I guess we shouldn't trust `.bower.json`