# Third-party software notices

This inventory is generated by `node scripts/generate-third-party-notices.mjs` from the exact `package-lock.json` and the license/NOTICE files available after `npm ci`. It records **43 locked packages**, **16 installed packages**, and **27 uninstalled optional platform packages** for this audit. Installed package versions must match the lockfile; the script fails if they differ. Run it again after dependency updates and review the resulting changes.

## Scope and distribution

- Every currently locked npm package is a development, testing, PDF-authoring or image-encoding dependency. The browser reader imports only this project's local JavaScript modules; it does not bundle these npm packages into the website.
- `node_modules/`, downloaded browser binaries, native Sharp/libvips binaries, local Python packages, Node.js, npm, Git, Chrome/Edge and temporary authoring runtimes are not committed to this repository or copied into `dist/`. They retain their own upstream terms and are obtained separately when needed.
- This file covers software dependencies only. Teaching texts, translations, fonts, generated artwork, PDFs, and source attributions are governed by their own notices in `LICENSE.md`, the website license page and the relevant asset/content directories. The project MIT license does not replace third-party licenses.
- Using an authoring tool does not itself make a generated image or PDF a copy of that tool's program. Output rights still depend on the teaching text, font and artwork incorporated into the output.
- If you redistribute installed tools, a container, an installer, a browser, or native binaries, preserve their complete upstream notices and fulfill applicable redistribution/source/relinking obligations. This source inventory is not a substitute for a binary distribution compliance review.

## Installed package licenses and preserved notices

The linked files are exact copies, including copyright and warranty text. SHA-256 checksums and original paths are recorded in [the manifest](licenses/dependencies/manifest.json).

