# Third-Party Notices

This inventory accompanies Shorts Factory Engine. The product license in
`LICENSE.md` applies only to first-party code and does not replace any
third-party license. This document is an engineering inventory, not legal
advice; upstream license files control if an entry differs from this summary.

## Distribution boundary

- The Source Kit includes `package-lock.json`, but not `node_modules`.
- Python wheels and ML model bytes are not bundled. The buyer downloads them
  under their upstream terms using the pinned manifests.
- n8n, PostgreSQL, Redis/Valkey, S3-compatible servers, FFmpeg, Google Cloud
  services and Telegram are buyer-provided prerequisites, not redistributed
  binaries in the Source Kit.
- Any container-image distribution requires a separate image-level SBOM and
  notice review; this file covers the source-kit boundary.

## Pulsar and Charsiu

The first-party Pulsar wrapper and orchestration are governed by the commercial
Source-Available license. The Charsiu-derived adapter retains the MIT notice,
Copyright (c) 2021 jzhu, in `pulsar/ATTRIBUTION.md`. Reviewed upstream
revision: `13a69f2a22ca0c0962b75cc693399b0ae23a12c9`.

## Anton font

`assets/fonts/Anton-Regular.ttf` is licensed under the SIL Open Font License
1.1. The complete license is shipped as `assets/fonts/OFL.txt`.

## Carnegie Mellon Pronouncing Dictionary data

The bundled `pulsar/src/pulsar_aligner/data/cmudict.dict` data file comes
from the official `cmusphinx/cmudict` repository at revision
`74790861f652b15e4ac49015a90074ad62a27690`. Copyright (C) 1993-2015
Carnegie Mellon University. Redistribution in source and binary forms, with or
without modification, is permitted under the conditions reproduced in
`pulsar/src/pulsar_aligner/data/CMUDICT_LICENSE`. The data SHA-256 is
`81917843C7F44CE2B094AC63873C2C7A4CF802040792C455BA3CA406891C3D22`.

No code from the separately licensed `cmudict` Python package or
`cmudict-tools` is included or required.

## Downloaded model

`Systran/faster-whisper-large-v3` is pinned to revision
`edaa852ec7e145841d8ffdb056a99866b5f0a478` and declares MIT. Model bytes are
not bundled and must be acquired separately from the upstream repository.

## Python wheel manifest

The following packages are exact-pinned with wheel hashes in
`pulsar/requirements-windows.lock.txt`. They are installed by the buyer and
are not included in the Source Kit. Binary wheels may contain additional
license notices; installers must preserve the metadata and license files in
the installed distributions. SciPy and NumPy wheels carry additional
bundled-component notices.

| Package | Version | Declared/reviewed license |
| --- | --- | --- |
| `av` | `18.1.0` | BSD-3-Clause |
| `certifi` | `2024.12.14` | MPL-2.0 |
| `cffi` | `2.0.0` | MIT |
| `charset-normalizer` | `3.4.1` | MIT |
| `colorama` | `0.4.6` | BSD-3-Clause |
| `ctranslate2` | `4.8.2` | MIT |
| `faster-whisper` | `1.2.1` | MIT |
| `filelock` | `3.32.5` | MIT |
| `flatbuffers` | `25.12.19` | Apache-2.0 |
| `fsspec` | `2026.6.0` | BSD-3-Clause |
| `huggingface-hub` | `0.36.2` | Apache-2.0 |
| `idna` | `3.18` | BSD-3-Clause |
| `numpy` | `2.4.6` | BSD-3-Clause AND 0BSD AND MIT AND Zlib AND CC0-1.0 |
| `onnxruntime` | `1.27.0` | MIT |
| `packaging` | `24.2` | Apache-2.0 OR BSD-2-Clause |
| `protobuf` | `6.33.6` | BSD-3-Clause |
| `pycparser` | `3.0` | BSD-3-Clause |
| `pyyaml` | `6.0.2` | MIT |
| `requests` | `2.32.3` | Apache-2.0 |
| `scipy` | `1.17.1` | BSD-3-Clause; wheel includes additional notices |
| `setuptools` | `84.0.0` | MIT |
| `tokenizers` | `0.22.2` | Apache-2.0 |
| `tqdm` | `4.68.3` | MPL-2.0 AND MIT |
| `typing-extensions` | `4.15.0` | PSF-2.0 |
| `urllib3` | `2.4.0` | MIT |
| `wheel` | `0.45.1` | MIT |

