# Third-party notices

Regex Tools original source is GPL-3.0-or-later. The production browser bundle
contains the compatible runtime components below.
Exact dependency resolution is recorded in `package-lock.json`.

| Component                        | Version                                                                                                                                | Licence                                                                                        | Shipped                      | Role and source                                                                                                            |
| -------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------- | ---------------------------- | -------------------------------------------------------------------------------------------------------------------------- |
| `@add-ideas/toolbox-contract`    | 0.2.2                                                                                                                                  | Apache-2.0                                                                                     | Runtime                      | Manifest contract; <https://git.add-ideas.de/zemion/toolbox-sdk>                                                           |
| `@add-ideas/toolbox-shell-react` | 0.2.2                                                                                                                                  | Apache-2.0                                                                                     | Runtime                      | Shared shell; same source                                                                                                  |
| `@eslint-community/regexpp`      | 4.12.2                                                                                                                                 | MIT                                                                                            | Syntax worker                | ECMAScript parser; <https://github.com/eslint-community/regexpp>                                                           |
| CodeMirror packages              | state 6.7.1; view 6.43.6; language 6.12.4; commands 6.10.4; search 6.7.1                                                               | MIT                                                                                            | Runtime                      | Editors; <https://github.com/codemirror>                                                                                   |
| `@lezer/highlight`               | 1.2.3                                                                                                                                  | MIT                                                                                            | Runtime                      | Editor highlighting support; <https://github.com/lezer-parser/highlight>                                                   |
| React / React DOM                | 19.2.7                                                                                                                                 | MIT                                                                                            | Runtime                      | User interface; <https://github.com/facebook/react>                                                                        |
| `fflate`                         | 0.8.3                                                                                                                                  | MIT                                                                                            | Runtime and build dependency | Local corpus-output ZIP and deterministic release ZIP; <https://github.com/101arrowz/fflate>                               |
| Emscripten generated runtime     | 6.0.4                                                                                                                                  | MIT OR NCSA                                                                                    | Generated WebAssembly glue   | Standalone PCRE2 and C++ module toolchain; <https://github.com/emscripten-core/emscripten>                                 |
| PCRE2                            | 10.47                                                                                                                                  | BSD-3-Clause WITH PCRE2-exception                                                              | WebAssembly runtime          | Pinned official 8-bit engine; <https://github.com/PCRE2Project/pcre2>                                                      |
| PHP                              | 8.5.8                                                                                                                                  | PHP License 4 (BSD-3-Clause)                                                                   | PHP runtime                  | `preg_*` execution; v4 elected through the earlier licence's later-version option; <https://www.php.net/>                  |
| PCRE2 in PHP                     | 10.44                                                                                                                                  | PCRE2 BSD licence                                                                              | PHP runtime                  | Engine embedded in the PHP build; distinct from standalone PCRE2 10.47                                                     |
| WordPress Playground `@php-wasm` | 3.1.46                                                                                                                                 | GPL-2.0-or-later                                                                               | PHP runtime/host packages    | `web-8-5`, `universal` and pinned support packages; <https://github.com/WordPress/wordpress-playground>                    |
| Zend Engine and PHP bundled code | PHP 8.5.8                                                                                                                              | Zend Engine License 2.00; MIT; public-domain/CC0 and component terms                           | PHP WebAssembly              | Exact Zend, official `README.REDIST.BINS`, CLI HTTP parser and hash-code notices travel with the pack                      |
| PHP-vendored support code        | bcmath snapshot; timelib 2022.15; tzdata 2026.1; libmagic snapshot; Lexbor 2.7.0; libmbfl 1.3.2; uriparser 1.0.2; libavifinfo snapshot | LGPL-2.0-or-later; MIT; public domain; BSD; Apache-2.0; LGPL-2.1; BSD and AOM patent terms     | PHP WebAssembly              | Exact php-src 8.5.8 component paths and legal routes are recorded in the native inventory                                  |
| PHP data/archive/image libraries | zlib 1.2.13; libzip 1.9.2; libxml2 2.9.10; SQLite 3.51.0; libgd 2.3.3                                                                  | Zlib; BSD-3-Clause; MIT; public domain; BSD-like                                               | PHP WebAssembly              | Exact primary archive hashes/commits and separately pinned legal files                                                     |
| PHP image codec libraries        | libjpeg-turbo 3.0.3; libpng 1.6.39; libwebp/libsharpyuv pinned commit; libavif 1.3.0; libaom 3.12.1 with libyuv snapshot               | IJG/BSD/Zlib; Libpng; BSD/patent grants; BSD-2-Clause/AOM patent terms                         | PHP WebAssembly              | libavif's local AOM 3.12.1 is linked; the adjacent standalone AOM 3.13.1 recipe is not                                     |
| PHP network/text libraries       | OpenSSL 1.1.1t; curl 7.69.1; libiconv 1.17; Oniguruma 6.9.10                                                                           | OpenSSL/SSLeay; curl; LGPL-2.1-or-later; BSD-2-Clause                                          | PHP WebAssembly              | Oniguruma's exact archive/header and bounded upstream source interval are recorded without claiming an unpinned build HEAD |
| Emscripten system code in PHP    | main linker 4.0.19; musl, compiler-rt, libc++, libc++abi and dlmalloc snapshots                                                        | MIT/NCSA; MIT/component terms; Apache-2.0 WITH LLVM-exception plus legacy terms; public domain | PHP WebAssembly              | Exact Emscripten commit and independently pinned component legal files                                                     |