| Package | Locked version | Declared license | Role | Primary upstream/package sources | Copied license and notice files |
| --- | --- | --- | --- | --- | --- |
| `@img/colour` | 1.1.0 | MIT | Transitive tool | [Upstream](https://github.com/lovell/colour) · [package](https://www.npmjs.com/package/@img/colour/v/1.1.0) | [LICENSE.md](licenses/dependencies/img--colour-1.1.0/LICENSE.md) |
| `@img/sharp-win32-x64` | 0.35.5 | Apache-2.0 AND LGPL-3.0-or-later | Optional native tool | [Upstream](https://github.com/lovell/sharp) · [package](https://www.npmjs.com/package/@img/sharp-win32-x64/v/0.35.5) | [LICENSE](licenses/dependencies/img--sharp-win32-x64-0.35.5/LICENSE), [README.md](licenses/dependencies/img--sharp-win32-x64-0.35.5/README.md), [versions.json](licenses/dependencies/img--sharp-win32-x64-0.35.5/versions.json) |
| `@types/node` | 26.6.6 | MIT | Transitive tool | [Upstream](https://github.com/DefinitelyTyped/DefinitelyTyped) · [package](https://www.npmjs.com/package/@types/node/v/26.6.6) | [LICENSE](licenses/dependencies/types--node-26.6.6/LICENSE) |
| `@types/whatwg-mimetype` | 3.0.2 | MIT | Transitive tool | [Upstream](https://github.com/DefinitelyTyped/DefinitelyTyped) · [package](https://www.npmjs.com/package/@types/whatwg-mimetype/v/3.0.2) | [LICENSE](licenses/dependencies/types--whatwg-mimetype-3.0.2/LICENSE) |
| `@types/ws` | 8.18.2 | MIT | Transitive tool | [Upstream](https://github.com/DefinitelyTyped/DefinitelyTyped) · [package](https://www.npmjs.com/package/@types/ws/v/8.18.2) | [LICENSE](licenses/dependencies/types--ws-8.18.2/LICENSE) |
| `buffer-image-size` | 0.6.4 | MIT | Transitive tool | [Upstream](https://github.com/evidentpoint/buffer-image-size) · [package](https://www.npmjs.com/package/buffer-image-size/v/0.6.4) | [LICENSE](licenses/dependencies/buffer-image-size-0.6.4/LICENSE) |
| `detect-libc` | 2.1.2 | Apache-2.0 | Transitive tool | [Upstream](https://github.com/lovell/detect-libc) · [package](https://www.npmjs.com/package/detect-libc/v/2.1.2) | [LICENSE](licenses/dependencies/detect-libc-2.1.2/LICENSE) |
| `entities` | 7.0.1 | BSD-2-Clause | Transitive tool | [Upstream](https://github.com/fb55/entities) · [package](https://www.npmjs.com/package/entities/v/7.0.1) | [LICENSE](licenses/dependencies/entities-7.0.1/LICENSE) |
| `happy-dom` | 21.0.4 | MIT | Direct tool | [Upstream](https://github.com/capricorn86/happy-dom) · [package](https://www.npmjs.com/package/happy-dom/v/21.0.4) | [LICENSE](licenses/dependencies/happy-dom-21.0.4/LICENSE) |
| `playwright` | 1.64.1 | Apache-2.0 | Direct tool | [Upstream](https://github.com/microsoft/playwright) · [package](https://www.npmjs.com/package/playwright/v/1.64.1) | [LICENSE](licenses/dependencies/playwright-1.64.1/LICENSE), [NOTICE](licenses/dependencies/playwright-1.64.1/NOTICE), [expect.js.LICENSE](licenses/dependencies/playwright-1.64.1/lib/matchers/expect.js.LICENSE), [babelBundle.js.LICENSE](licenses/dependencies/playwright-1.64.1/lib/transform/babelBundle.js.LICENSE), [esmLoader.js.LICENSE](licenses/dependencies/playwright-1.64.1/lib/transform/esmLoader.js.LICENSE) |
| `playwright-core` | 1.64.1 | Apache-2.0 | Transitive tool | [Upstream](https://github.com/microsoft/playwright) · [package](https://www.npmjs.com/package/playwright-core/v/1.64.1) | [LICENSE](licenses/dependencies/playwright-core-1.64.1/LICENSE), [NOTICE](licenses/dependencies/playwright-core-1.64.1/NOTICE), [serverRegistry.js.LICENSE](licenses/dependencies/playwright-core-1.64.1/lib/serverRegistry.js.LICENSE), [utilsBundle.js.LICENSE](licenses/dependencies/playwright-core-1.64.1/lib/utilsBundle.js.LICENSE), [webp_codec.LICENSE](licenses/dependencies/playwright-core-1.64.1/lib/webp_codec.LICENSE) |
| `semver` | 7.8.5 | ISC | Transitive tool | [Upstream](https://github.com/npm/node-semver) · [package](https://www.npmjs.com/package/semver/v/7.8.5) | [LICENSE](licenses/dependencies/semver-7.8.5/LICENSE) |
| `sharp` | 0.35.5 | Apache-2.0 | Direct tool | [Upstream](https://github.com/lovell/sharp) · [package](https://www.npmjs.com/package/sharp/v/0.35.5) | [LICENSE](licenses/dependencies/sharp-0.35.5/LICENSE) |
| `undici-types` | 8.9.0 | MIT | Transitive tool | [Upstream](https://github.com/nodejs/undici) · [package](https://www.npmjs.com/package/undici-types/v/8.9.0) | [LICENSE](licenses/dependencies/undici-types-8.9.0/LICENSE) |
| `whatwg-mimetype` | 3.0.0 | MIT | Transitive tool | [Upstream](https://github.com/jsdom/whatwg-mimetype) · [package](https://www.npmjs.com/package/whatwg-mimetype/v/3.0.0) | [LICENSE.txt](licenses/dependencies/whatwg-mimetype-3.0.0/LICENSE.txt) |
| `ws` | 8.22.0 | MIT | Transitive tool | [Upstream](https://github.com/websockets/ws) · [package](https://www.npmjs.com/package/ws/v/8.22.0) | [LICENSE](licenses/dependencies/ws-8.22.0/LICENSE) |

## Bundled dependencies inside Playwright

Some packages are bundled inside Playwright rather than appearing separately in the npm lock. Their complete package lists, versions, copyrights and license text are preserved in these upstream bundle notices. The Apache-2.0 label for Playwright must not be mistaken for a license replacement for these components. The root Playwright NOTICE also retains the Microsoft/Puppeteer attribution.

