# Third-party notices The versions below are the exact installed versions in `package-lock.json` for SVG Tools 0.1.0. “Shipped” means code or data can be present in the browser bundle. No listed source was copied into project-authored files; packages are consumed through their public APIs and normal bundling. The deterministic release contains a generated `LICENSES/npm-runtime-licenses.txt` with each shipped package's original licence or notice file. Repository links are the upstream source locations declared by the packages. ## Direct runtime dependencies | Project | Version | Licence | Role | Source | | ----------------------- | ------- | --------------------- | -------------------------------------------------------- | ------------------------------------------------- | | Toolbox contract | 0.3.0 | Apache-2.0 | manifest/context types | https://git.add-ideas.de/lotobo/toolbox-sdk | | Toolbox shell React | 0.3.0 | Apache-2.0 | shared app shell/theme/help/source actions | https://git.add-ideas.de/lotobo/toolbox-sdk | | CodeMirror commands | 6.10.4 | MIT | editor commands/keymap | https://code.haverbeke.berlin/codemirror/commands | | CodeMirror XML language | 6.1.0 | MIT | XML language support | https://github.com/codemirror/lang-xml | | CodeMirror language | 6.12.4 | MIT | highlighting/folding | https://code.haverbeke.berlin/codemirror/language | | CodeMirror search | 6.7.1 | MIT | editor search | https://code.haverbeke.berlin/codemirror/search | | CodeMirror state | 6.7.1 | MIT | editor state | https://code.haverbeke.berlin/codemirror/state | | CodeMirror view | 6.43.6 | MIT | source editor UI | https://code.haverbeke.berlin/codemirror/view | | Lezer XML | 1.0.6 | MIT | ranged XML syntax diagnostics | https://github.com/lezer-parser/xml | | css-tree | 3.2.1 | MIT | parsed CSS security and animation-value checks | https://github.com/csstree/csstree | | DOMPurify | 3.4.14 | MPL-2.0 OR Apache-2.0 | first sanitization layer | https://github.com/cure53/DOMPurify | | fflate | 0.8.3 | MIT | bounded SVGZ decompression and deterministic compression | https://github.com/101arrowz/fflate | | React | 19.2.6 | MIT | application UI | https://github.com/facebook/react | | React DOM | 19.2.6 | MIT | browser rendering | https://github.com/facebook/react | | SVGO | 4.0.2 | MIT | worker-based optional optimization | https://github.com/svg/svgo | ## Transitive runtime dependencies | Package | Version | Licence | Source | | ---------------------------- | ------- | ------------- | ------------------------------------------------------- | | `@codemirror/autocomplete` | 6.20.3 | MIT | https://code.haverbeke.berlin/codemirror/autocomplete | | `@lezer/common` | 1.5.2 | MIT | https://github.com/lezer-parser/common | | `@lezer/highlight` | 1.2.3 | MIT | https://github.com/lezer-parser/highlight | | `@lezer/lr` | 1.4.10 | MIT | https://code.haverbeke.berlin/lezer/lr | | `@marijn/find-cluster-break` | 1.0.3 | MIT | https://code.haverbeke.berlin/marijn/find-cluster-break | | `@types/trusted-types` | 2.0.7 | MIT | https://github.com/DefinitelyTyped/DefinitelyTyped | | `boolbase` | 1.0.0 | ISC | https://github.com/fb55/boolbase | | `commander` | 11.1.0 | MIT | https://github.com/tj/commander.js | | `crelt` | 1.0.7 | MIT | https://code.haverbeke.berlin/marijn/crelt | | `css-select` | 5.2.2 | BSD-2-Clause | https://github.com/fb55/css-select | | `css-what` | 6.2.2 | BSD-2-Clause | https://github.com/fb55/css-what | | `csso` | 5.0.5 | MIT | https://github.com/css/csso | | `dom-serializer` | 2.0.0 | MIT | https://github.com/cheeriojs/dom-serializer | | `domelementtype` | 2.3.0 | BSD-2-Clause | https://github.com/fb55/domelementtype | | `domhandler` | 5.0.3 | BSD-2-Clause | https://github.com/fb55/domhandler | | `domutils` | 3.2.2 | BSD-2-Clause | https://github.com/fb55/domutils | | `entities` | 4.5.0 | BSD-2-Clause | https://github.com/fb55/entities | | `mdn-data` | 2.27.1 | CC0-1.0 | https://github.com/mdn/data | | `nth-check` | 2.1.1 | BSD-2-Clause | https://github.com/fb55/nth-check | | `picocolors` | 1.1.1 | ISC | https://github.com/alexeyraspopov/picocolors | | `sax` | 1.6.1 | BlueOak-1.0.0 | https://github.com/isaacs/sax-js | | `scheduler` | 0.27.0 | MIT | https://github.com/facebook/react | | `source-map-js` | 1.2.1 | BSD-3-Clause | https://github.com/7rulnik/source-map-js | | `style-mod` | 4.1.3 | MIT | https://github.com/marijnh/style-mod | | `w3c-keyname` | 2.2.8 | MIT | https://github.com/marijnh/w3c-keyname | ## Development-only dependencies These packages are required to build, check or test source and are not shipped as runtime modules in the release ZIP. | Package | Version | Licence | | ----------------------------- | ------- | ---------- | | `@add-ideas/toolbox-testkit` | 0.3.0 | Apache-2.0 | | `@eslint/js` | 10.0.1 | MIT | | `@playwright/test` | 1.61.1 | Apache-2.0 | | `@testing-library/jest-dom` | 6.9.1 | MIT | | `@testing-library/react` | 16.3.2 | MIT | | `@testing-library/user-event` | 14.6.1 | MIT | | `@types/css-tree` | 2.3.11 | MIT | | `@types/node` | 25.8.0 | MIT | | `@types/react` | 19.2.14 | MIT | | `@types/react-dom` | 19.2.3 | MIT | | `@vitejs/plugin-react` | 6.0.2 | MIT | | `eslint` | 10.4.0 | MIT | | `eslint-plugin-react-hooks` | 7.1.1 | MIT | | `eslint-plugin-react-refresh` | 0.5.2 | MIT | | `fast-check` | 4.9.0 | MIT | | `globals` | 17.6.0 | MIT | | `jsdom` | 29.1.1 | MIT | | `prettier` | 3.8.3 | MIT | | `typescript` | 6.0.3 | Apache-2.0 | | `typescript-eslint` | 8.59.3 | MIT | | `vite` | 8.2.0 | MIT | | `vitest` | 4.1.6 | MIT | ## Reviewed but not shipped SVG-Edit, SVG Path Editor and SVGPathCommander were inspected at the revisions in `SOURCE.md`; no code, fixture, asset or explanatory text was copied or adapted. Boxy SVG and SVGViewer were product references only. No boolean geometry library, licensed parser, external raster engine, font or optional Wasm module is included. All hostile and semantic fixtures are project-authored.