npm run release:prepare generates npm-runtime-licenses.txt from the exact runtime packages in package-lock.json. The generated inventory is included in the static build and release ZIP together with the project licence and third-party notices.

The reviewed Silurus OOXML licence and its bundled-code/data notices are also kept as stable files because the npm package contains Rust/WebAssembly and data whose complete provenance is broader than its top-level MIT licence.

Review dependency licence changes whenever the lockfile changes. Generation is an inventory aid, not a substitute for legal review.