| WebPerl / Perl                   | 0.09-beta / 5.28.1                                                                                                                     | GPL-1.0-or-later OR Artistic-1.0-Perl                                                          | Legacy Perl runtime          | Unmodified, explicitly legacy prebuilt engine; <https://github.com/haukex/webperl>                                         |
| Emscripten used by WebPerl       | 1.38.28                                                                                                                                | MIT OR NCSA                                                                                    | Legacy Perl loader/runtime   | Exact upstream-generated asset toolchain                                                                                   |
| Pyodide                          | 314.0.3                                                                                                                                | MPL-2.0                                                                                        | Python runtime pack          | Self-hosted CPython browser runtime; <https://github.com/pyodide/pyodide>                                                  |
| Error Stack Parser / StackFrame  | 2.1.4 / 1.3.4 vendored ports                                                                                                           | MIT                                                                                            | Python loader                | Exact upstream tags/archives and Pyodide port-source hashes are recorded                                                   |
| CPython                          | 3.14.2                                                                                                                                 | Python-2.0 and bundled terms                                                                   | Python runtime/stdlib        | `re` execution and bundled standard library; <https://github.com/python/cpython>                                           |
| Expat / libmpdec / HACL*         | 2.7.3 / 2.5.1 / pinned HACL commit                                                                                                     | MIT / BSD-2-Clause / MIT                                                                       | Python base WebAssembly      | CPython-vendored static components; exact preferred HACL source and generated-source route are recorded                    |
| libffi / Hiwire                  | pinned commit / 1.0.1                                                                                                                  | MIT / MPL-2.0                                                                                  | Python base WebAssembly      | Pyodide's exact `_ctypes` and JavaScript-reference bridge inputs                                                           |
| XZ liblzma / Zstandard           | 5.2.2 / 1.5.7                                                                                                                          | Public-domain fallback grant / BSD-3-Clause                                                    | Python base WebAssembly      | Static compression modules from Pyodide's pinned primary source archives                                                   |
| SQLite                           | 3.39.0                                                                                                                                 | Public-domain dedication/blessing                                                              | Python base WebAssembly      | Static `_sqlite3` from the pinned official amalgamation archive                                                            |
| bzip2 / zlib                     | 1.0.6 / 1.3.1                                                                                                                          | bzip2-1.0.6 / Zlib                                                                             | Python base WebAssembly      | Exact Emscripten 5.0.3 ports selected by Pyodide                                                                           |
| Emscripten used by Pyodide       | 5.0.3 plus five pinned Pyodide patches                                                                                                 | MIT OR NCSA                                                                                    | Python loader/WebAssembly    | Exact toolchain source tree, patches and recipe hashes                                                                     |
| Emscripten system runtime        | snapshot in 5.0.3                                                                                                                      | MIT and Apache-2.0 WITH LLVM-exception                                                         | Python base WebAssembly      | musl, compiler-rt, libc++, libc++abi, libunwind and dlmalloc conservative notice closure                                   |
| MiniLZ4                          | snapshot in Emscripten 5.0.3                                                                                                           | MIT                                                                                            | Python loader                | Selected by Pyodide's `-sLZ4=1`; its source notice is restored outside the minified loader                                 |
| ruby.wasm / CRuby                | 2.9.3-2.9.4 / 4.0.0                                                                                                                    | MIT host; Ruby/BSD and bundled terms                                                           | Ruby runtime                 | Minimal CRuby WebAssembly pack and complete upstream NOTICE; <https://github.com/ruby/ruby.wasm>                           |
| TeaVM                            | 0.15.0                                                                                                                                 | Apache-2.0                                                                                     | Generated Java engine module | `java.util.regex` class-library implementation; <https://github.com/konsoletyper/teavm>                                    |
| Emscripten system code in C++    | Emscripten 6.0.4; musl 1.2.6; compiler-rt 22.1.8; libc++/libc++abi 21.1.8; emmalloc snapshot                                           | MIT/NCSA; MIT/component terms; Apache-2.0 WITH LLVM-exception plus legacy terms                | C++ WebAssembly              | Exact traced link and preferred-source/legal closure; libunwind 22.1.8 is retained as an audited non-selection             |
| Go                               | 1.26.5                                                                                                                                 | BSD-3-Clause                                                                                   | Go runtime/engine            | Standard-library `regexp` and official `js/wasm` support; <https://go.dev/>                                                |
| Rust `regex` / toolchain         | regex 1.13.1 / rustc 1.97.1                                                                                                            | MIT OR Apache-2.0 plus component terms                                                         | Rust runtime/engine          | Exact Cargo graph, standard library and wasm-bindgen notices travel with the pack                                          |
| .NET                             | runtime 10.0.10 / SDK 10.0.302                                                                                                         | MIT plus bundled component terms                                                               | .NET runtime/engine          | Browser-WASM `System.Text.RegularExpressions`; <https://github.com/dotnet/runtime>                                         |
| Vite                             | 8.1.5                                                                                                                                  | MIT                                                                                            | Generated helpers            | Production build; <https://github.com/vitejs/vite>                                                                         |
| Rolldown                         | 1.1.5                                                                                                                                  | MIT                                                                                            | Generated helpers            | Production bundling; <https://github.com/rolldown/rolldown>                                                                |