## Node dependency inventory

Generated from `docs/commercial-readiness/NODE_SBOM.cdx.json` (326 components). The
`url-template@2.0.8` package metadata says `BSD`; its bundled three-clause
license text was reviewed and is represented below as BSD-3-Clause.

| Package | Version | Declared/reviewed license |
| --- | --- | --- |
| `@aws-crypto/crc32` | `5.2.0` | Apache-2.0 |
| `@aws-crypto/crc32c` | `5.2.0` | Apache-2.0 |
| `@aws-crypto/sha1-browser` | `5.2.0` | Apache-2.0 |
| `@aws-crypto/sha256-browser` | `5.2.0` | Apache-2.0 |
| `@aws-crypto/sha256-js` | `5.2.0` | Apache-2.0 |
| `@aws-crypto/supports-web-crypto` | `5.2.0` | Apache-2.0 |
| `@aws-crypto/util` | `5.2.0` | Apache-2.0 |
| `@aws-sdk/client-s3` | `3.1014.0` | Apache-2.0 |
| `@aws-sdk/core` | `3.973.23` | Apache-2.0 |
| `@aws-sdk/crc64-nvme` | `3.972.5` | Apache-2.0 |
| `@aws-sdk/credential-provider-env` | `3.972.21` | Apache-2.0 |
| `@aws-sdk/credential-provider-http` | `3.972.23` | Apache-2.0 |
| `@aws-sdk/credential-provider-ini` | `3.972.23` | Apache-2.0 |
| `@aws-sdk/credential-provider-login` | `3.972.23` | Apache-2.0 |
| `@aws-sdk/credential-provider-node` | `3.972.24` | Apache-2.0 |
| `@aws-sdk/credential-provider-process` | `3.972.21` | Apache-2.0 |
| `@aws-sdk/credential-provider-sso` | `3.972.23` | Apache-2.0 |
| `@aws-sdk/credential-provider-web-identity` | `3.972.23` | Apache-2.0 |
| `@aws-sdk/middleware-bucket-endpoint` | `3.972.8` | Apache-2.0 |
| `@aws-sdk/middleware-expect-continue` | `3.972.8` | Apache-2.0 |
| `@aws-sdk/middleware-flexible-checksums` | `3.974.3` | Apache-2.0 |
| `@aws-sdk/middleware-host-header` | `3.972.8` | Apache-2.0 |
| `@aws-sdk/middleware-location-constraint` | `3.972.8` | Apache-2.0 |
| `@aws-sdk/middleware-logger` | `3.972.8` | Apache-2.0 |
| `@aws-sdk/middleware-recursion-detection` | `3.972.8` | Apache-2.0 |
| `@aws-sdk/middleware-sdk-s3` | `3.972.23` | Apache-2.0 |
| `@aws-sdk/middleware-ssec` | `3.972.8` | Apache-2.0 |
| `@aws-sdk/middleware-user-agent` | `3.972.24` | Apache-2.0 |
| `@aws-sdk/nested-clients` | `3.996.13` | Apache-2.0 |
| `@aws-sdk/region-config-resolver` | `3.972.9` | Apache-2.0 |
| `@aws-sdk/s3-request-presigner` | `3.1014.0` | Apache-2.0 |
| `@aws-sdk/signature-v4-multi-region` | `3.996.11` | Apache-2.0 |
| `@aws-sdk/token-providers` | `3.1014.0` | Apache-2.0 |
| `@aws-sdk/types` | `3.973.6` | Apache-2.0 |
| `@aws-sdk/util-arn-parser` | `3.972.3` | Apache-2.0 |
| `@aws-sdk/util-endpoints` | `3.996.5` | Apache-2.0 |
| `@aws-sdk/util-format-url` | `3.972.8` | Apache-2.0 |
| `@aws-sdk/util-locate-window` | `3.965.5` | Apache-2.0 |
| `@aws-sdk/util-user-agent-browser` | `3.972.8` | Apache-2.0 |
| `@aws-sdk/util-user-agent-node` | `3.973.10` | Apache-2.0 |
| `@aws-sdk/xml-builder` | `3.972.39` | Apache-2.0 |
| `@aws/lambda-invoke-store` | `0.2.4` | Apache-2.0 |
