:fsfLibre", "value": "true" }, { "name": "cdx:license:deprecated", "value": "false" } ] } } ], "purl": "pkg:npm/%40octokit/types@13.10.0", "type": "library", "bom-ref": "pkg:npm/@octokit/types@13.10.0", "properties": [ { "name": "SrcFile", "value": "node_modules/@octokit/types/package.json" }, { "name": "ImportedModules", "value": "@octokit/types,Endpoints,@octokit/types/Endpoints" }, { "name": "cdx:npm:package:type-only", "value": "true" }, { "name": "cdx:license:category", "value": "Permissive" } ], "evidence": { "identity": [ { "field": "purl", "confidence": 0.7, "methods": [ { "technique": "manifest-analysis", "confidence": 0.7, "value": "node_modules/@octokit/types/package.json" } ], "concludedValue": "node_modules/@octokit/types/package.json" } ], "occurrences": [ { "location": "src/utils/github.ts", "line": 1 } ] } }, { "authors": [ { "name": "Expo" } ], "group": "@expo", "name": "spawn-async", "version": "1.8.0", "description": "A Promise-based interface into processes created by child_process.spawn", "scope": "required", "licenses": [ { "license": { "id": "MIT", "url": "https://opensource.org/licenses/MIT", "properties": [ { "name": "cdx:license:category", "value": "Permissive" }, { "name": "cdx:license:foss", "value": "true" }, { "name": "cdx:license:osiApproved", "value": "true" }, { "name": "cdx:license:fsfLibre", "value": "true" }, { "name": "cdx:license:deprecated", "value": "false" } ] } } ], "purl": "pkg:npm/%40expo/spawn-async@1.8.0", "externalReferences": [ { "type": "vcs", "url": "https://github.com/expo/spawn-async#readme" }, { "type": "vcs", "url": "git+https://github.com/expo/spawn-async.git" } ], "type": "library", "bom-ref": "pkg:npm/@expo/spawn-async@1.8.0", "properties": [ { "name": "SrcFile", "value": "node_modules/@expo/spawn-async/package.json" }, { "name": "ImportedModules", "value": "@expo/spawn-async" }, { "name": "cdx:license:category", "value": "Permissive" } ], "evidence": { "identity": [ { "field": "purl", "confidence": 0.7, "methods": [ { "technique": "manifest-analysis", "confidence": 0.7, "value": "node_modules/@expo/spawn-async/package.json" } ], "concludedValue": "node_modules/@expo/spawn-async/package.json" } ], "occurrences": [ { "location": "src/utils/git.ts", "line": 1 }, { "location": "src/utils/git.ts", "line": 21 }, { "location": "src/utils/git.ts", "line": 31 }, { "location": "src/utils/git.ts", "line": 75 }, { "location": "src/utils/git.ts", "line": 76 }, { "location": "src/utils/git.ts", "line": 79 }, { "location": "src/utils/npm.ts", "line": 1 }, { "location": "src/utils/npm.ts", "line": 149 } ] } }, { "group": "@expo", "name": "package-manager", "version": "1.14.1", "description": "A library for installing and finding packages in a project", "scope": "required", "licenses": [ { "license": { "id": "MIT", "url": "https://opensource.org/licenses/MIT", "properties": [ { "name": "cdx:license:category", "value": "Permissive" }, { "name": "cdx:license:foss", "value": "true" }, { "name": "cdx:license:osiApproved", "value": "true" }, { "name": "cdx:license:fsfLibre", "value": "true" }, { "name": "cdx:license:deprecated", "value": "false" } ] } } ], "purl": "pkg:npm/%40expo/package-manager@1.14.1", "externalReferences": [ { "type": "vcs", "url": "https://github.com/expo/expo/tree/main/packages/@expo/package-manager#readme" }, { "type": "vcs", "url": "https://github.com/expo/expo.git" } ], "type": "library", "bom-ref": "pkg:npm/@expo/package-manager@1.14.1", "properties": [ { "name": "SrcFile", "value": "node_modules/@expo/package-manager/package.json" }, { "name": "ImportedModules", "value": "@expo/package-manager" }, { "name": "cdx:license:category", "value": "Permissive" } ], "evidence": { "identity": [ { "field": "purl", "confidence": 0.7, "methods": [ { "technique": "manifest-analysis", "confidence": 0.7, "value": "node_modules/@expo/package-manager/package.json" } ], "concludedValue": "node_modules/@expo/package-manager/package.json" } ], "occurrences": [ { "location": "src/Template.ts", "line": 4 }, { "location": "src/resolvePackageManager.ts", "line": 1 } ] } }, { "group": "@expo", "name": "json-file", "version": "11.2.1", "description": "A module for reading, writing, and manipulating JSON files", "scope": "required", "licenses": [ { "license": { "id": "MIT", "url": "https://opensource.org/licenses/MIT", "properties": [ { "name": "cdx:license:category", "value": "Permissive" }, { "name": "cdx:license:foss", "value": "true" }, { "name": "cdx:license:osiApproved", "value": "true" }, { "name": "cdx:license:fsfLibre", "value": "true" }, { "name": "cdx:license:deprecated", "value": "false" } ] } } ], "purl": "pkg:npm/%40expo/json-file@11.2.1", "externalReferences": [ { "type": "vcs", "url": "https://github.com/expo/expo/tree/main/packages/@expo/json-file#readme" }, { "type": "vcs", "url": "https://github.com/expo/expo.git" } ], "type": "library", "bom-ref": "pkg:npm/@expo/json-file@11.2.1", "properties": [ { "name": "SrcFile", "value": "node_modules/@expo/json-file/package.json" }, { "name": "ImportedModules", "value": "@expo/json-file,JSONObject,@expo/json-file/JSONObject" }, { "name": "cdx:license:category", "value": "Permissive" } ], "evidence": { "identity": [ { "field": "purl", "confidence": 0.7, "methods": [ { "technique": "manifest-analysis", "confidence": 0.7, "value": "node_modules/@expo/json-file/package.json" } ], "concludedValue": "node_modules/@expo/json-file/package.json" } ], "occurrences": [ { "location": "src/Examples.ts", "line": 1 }, { "location": "src/Template.ts", "line": 2 }, { "location": "src/Template.ts", "line": 3 }, { "location": "src/sessionStorage.ts", "line": 1 }, { "location": "src/sessionStorage.ts", "line": 22 }, { "location": "src/telemetry.ts", "line": 1 }, { "location": "src/telemetry.ts", "line": 220 }, { "location": "src/telemetry.ts", "line": 228 } ] }, "tags": [ "json" ] }, { "group": "@expo", "name": "config", "version": "58.0.1", "description": "A library for interacting with the app.json", "scope": "excluded", "licenses": [ { "license": { "id": "MIT", "url": "https://opensource.org/licenses/MIT", "properties": [ { "name": "cdx:license:category", "value": "Permissive" }, { "name": "cdx:license:foss", "value": "true" }, { "name": "cdx:license:osiApproved", "value": "true" }, { "name": "cdx:license:fsfLibre", "value": "true" }, { "name": "cdx:license:deprecated", "value": "false" } ] } } ], "purl": "pkg:npm/%40expo/config@58.0.1", "externalReferences": [ { "type": "vcs", "url": "https://github.com/expo/expo/tree/main/packages/@expo/config#readme" }, { "type": "vcs", "url": "https://github.com/expo/expo.git" } ], "type": "library", "bom-ref": "pkg:npm/@expo/config@58.0.1", "properties": [ { "name": "SrcFile", "value": "node_modules/@expo/config/package.json" }, { "name": "ImportedModules", "value": "@expo/config,ExpoConfig,@expo/config/ExpoConfig" }, { "name": "cdx:npm:package:type-only", "value": "true" }, { "name": "cdx:license:category", "value": "Permissive" } ], "evidence": { "identity": [ { "field": "purl", "confidence": 0.7, "methods": [ { "technique": "manifest-analysis", "confidence": 0.7, "value": "node_modules/@expo/config/package.json" } ], "concludedValue": "node_modules/@expo/config/package.json" } ], "occurrences": [ { "location": "src/Template.ts", "line": 1 } ] } } ], "dependencies": [], "annotations": [ { "bom-ref": "metadata-annotations", "subjects": [ "pkg:npm/create-expo@5.1.4" ], "annotator": { "component": { "group": "@cyclonedx", "name": "cdxgen", "version": "12.8.5", "purl": "pkg:npm/%40cyclonedx/cdxgen@12.8.5", "type": "application", "bom-ref": "pkg:npm/@cyclonedx/cdxgen@12.8.5", "publisher": "OWASP Foundation", "authors": [ { "name": "OWASP Foundation" } ] } }, "timestamp": "2026-09-29T16:22:10Z", "text": "This Software Bill-of-Materials (SBOM) document was created on Tuesday, September 29, 2026 with cdxgen. The data was captured during the pre-build lifecycle phase without building the application. The document describes an application named 'create-expo' with version '5.1.4'. The package type in this SBOM is npm with 4 purl namespaces described under components. The components were identified from 26 source files." } ] }