74 lines
19 KiB
Markdown
74 lines
19 KiB
Markdown
# Third-party notices
|
|
|
|
Regex Tools original source is GPL-3.0-or-later. The production browser bundle
|
|
contains the compatible runtime components below.
|
|
Exact dependency resolution is recorded in `package-lock.json`.
|
|
|
|
| Component | Version | Licence | Shipped | Role and source |
|
|
| -------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------- | ---------------------------- | -------------------------------------------------------------------------------------------------------------------------- |
|
|
| `@add-ideas/toolbox-contract` | 0.2.2 | Apache-2.0 | Runtime | Manifest contract; <https://git.add-ideas.de/zemion/toolbox-sdk> |
|
|
| `@add-ideas/toolbox-shell-react` | 0.2.2 | Apache-2.0 | Runtime | Shared shell; same source |
|
|
| `@eslint-community/regexpp` | 4.12.2 | MIT | Syntax worker | ECMAScript parser; <https://github.com/eslint-community/regexpp> |
|
|
| CodeMirror packages | state 6.7.1; view 6.43.6; language 6.12.4; commands 6.10.4; search 6.7.1 | MIT | Runtime | Editors; <https://github.com/codemirror> |
|
|
| `@lezer/highlight` | 1.2.3 | MIT | Runtime | Editor highlighting support; <https://github.com/lezer-parser/highlight> |
|
|
| React / React DOM | 19.2.7 | MIT | Runtime | User interface; <https://github.com/facebook/react> |
|
|
| `fflate` | 0.8.3 | MIT | Runtime and build dependency | Local corpus-output ZIP and deterministic release ZIP; <https://github.com/101arrowz/fflate> |
|
|
| Emscripten generated runtime | 6.0.4 | MIT OR NCSA | Generated WebAssembly glue | Standalone PCRE2 and C++ module toolchain; <https://github.com/emscripten-core/emscripten> |
|
|
| PCRE2 | 10.47 | BSD-3-Clause WITH PCRE2-exception | WebAssembly runtime | Pinned official 8-bit engine; <https://github.com/PCRE2Project/pcre2> |
|
|
| PHP | 8.5.8 | PHP License 4 (BSD-3-Clause) | PHP runtime | `preg_*` execution; v4 elected through the earlier licence's later-version option; <https://www.php.net/> |
|
|
| PCRE2 in PHP | 10.44 | PCRE2 BSD licence | PHP runtime | Engine embedded in the PHP build; distinct from standalone PCRE2 10.47 |
|
|
| WordPress Playground `@php-wasm` | 3.1.46 | GPL-2.0-or-later | PHP runtime/host packages | `web-8-5`, `universal` and pinned support packages; <https://github.com/WordPress/wordpress-playground> |
|
|
| Zend Engine and PHP bundled code | PHP 8.5.8 | Zend Engine License 2.00; MIT; public-domain/CC0 and component terms | PHP WebAssembly | Exact Zend, official `README.REDIST.BINS`, CLI HTTP parser and hash-code notices travel with the pack |
|
|
| PHP-vendored support code | bcmath snapshot; timelib 2022.15; tzdata 2026.1; libmagic snapshot; Lexbor 2.7.0; libmbfl 1.3.2; uriparser 1.0.2; libavifinfo snapshot | LGPL-2.0-or-later; MIT; public domain; BSD; Apache-2.0; LGPL-2.1; BSD and AOM patent terms | PHP WebAssembly | Exact php-src 8.5.8 component paths and legal routes are recorded in the native inventory |
|
|
| PHP data/archive/image libraries | zlib 1.2.13; libzip 1.9.2; libxml2 2.9.10; SQLite 3.51.0; libgd 2.3.3 | Zlib; BSD-3-Clause; MIT; public domain; BSD-like | PHP WebAssembly | Exact primary archive hashes/commits and separately pinned legal files |
|
|
| PHP image codec libraries | libjpeg-turbo 3.0.3; libpng 1.6.39; libwebp/libsharpyuv pinned commit; libavif 1.3.0; libaom 3.12.1 with libyuv snapshot | IJG/BSD/Zlib; Libpng; BSD/patent grants; BSD-2-Clause/AOM patent terms | PHP WebAssembly | libavif's local AOM 3.12.1 is linked; the adjacent standalone AOM 3.13.1 recipe is not |
|
|
| PHP network/text libraries | OpenSSL 1.1.1t; curl 7.69.1; libiconv 1.17; Oniguruma 6.9.10 | OpenSSL/SSLeay; curl; LGPL-2.1-or-later; BSD-2-Clause | PHP WebAssembly | Oniguruma's exact archive/header and bounded upstream source interval are recorded without claiming an unpinned build HEAD |
|
|
| Emscripten system code in PHP | main linker 4.0.19; musl, compiler-rt, libc++, libc++abi and dlmalloc snapshots | MIT/NCSA; MIT/component terms; Apache-2.0 WITH LLVM-exception plus legacy terms; public domain | PHP WebAssembly | Exact Emscripten commit and independently pinned component legal files |
|
|
| WebPerl / Perl | 0.09-beta / 5.28.1 | GPL-1.0-or-later OR Artistic-1.0-Perl | Legacy Perl runtime | Unmodified, explicitly legacy prebuilt engine; <https://github.com/haukex/webperl> |
|
|
| Emscripten used by WebPerl | 1.38.28 | MIT OR NCSA | Legacy Perl loader/runtime | Exact upstream-generated asset toolchain |
|
|
| Pyodide | 314.0.3 | MPL-2.0 | Python runtime pack | Self-hosted CPython browser runtime; <https://github.com/pyodide/pyodide> |
|
|
| Error Stack Parser / StackFrame | 2.1.4 / 1.3.4 vendored ports | MIT | Python loader | Exact upstream tags/archives and Pyodide port-source hashes are recorded |