| `@esbuild/win32-x64` | `0.28.2` | MIT |
| `@ioredis/commands` | `1.5.1` | MIT |
| `@jridgewell/sourcemap-codec` | `1.5.5` | MIT |
| `@nodable/entities` | `3.0.0` | MIT |
| `@pinojs/redact` | `0.4.0` | MIT |
| `@rollup/rollup-win32-x64-gnu` | `4.62.5` | MIT |
| `@rollup/rollup-win32-x64-msvc` | `4.62.5` | MIT |
| `@smithy/abort-controller` | `4.2.12` | Apache-2.0 |
| `@smithy/chunked-blob-reader-native` | `4.2.3` | Apache-2.0 |
| `@smithy/chunked-blob-reader` | `5.2.2` | Apache-2.0 |
| `@smithy/config-resolver` | `4.4.13` | Apache-2.0 |
| `@smithy/core` | `3.23.12` | Apache-2.0 |
| `@smithy/credential-provider-imds` | `4.2.12` | Apache-2.0 |
| `@smithy/eventstream-codec` | `4.2.12` | Apache-2.0 |
| `@smithy/eventstream-serde-browser` | `4.2.12` | Apache-2.0 |
| `@smithy/eventstream-serde-config-resolver` | `4.3.12` | Apache-2.0 |
| `@smithy/eventstream-serde-node` | `4.2.12` | Apache-2.0 |
| `@smithy/eventstream-serde-universal` | `4.2.12` | Apache-2.0 |
| `@smithy/fetch-http-handler` | `5.3.15` | Apache-2.0 |
| `@smithy/hash-blob-browser` | `4.2.13` | Apache-2.0 |
| `@smithy/hash-node` | `4.2.12` | Apache-2.0 |
| `@smithy/hash-stream-node` | `4.2.12` | Apache-2.0 |
| `@smithy/invalid-dependency` | `4.2.12` | Apache-2.0 |
| `@smithy/is-array-buffer` | `2.2.0` | Apache-2.0 |
| `@smithy/is-array-buffer` | `2.2.0` | Apache-2.0 |
| `@smithy/is-array-buffer` | `2.2.0` | Apache-2.0 |
| `@smithy/is-array-buffer` | `4.2.2` | Apache-2.0 |
| `@smithy/md5-js` | `4.2.12` | Apache-2.0 |
| `@smithy/middleware-content-length` | `4.2.12` | Apache-2.0 |
| `@smithy/middleware-endpoint` | `4.4.27` | Apache-2.0 |
| `@smithy/middleware-retry` | `4.4.44` | Apache-2.0 |
| `@smithy/middleware-serde` | `4.2.15` | Apache-2.0 |
| `@smithy/middleware-stack` | `4.2.12` | Apache-2.0 |
| `@smithy/node-config-provider` | `4.3.12` | Apache-2.0 |
| `@smithy/node-http-handler` | `4.5.0` | Apache-2.0 |
| `@smithy/property-provider` | `4.2.12` | Apache-2.0 |
| `@smithy/protocol-http` | `5.3.12` | Apache-2.0 |
| `@smithy/querystring-builder` | `4.2.12` | Apache-2.0 |
| `@smithy/querystring-parser` | `4.2.12` | Apache-2.0 |
| `@smithy/service-error-classification` | `4.2.12` | Apache-2.0 |
| `@smithy/shared-ini-file-loader` | `4.4.7` | Apache-2.0 |
| `@smithy/signature-v4` | `5.3.12` | Apache-2.0 |
| `@smithy/smithy-client` | `4.12.7` | Apache-2.0 |
| `@smithy/types` | `4.17.2` | Apache-2.0 |
| `@smithy/url-parser` | `4.2.12` | Apache-2.0 |
| `@smithy/util-base64` | `4.3.2` | Apache-2.0 |
| `@smithy/util-body-length-browser` | `4.2.2` | Apache-2.0 |
| `@smithy/util-body-length-node` | `4.2.3` | Apache-2.0 |
| `@smithy/util-buffer-from` | `2.2.0` | Apache-2.0 |
| `@smithy/util-buffer-from` | `2.2.0` | Apache-2.0 |
| `@smithy/util-buffer-from` | `2.2.0` | Apache-2.0 |
| `@smithy/util-buffer-from` | `4.2.2` | Apache-2.0 |
| `@smithy/util-config-provider` | `4.2.2` | Apache-2.0 |