`@add-ideas/toolbox-testkit` 0.2.2 and the other test/build dependencies are
development-only and are not part of the static runtime bundle.

The PHP pack's `native-components.json` is scoped to the exact
`php.wasm` SHA-256 and routes every linked component above to one or more of 42
independently verifier-pinned licence, notice or patent files. It separately
records and tests the false-positive/unshipped detections for GMP, libsodium,
tidy, ICU/intl, FreeType, ImageMagick/imagick and AOM 3.13.1.

`recheck` 4.5.0 and `regexp-ast-analysis` 0.7.1 were inspected but deliberately
not installed or shipped. PCRE2 source is not vendored; its generated
WebAssembly pack is shipped with exact metadata, checksums and licence. Pyodide,
PHP WebAssembly and ruby.wasm are pinned npm build inputs whose reviewed
self-hosted files are copied into engine packs. The Python pack's
`SOURCE-MANIFEST.json` distinguishes the optional wheel catalogue from files
actually shipped, inventories the complete linked base runtime and provides
exact preferred-form/archive/Git/patch identities. The TeaVM module contains
its compiled class library and is explicitly identified as TeaVM, not OpenJDK;
the Scala compatibility profile shares it and ships no Scala runtime.

Licence texts and copyright notices for the ordinary bundled dependencies are
in `LICENSES/`. Each engine pack carries its exact upstream licence/notice
files alongside the runtime. The release package additionally carries the exact
Vite and Rolldown legal files under `LICENSES/build/`, including Vite's
bundled-dependency notices for code emitted by the production build.
