# Third-party software

See DEPENDENCIES.json for all locked dependencies, including optional platform packages, and licenses/ for unchanged upstream licence texts. Noto Sans and its OFL are in public/tools-assets/fonts/. Build and local browser-test dependencies are identified separately. These notices do not license the excluded private Essential Designs site.

Supplementary upstream notices and exact provenance are in upstream/. Some MIT packages did not publish a complete licence file: their original README and package metadata are preserved with an unchanged standard MIT text, without inventing copyright holders. Brotli includes Google Apache-2.0 decoder code as well as MIT code. The pdfme common dependency embeds an unchanged Roboto font under Apache-2.0; its original font notices and the full licence text are retained even though generated business documents use Noto Sans. Fontkit also credits ported HarfBuzz and base64-arraybuffer code; their unchanged notices and the upstream revision limitation are retained. See UPSTREAM_LICENSES.json, upstream/SUPPLEMENT_PROVENANCE.json and upstream/FONTKIT_BORROWED_CODE_PROVENANCE.json for these mappings and original sources.