| `@smithy/util-defaults-mode-browser` | `4.3.43` | Apache-2.0 |
| `@smithy/util-defaults-mode-node` | `4.2.47` | Apache-2.0 |
| `@smithy/util-endpoints` | `3.3.3` | Apache-2.0 |
| `@smithy/util-hex-encoding` | `4.2.2` | Apache-2.0 |
| `@smithy/util-middleware` | `4.2.12` | Apache-2.0 |
| `@smithy/util-retry` | `4.2.12` | Apache-2.0 |
| `@smithy/util-stream` | `4.5.20` | Apache-2.0 |
| `@smithy/util-uri-escape` | `4.2.2` | Apache-2.0 |
| `@smithy/util-utf8` | `2.3.0` | Apache-2.0 |
| `@smithy/util-utf8` | `2.3.0` | Apache-2.0 |
| `@smithy/util-utf8` | `2.3.0` | Apache-2.0 |
| `@smithy/util-utf8` | `4.2.2` | Apache-2.0 |
| `@smithy/util-waiter` | `4.2.13` | Apache-2.0 |
| `@smithy/uuid` | `1.1.2` | Apache-2.0 |
| `@types/body-parser` | `1.19.6` | MIT |
| `@types/chai` | `5.2.3` | MIT |
| `@types/connect` | `3.4.38` | MIT |
| `@types/deep-eql` | `4.0.2` | MIT |
| `@types/estree` | `1.0.9` | MIT |
| `@types/express-serve-static-core` | `5.1.1` | MIT |
| `@types/express` | `5.0.6` | MIT |
| `@types/http-errors` | `2.0.5` | MIT |
| `@types/node` | `22.19.15` | MIT |
| `@types/pg` | `8.20.0` | MIT |
| `@types/qs` | `6.15.0` | MIT |
| `@types/range-parser` | `1.2.7` | MIT |
| `@types/send` | `1.2.1` | MIT |
| `@types/serve-static` | `2.2.0` | MIT |
| `@vitest/expect` | `3.2.7` | MIT |
| `@vitest/mocker` | `3.2.7` | MIT |
| `@vitest/pretty-format` | `3.2.7` | MIT |
| `@vitest/runner` | `3.2.7` | MIT |
| `@vitest/snapshot` | `3.2.7` | MIT |
| `@vitest/spy` | `3.2.7` | MIT |
| `@vitest/utils` | `3.2.7` | MIT |
| `accepts` | `1.3.8` | MIT |
| `agent-base` | `6.0.2` | MIT |
| `agent-base` | `7.1.4` | MIT |
| `anynum` | `1.0.1` | MIT |
| `array-flatten` | `1.1.1` | MIT |
| `assertion-error` | `2.0.1` | MIT |
| `asynckit` | `0.4.0` | MIT |
| `atomic-sleep` | `1.0.0` | MIT |
| `axios` | `1.19.0` | MIT |
| `base64-js` | `1.5.1` | MIT |
| `bignumber.js` | `9.3.1` | MIT |
| `body-parser` | `1.20.8` | MIT |
| `bowser` | `2.14.1` | MIT |
| `buffer-equal-constant-time` | `1.0.1` | BSD-3-Clause |
| `bytes` | `3.1.2` | MIT |
| `cac` | `6.7.14` | MIT |
| `call-bind-apply-helpers` | `1.0.2` | MIT |
| `call-bound` | `1.0.4` | MIT |
| `chai` | `5.3.3` | MIT |
| `check-error` | `2.1.3` | MIT |
| `cluster-key-slot` | `1.1.2` | Apache-2.0 |
| `combined-stream` | `1.0.8` | MIT |
| `content-disposition` | `0.5.4` | MIT |
| `content-type` | `1.0.5` | MIT |
| `cookie-signature` | `1.0.7` | MIT |
| `cookie` | `0.7.2` | MIT |
| `data-uri-to-buffer` | `4.0.1` | MIT |
| `debug` | `2.6.9` | MIT |
| `debug` | `4.4.3` | MIT |
| `debug` | `4.4.3` | MIT |
| `debug` | `4.4.3` | MIT |
| `debug` | `4.4.3` | MIT |
| `debug` | `4.4.3` | MIT |
| `deep-eql` | `5.0.2` | MIT |
| `delayed-stream` | `1.0.0` | MIT |
| `denque` | `2.1.0` | Apache-2.0 |
| `depd` | `2.0.0` | MIT |
| `destroy` | `1.2.0` | MIT |
| `dotenv` | `16.6.1` | BSD-2-Clause |