| Package | Complete bundled-component notices |
| --- | --- |
| `playwright` | [playwright/lib/matchers/expect.js.LICENSE](licenses/dependencies/playwright-1.64.1/lib/matchers/expect.js.LICENSE) |
| `playwright` | [playwright/lib/transform/babelBundle.js.LICENSE](licenses/dependencies/playwright-1.64.1/lib/transform/babelBundle.js.LICENSE) |
| `playwright` | [playwright/lib/transform/esmLoader.js.LICENSE](licenses/dependencies/playwright-1.64.1/lib/transform/esmLoader.js.LICENSE) |
| `playwright-core` | [playwright-core/lib/serverRegistry.js.LICENSE](licenses/dependencies/playwright-core-1.64.1/lib/serverRegistry.js.LICENSE) |
| `playwright-core` | [playwright-core/lib/utilsBundle.js.LICENSE](licenses/dependencies/playwright-core-1.64.1/lib/utilsBundle.js.LICENSE) |
| `playwright-core` | [playwright-core/lib/webp_codec.LICENSE](licenses/dependencies/playwright-core-1.64.1/lib/webp_codec.LICENSE) |

## Sharp and native image-library licensing

Sharp's JavaScript/native binding uses Apache-2.0; its prebuilt libvips distribution includes libraries with separate LGPL, MPL, BSD, MIT, zlib/IJG and other notices. Some platform packages therefore declare compound licenses. For example, the locked Windows packages declare **Apache-2.0 AND LGPL-3.0-or-later**. Preserve these distinctions.

The installed native package README/version files are retained below when provided by that package. They record that build's native-library license table and component versions; they must not be replaced by a blanket Apache or MIT statement.

| Installed native package | Declared license | Preserved package evidence |
| --- | --- | --- |
| `@img/sharp-win32-x64@0.35.5` | Apache-2.0 AND LGPL-3.0-or-later | [LICENSE](licenses/dependencies/img--sharp-win32-x64-0.35.5/LICENSE), [README.md](licenses/dependencies/img--sharp-win32-x64-0.35.5/README.md), [versions.json](licenses/dependencies/img--sharp-win32-x64-0.35.5/versions.json) |

In the audited Windows build, the package table identifies aom, cairo, cgif, expat, fontconfig, freetype, fribidi, glib, harfbuzz, highway, lcms, libarchive, libexif, libffi, libheif, libimagequant, libnsgif, libpng, librsvg, libtiff, libultrahdr, libvips, libwebp, libxml2, mozjpeg, pango, pixman, proxy-libintl and zlib-ng. Component inclusion varies by platform/build; use its actual package README and version inventory. Those third-party libraries are inside separately installed native binaries, which this project does not redistribute.

Primary upstream packaging and licensing information: [Sharp](https://github.com/lovell/sharp), [sharp-libvips](https://github.com/lovell/sharp-libvips), and [its native-library notices](https://github.com/lovell/sharp-libvips/blob/main/THIRD-PARTY-NOTICES.md). An upstream main-branch page can change; the copied package-specific README/version files above record the audited installed build.

## Complete lockfile inventory, including optional platforms

Uninstalled optional packages are identified from the lockfile, not represented as locally inspected license texts. The package registry and upstream distribution are the sources for their full terms if installing or redistributing those variants. Common SPDX identifiers here include MIT, Apache-2.0, BSD-2-Clause, ISC, 0BSD and LGPL-3.0-or-later, including compound expressions.