|
|
| CPython | 3.14.2 | Python-2.0 and bundled terms | Python runtime/stdlib | `re` execution and bundled standard library; <https://github.com/python/cpython> |
|
|
| Expat / libmpdec / HACL* | 2.7.3 / 2.5.1 / pinned HACL commit | MIT / BSD-2-Clause / MIT | Python base WebAssembly | CPython-vendored static components; exact preferred HACL source and generated-source route are recorded |
|
|
| libffi / Hiwire | pinned commit / 1.0.1 | MIT / MPL-2.0 | Python base WebAssembly | Pyodide's exact `_ctypes` and JavaScript-reference bridge inputs |
|
|
| XZ liblzma / Zstandard | 5.2.2 / 1.5.7 | Public-domain fallback grant / BSD-3-Clause | Python base WebAssembly | Static compression modules from Pyodide's pinned primary source archives |
|
|
| SQLite | 3.39.0 | Public-domain dedication/blessing | Python base WebAssembly | Static `_sqlite3` from the pinned official amalgamation archive |
|
|
| bzip2 / zlib | 1.0.6 / 1.3.1 | bzip2-1.0.6 / Zlib | Python base WebAssembly | Exact Emscripten 5.0.3 ports selected by Pyodide |
|
|
| Emscripten used by Pyodide | 5.0.3 plus five pinned Pyodide patches | MIT OR NCSA | Python loader/WebAssembly | Exact toolchain source tree, patches and recipe hashes |
|
|
| Emscripten system runtime | snapshot in 5.0.3 | MIT and Apache-2.0 WITH LLVM-exception | Python base WebAssembly | musl, compiler-rt, libc++, libc++abi, libunwind and dlmalloc conservative notice closure |
|
|
| MiniLZ4 | snapshot in Emscripten 5.0.3 | MIT | Python loader | Selected by Pyodide's `-sLZ4=1`; its source notice is restored outside the minified loader |
|
|
| ruby.wasm / CRuby | 2.9.3-2.9.4 / 4.0.0 | MIT host; Ruby/BSD and bundled terms | Ruby runtime | Minimal CRuby WebAssembly pack and complete upstream NOTICE; <https://github.com/ruby/ruby.wasm> |
|
|
| TeaVM | 0.15.0 | Apache-2.0 | Generated Java engine module | `java.util.regex` class-library implementation; <https://github.com/konsoletyper/teavm> |
|
|
| Emscripten system code in C++ | Emscripten 6.0.4; musl 1.2.6; compiler-rt 22.1.8; libc++/libc++abi 21.1.8; emmalloc snapshot | MIT/NCSA; MIT/component terms; Apache-2.0 WITH LLVM-exception plus legacy terms | C++ WebAssembly | Exact traced link and preferred-source/legal closure; libunwind 22.1.8 is retained as an audited non-selection |
|
|
| Go | 1.26.5 | BSD-3-Clause | Go runtime/engine | Standard-library `regexp` and official `js/wasm` support; <https://go.dev/> |
|
|
| Rust `regex` / toolchain | regex 1.13.1 / rustc 1.97.1 | MIT OR Apache-2.0 plus component terms | Rust runtime/engine | Exact Cargo graph, standard library and wasm-bindgen notices travel with the pack |
|
|
| .NET | runtime 10.0.10 / SDK 10.0.302 | MIT plus bundled component terms | .NET runtime/engine | Browser-WASM `System.Text.RegularExpressions`; <https://github.com/dotnet/runtime> |
|
|
| Vite | 8.1.5 | MIT | Generated helpers | Production build; <https://github.com/vitejs/vite> |
|
|
| Rolldown | 1.1.5 | MIT | Generated helpers | Production bundling; <https://github.com/rolldown/rolldown> |
|
|
|
|
`@add-ideas/toolbox-testkit` 0.2.2 and the other test/build dependencies are
|
|
development-only and are not part of the static runtime bundle.
|
|
|
|
The PHP pack's `native-components.json` is scoped to the exact
|
|
`php.wasm` SHA-256 and routes every linked component above to one or more of 42
|
|
independently verifier-pinned licence, notice or patent files. It separately
|
|
records and tests the false-positive/unshipped detections for GMP, libsodium,
|
|
tidy, ICU/intl, FreeType, ImageMagick/imagick and AOM 3.13.1.
|
|
|
|
`recheck` 4.5.0 and `regexp-ast-analysis` 0.7.1 were inspected but deliberately
|
|
not installed or shipped. PCRE2 source is not vendored; its generated
|
|
WebAssembly pack is shipped with exact metadata, checksums and licence. Pyodide,
|
|
PHP WebAssembly and ruby.wasm are pinned npm build inputs whose reviewed
|
|
self-hosted files are copied into engine packs. The Python pack's
|
|
`SOURCE-MANIFEST.json` distinguishes the optional wheel catalogue from files
|
|
actually shipped, inventories the complete linked base runtime and provides
|
|
exact preferred-form/archive/Git/patch identities. The TeaVM module contains
|
|
its compiled class library and is explicitly identified as TeaVM, not OpenJDK;
|
|
the Scala compatibility profile shares it and ships no Scala runtime.
|
|
|
|
Licence texts and copyright notices for the ordinary bundled dependencies are
|
|
in `LICENSES/`. Each engine pack carries its exact upstream licence/notice
|
|
files alongside the runtime. The release package additionally carries the exact
|
|
Vite and Rolldown legal files under `LICENSES/build/`, including Vite's
|
|
bundled-dependency notices for code emitted by the production build.
|