| `dunder-proto` | `1.0.1` | MIT |
| `ecdsa-sig-formatter` | `1.0.11` | Apache-2.0 |
| `ee-first` | `1.1.1` | MIT |
| `encodeurl` | `2.0.0` | MIT |
| `es-define-property` | `1.0.1` | MIT |
| `es-errors` | `1.3.0` | MIT |
| `es-module-lexer` | `1.7.0` | MIT |
| `es-object-atoms` | `1.1.2` | MIT |
| `es-set-tostringtag` | `2.1.0` | MIT |
| `esbuild` | `0.28.2` | MIT |
| `escape-html` | `1.0.3` | MIT |
| `estree-walker` | `3.0.3` | MIT |
| `etag` | `1.8.1` | MIT |
| `expect-type` | `1.3.0` | Apache-2.0 |
| `express` | `4.22.3` | MIT |
| `extend` | `3.0.2` | MIT |
| `fast-xml-builder` | `1.3.1` | MIT |
| `fast-xml-parser` | `5.11.0` | MIT |
| `fdir` | `6.5.0` | MIT |
| `fetch-blob` | `3.2.0` | MIT |
| `finalhandler` | `1.3.2` | MIT |
| `follow-redirects` | `1.16.0` | MIT |
| `form-data` | `4.0.6` | MIT |
| `formdata-polyfill` | `4.0.10` | MIT |
| `forwarded` | `0.2.0` | MIT |
| `fresh` | `0.5.2` | MIT |
| `function-bind` | `1.1.2` | MIT |
| `gaxios` | `7.1.4` | Apache-2.0 |
| `gcp-metadata` | `8.1.2` | Apache-2.0 |
| `get-caller-file` | `2.0.5` | ISC |
| `get-intrinsic` | `1.3.0` | MIT |
| `get-proto` | `1.0.1` | MIT |
| `google-auth-library` | `10.6.2` | Apache-2.0 |
| `google-logging-utils` | `1.1.3` | Apache-2.0 |
| `googleapis-common` | `8.0.2-rc.0` | Apache-2.0 |
| `googleapis` | `150.0.1` | Apache-2.0 |
| `gopd` | `1.2.0` | MIT |
| `has-symbols` | `1.1.0` | MIT |
| `has-tostringtag` | `1.0.2` | MIT |
| `hasown` | `2.0.4` | MIT |
| `http-errors` | `2.0.1` | MIT |
| `https-proxy-agent` | `5.0.1` | MIT |
| `https-proxy-agent` | `7.0.6` | MIT |
| `iconv-lite` | `0.4.24` | MIT |
| `inherits` | `2.0.4` | ISC |
| `ioredis` | `5.10.1` | MIT |
| `ipaddr.js` | `1.9.1` | MIT |
| `is-unsafe` | `2.0.2` | MIT |
| `js-tokens` | `9.0.1` | MIT |
| `json-bigint` | `1.0.0` | MIT |
| `jwa` | `2.0.1` | MIT |
| `jws` | `4.0.1` | MIT |
| `lodash.defaults` | `4.2.0` | MIT |
| `lodash.isarguments` | `3.1.0` | MIT |
| `loupe` | `3.2.1` | MIT |
| `magic-string` | `0.30.21` | MIT |
| `math-intrinsics` | `1.1.0` | MIT |
| `media-typer` | `0.3.0` | MIT |
| `merge-descriptors` | `1.0.3` | MIT |
| `methods` | `1.1.2` | MIT |
| `mime-db` | `1.52.0` | MIT |
| `mime-types` | `2.1.35` | MIT |
| `mime` | `1.6.0` | MIT |
| `ms` | `2.0.0` | MIT |
| `ms` | `2.1.3` | MIT |
| `ms` | `2.1.3` | MIT |
| `ms` | `2.1.3` | MIT |
| `ms` | `2.1.3` | MIT |
| `ms` | `2.1.3` | MIT |
| `ms` | `2.1.3` | MIT |
| `nanoid` | `3.3.18` | MIT |
| `negotiator` | `0.6.3` | MIT |
| `node-domexception` | `1.0.0` | MIT |
| `node-fetch` | `3.3.2` | MIT |
| `object-inspect` | `1.13.4` | MIT |
| `on-exit-leak-free` | `2.1.2` | MIT |
| `on-finished` | `2.4.1` | MIT |
| `parseurl` | `1.3.3` | MIT |
| `path-expression-matcher` | `1.6.2` | MIT |
| `path-to-regexp` | `0.1.13` | MIT |
| `pathe` | `2.0.3` | MIT |
| `pathval` | `2.0.1` | MIT |