| Package | Locked version | Lockfile license | Evidence | OS/CPU restriction | Primary package source |
| --- | --- | --- | --- | --- | --- |
| `@emnapi/runtime` | 1.11.3 | MIT | Not installed; lock metadata only | Any supported platform | [Package](https://www.npmjs.com/package/@emnapi/runtime/v/1.11.3) |
| `@img/colour` | 1.1.0 | MIT | Installed; notices copied | Any supported platform | [Package](https://www.npmjs.com/package/@img/colour/v/1.1.0) |
| `@img/sharp-darwin-arm64` | 0.35.5 | Apache-2.0 | Not installed; lock metadata only | darwin, arm64 | [Package](https://www.npmjs.com/package/@img/sharp-darwin-arm64/v/0.35.5) |
| `@img/sharp-darwin-x64` | 0.35.5 | Apache-2.0 | Not installed; lock metadata only | darwin, x64 | [Package](https://www.npmjs.com/package/@img/sharp-darwin-x64/v/0.35.5) |
| `@img/sharp-freebsd-wasm32` | 0.35.5 | Apache-2.0 | Not installed; lock metadata only | freebsd | [Package](https://www.npmjs.com/package/@img/sharp-freebsd-wasm32/v/0.35.5) |
| `@img/sharp-libvips-darwin-arm64` | 1.3.4 | LGPL-3.0-or-later | Not installed; lock metadata only | darwin, arm64 | [Package](https://www.npmjs.com/package/@img/sharp-libvips-darwin-arm64/v/1.3.4) |
| `@img/sharp-libvips-darwin-x64` | 1.3.4 | LGPL-3.0-or-later | Not installed; lock metadata only | darwin, x64 | [Package](https://www.npmjs.com/package/@img/sharp-libvips-darwin-x64/v/1.3.4) |
| `@img/sharp-libvips-linux-arm` | 1.3.4 | LGPL-3.0-or-later | Not installed; lock metadata only | linux, arm | [Package](https://www.npmjs.com/package/@img/sharp-libvips-linux-arm/v/1.3.4) |
| `@img/sharp-libvips-linux-arm64` | 1.3.4 | LGPL-3.0-or-later | Not installed; lock metadata only | linux, arm64 | [Package](https://www.npmjs.com/package/@img/sharp-libvips-linux-arm64/v/1.3.4) |
| `@img/sharp-libvips-linux-ppc64` | 1.3.4 | LGPL-3.0-or-later | Not installed; lock metadata only | linux, ppc64 | [Package](https://www.npmjs.com/package/@img/sharp-libvips-linux-ppc64/v/1.3.4) |
| `@img/sharp-libvips-linux-riscv64` | 1.3.4 | LGPL-3.0-or-later | Not installed; lock metadata only | linux, riscv64 | [Package](https://www.npmjs.com/package/@img/sharp-libvips-linux-riscv64/v/1.3.4) |
| `@img/sharp-libvips-linux-s390x` | 1.3.4 | LGPL-3.0-or-later | Not installed; lock metadata only | linux, s390x | [Package](https://www.npmjs.com/package/@img/sharp-libvips-linux-s390x/v/1.3.4) |
| `@img/sharp-libvips-linux-x64` | 1.3.4 | LGPL-3.0-or-later | Not installed; lock metadata only | linux, x64 | [Package](https://www.npmjs.com/package/@img/sharp-libvips-linux-x64/v/1.3.4) |
| `@img/sharp-libvips-linuxmusl-arm64` | 1.3.4 | LGPL-3.0-or-later | Not installed; lock metadata only | linux, arm64 | [Package](https://www.npmjs.com/package/@img/sharp-libvips-linuxmusl-arm64/v/1.3.4) |
| `@img/sharp-libvips-linuxmusl-x64` | 1.3.4 | LGPL-3.0-or-later | Not installed; lock metadata only | linux, x64 | [Package](https://www.npmjs.com/package/@img/sharp-libvips-linuxmusl-x64/v/1.3.4) |
| `@img/sharp-linux-arm` | 0.35.5 | Apache-2.0 | Not installed; lock metadata only | linux, arm | [Package](https://www.npmjs.com/package/@img/sharp-linux-arm/v/0.35.5) |
| `@img/sharp-linux-arm64` | 0.35.5 | Apache-2.0 | Not installed; lock metadata only | linux, arm64 | [Package](https://www.npmjs.com/package/@img/sharp-linux-arm64/v/0.35.5) |
| `@img/sharp-linux-ppc64` | 0.35.5 | Apache-2.0 | Not installed; lock metadata only | linux, ppc64 | [Package](https://www.npmjs.com/package/@img/sharp-linux-ppc64/v/0.35.5) |
| `@img/sharp-linux-riscv64` | 0.35.5 | Apache-2.0 | Not installed; lock metadata only | linux, riscv64 | [Package](https://www.npmjs.com/package/@img/sharp-linux-riscv64/v/0.35.5) |
| `@img/sharp-linux-s390x` | 0.35.5 | Apache-2.0 | Not installed; lock metadata only | linux, s390x | [Package](https://www.npmjs.com/package/@img/sharp-linux-s390x/v/0.35.5) |
| `@img/sharp-linux-x64` | 0.35.5 | Apache-2.0 | Not installed; lock metadata only | linux, x64 | [Package](https://www.npmjs.com/package/@img/sharp-linux-x64/v/0.35.5) |