| `pg-cloudflare` | `1.3.0` | MIT |
| `pg-connection-string` | `2.12.0` | MIT |
| `pg-int8` | `1.0.1` | ISC |
| `pg-pool` | `3.13.0` | MIT |
| `pg-protocol` | `1.13.0` | MIT |
| `pg-types` | `2.2.0` | MIT |
| `pg` | `8.20.0` | MIT |
| `pgpass` | `1.0.5` | MIT |
| `picocolors` | `1.1.1` | ISC |
| `picomatch` | `4.0.5` | MIT |
| `pino-abstract-transport` | `2.0.0` | MIT |
| `pino-http` | `10.5.0` | MIT |
| `pino-std-serializers` | `7.1.0` | MIT |
| `pino` | `9.14.0` | MIT |
| `postcss` | `8.5.26` | MIT |
| `postgres-array` | `2.0.0` | MIT |
| `postgres-bytea` | `1.0.1` | MIT |
| `postgres-date` | `1.0.7` | MIT |
| `postgres-interval` | `1.2.0` | MIT |
| `process-warning` | `5.0.0` | MIT |
| `proxy-addr` | `2.0.7` | MIT |
| `proxy-from-env` | `2.1.0` | MIT |
| `qs` | `6.16.0` | BSD-3-Clause |
| `quick-format-unescaped` | `4.0.4` | MIT |
| `range-parser` | `1.2.1` | MIT |
| `raw-body` | `2.5.3` | MIT |
| `real-require` | `0.2.0` | MIT |
| `redis-errors` | `1.2.0` | MIT |
| `redis-parser` | `3.0.0` | MIT |
| `rollup` | `4.62.5` | MIT |
| `safe-buffer` | `5.2.1` | MIT |
| `safe-stable-stringify` | `2.5.0` | MIT |
| `safer-buffer` | `2.1.2` | MIT |
| `send` | `0.19.2` | MIT |
| `serve-static` | `1.16.3` | MIT |
| `setprototypeof` | `1.2.0` | ISC |
| `side-channel-list` | `1.0.1` | MIT |
| `side-channel-map` | `1.0.1` | MIT |
| `side-channel-weakmap` | `1.0.2` | MIT |
| `side-channel` | `1.1.1` | MIT |
| `siginfo` | `2.0.0` | ISC |
| `sonic-boom` | `4.2.1` | MIT |
| `source-map-js` | `1.2.1` | BSD-3-Clause |
| `split2` | `4.2.0` | ISC |
| `stackback` | `0.0.2` | MIT |
| `standard-as-callback` | `2.1.0` | MIT |
| `statuses` | `2.0.2` | MIT |
| `std-env` | `3.10.0` | MIT |
| `strip-literal` | `3.1.0` | MIT |
| `strnum` | `2.4.2` | MIT |
| `thread-stream` | `3.1.0` | MIT |
| `tinybench` | `2.9.0` | MIT |
| `tinyexec` | `0.3.2` | MIT |
| `tinyglobby` | `0.2.17` | MIT |
| `tinypool` | `1.1.1` | MIT |
| `tinyrainbow` | `2.0.0` | MIT |
| `tinyspy` | `4.0.4` | MIT |
| `toidentifier` | `1.0.1` | MIT |
| `tslib` | `2.8.1` | 0BSD |
| `tsx` | `4.23.12` | MIT |
| `type-is` | `1.6.18` | MIT |
| `typescript` | `5.9.3` | Apache-2.0 |
| `undici-types` | `6.21.0` | MIT |
| `unpipe` | `1.0.0` | MIT |
| `url-template` | `2.0.8` | BSD-3-Clause (reviewed metadata override) |
| `utils-merge` | `1.0.1` | MIT |
| `vary` | `1.1.2` | MIT |
| `vite-node` | `3.2.4` | MIT |
| `vite` | `7.3.6` | MIT |
| `vitest` | `3.2.7` | MIT |
| `web-streams-polyfill` | `3.3.3` | MIT |
| `why-is-node-running` | `2.3.0` | MIT |
| `xml-naming` | `0.3.0` | MIT |
| `xtend` | `4.0.2` | MIT |
| `zod` | `3.25.76` | MIT |

## Operational requirement

Before each commercial release, regenerate the Node SBOM from the final lock,
run this generator, review every unknown or copyleft entry, and preserve all
upstream notices required by the exact artifacts actually distributed.