| `@img/sharp-linuxmusl-arm64` | 0.35.5 | Apache-2.0 | Not installed; lock metadata only | linux, arm64 | [Package](https://www.npmjs.com/package/@img/sharp-linuxmusl-arm64/v/0.35.5) |
| `@img/sharp-linuxmusl-x64` | 0.35.5 | Apache-2.0 | Not installed; lock metadata only | linux, x64 | [Package](https://www.npmjs.com/package/@img/sharp-linuxmusl-x64/v/0.35.5) |
| `@img/sharp-wasm32` | 0.35.5 | Apache-2.0 AND LGPL-3.0-or-later AND MIT | Not installed; lock metadata only | Any supported platform | [Package](https://www.npmjs.com/package/@img/sharp-wasm32/v/0.35.5) |
| `@img/sharp-webcontainers-wasm32` | 0.35.5 | Apache-2.0 | Not installed; lock metadata only | wasm32 | [Package](https://www.npmjs.com/package/@img/sharp-webcontainers-wasm32/v/0.35.5) |
| `@img/sharp-win32-arm64` | 0.35.5 | Apache-2.0 AND LGPL-3.0-or-later | Not installed; lock metadata only | win32, arm64 | [Package](https://www.npmjs.com/package/@img/sharp-win32-arm64/v/0.35.5) |
| `@img/sharp-win32-ia32` | 0.35.5 | Apache-2.0 AND LGPL-3.0-or-later | Not installed; lock metadata only | win32, ia32 | [Package](https://www.npmjs.com/package/@img/sharp-win32-ia32/v/0.35.5) |
| `@img/sharp-win32-x64` | 0.35.5 | Apache-2.0 AND LGPL-3.0-or-later | Installed; notices copied | win32, x64 | [Package](https://www.npmjs.com/package/@img/sharp-win32-x64/v/0.35.5) |
| `@types/node` | 26.6.6 | MIT | Installed; notices copied | Any supported platform | [Package](https://www.npmjs.com/package/@types/node/v/26.6.6) |
| `@types/whatwg-mimetype` | 3.0.2 | MIT | Installed; notices copied | Any supported platform | [Package](https://www.npmjs.com/package/@types/whatwg-mimetype/v/3.0.2) |
| `@types/ws` | 8.18.2 | MIT | Installed; notices copied | Any supported platform | [Package](https://www.npmjs.com/package/@types/ws/v/8.18.2) |
| `buffer-image-size` | 0.6.4 | MIT | Installed; notices copied | Any supported platform | [Package](https://www.npmjs.com/package/buffer-image-size/v/0.6.4) |
| `detect-libc` | 2.1.2 | Apache-2.0 | Installed; notices copied | Any supported platform | [Package](https://www.npmjs.com/package/detect-libc/v/2.1.2) |
| `entities` | 7.0.1 | BSD-2-Clause | Installed; notices copied | Any supported platform | [Package](https://www.npmjs.com/package/entities/v/7.0.1) |
| `happy-dom` | 21.0.4 | MIT | Installed; notices copied | Any supported platform | [Package](https://www.npmjs.com/package/happy-dom/v/21.0.4) |
| `playwright` | 1.64.1 | Apache-2.0 | Installed; notices copied | Any supported platform | [Package](https://www.npmjs.com/package/playwright/v/1.64.1) |
| `playwright-core` | 1.64.1 | Apache-2.0 | Installed; notices copied | Any supported platform | [Package](https://www.npmjs.com/package/playwright-core/v/1.64.1) |
| `semver` | 7.8.5 | ISC | Installed; notices copied | Any supported platform | [Package](https://www.npmjs.com/package/semver/v/7.8.5) |
| `sharp` | 0.35.5 | Apache-2.0 | Installed; notices copied | Any supported platform | [Package](https://www.npmjs.com/package/sharp/v/0.35.5) |
| `tslib` | 2.8.1 | 0BSD | Not installed; lock metadata only | Any supported platform | [Package](https://www.npmjs.com/package/tslib/v/2.8.1) |
| `undici-types` | 8.9.0 | MIT | Installed; notices copied | Any supported platform | [Package](https://www.npmjs.com/package/undici-types/v/8.9.0) |
| `whatwg-mimetype` | 3.0.0 | MIT | Installed; notices copied | Any supported platform | [Package](https://www.npmjs.com/package/whatwg-mimetype/v/3.0.0) |
| `ws` | 8.22.0 | MIT | Installed; notices copied | Any supported platform | [Package](https://www.npmjs.com/package/ws/v/8.22.0) |

## Regeneration and completeness boundaries

`package-lock.json` records package integrity hashes. [manifest.json](licenses/dependencies/manifest.json) records each preserved notice's SHA-256 hash. The generator does not download missing platform packages, change their notices, infer missing permissions, or claim that absent optional license texts were inspected. Do not remove upstream notices when redistributing code that includes their protected material. Future dependency additions must be reviewed before publication; no blanket project license can grant rights in third-party work.