# Dependencies and licenses

## Current production WASM

Rust versions are pinned in `wasm-core/Cargo.lock`. All 71 registry archives, including host/build/other-target packages, were checked against lockfile checksums and extracted sources; no third-party source edits were found. See `validation/wasm/dependency-audit.json`. The lockfile is larger than the set linked into WASM. License copies and declared SPDX expressions are in [licenses/rust/index.json](licenses/rust/index.json); target-only r-efi supplies its declaration in its README. C libraries and compiler runtime licenses are also copied to `licenses/`.

| Component | Frozen version | Role | License |
| --- | --- | --- | --- |
| libxml2 / Rust libxml | 2.14.6 / 0.3.22 | XML, namespaces, XPath, reader, content parser | MIT |
| PCRE2 / Rust pcre2 | 10.42 / 0.2.11 | Regex without JIT | BSD-3-Clause with PCRE2 exception / Unlicense OR MIT |
| zip | 9.1.0 | Archive parsing, CRC, input checks | MIT |
| flate2 / zlib via libz-sys | 1.1.10 / 1.3.2 via 1.1.30 | DEFLATE | MIT OR Apache-2.0 / Zlib |
| lz4_flex | 0.14.0 | Paragraph/finding snapshots | MIT |
| sha2 | 0.11.1 | SHA-256 | MIT OR Apache-2.0 |
| siphasher | 1.0.1 | Compact lookup | MIT OR Apache-2.0 |
| serde / serde_json | 1.0.228 / 1.0.154 | Rules and reports | MIT OR Apache-2.0 |
| Rust standard library | 1.90.0 wasm32-unknown-emscripten | Language, allocator, collections, exceptions | MIT OR Apache-2.0; see COPYRIGHT |
| Emscripten | 4.0.15 | WASM linking, libc, generated JS loader | MIT OR NCSA; bundled components per its LICENSE |

`wasm-generated/core.mjs` is the unmodified Emscripten-generated loader. `core.wasm` contains our counted Rust sources and these libraries. No runtime filesystem, HTTP client, Python interpreter or server document processing is used. Libxml2 retains iconv, XPath, reader and output; HTTP, Python, tests and C threading are disabled. PCRE2 is 8-bit, without JIT. Updates require repeating business assertions, hostile-input rejection, actual browser outputs and independent package/schema validation.

The copied ThesisFlow Rust document core, custom ZIP preservation crate and browser ABI are our own code and fully counted. Binary size does not replace source-line counting.

## Preserved JS reference and development tools

These packages remain pinned with npm integrity hashes for the previous JS baseline and its tests. They are **not imported by the current production Worker**; `dist/build-meta.json` records the actual module graph. Existing license copies remain in `licenses/`.

| Component | Version | Reference role | License |
| --- | --- | --- | --- |
| libxml2-wasm | 0.7.2 | Previous XML adapter | MIT |
| pcre2-wasm | 10.49.2 | Previous regex adapter | MIT; PCRE2 BSD-3-Clause with exception |
| hash-wasm | 4.12.0 | Previous SHA-256/CRC32 | MIT |
| fflate | 0.8.3 | Previous ZIP streaming | MIT |
| pako | 2.1.0 | Previous ZIP/snapshot compression | MIT AND Zlib |
| saxes / xmlchars | 6.0.0 / 2.2.0 | Previous XML audit | ISC / MIT |
| Transcrypt | 3.9.5 | Previous JS generator/runtime | Apache-2.0 |
| Wrangler | 4.154.0 | Pages local validation and CI deployment tool; not shipped to browsers | MIT OR Apache-2.0 |
| esbuild | 0.28.2 | Current build tool | MIT |
| playwright-core | 1.64.1 | Browser tests/measurements | Apache-2.0 |
| Prettier | 3.9.10 | Formatting | MIT |
| Google GTS | 7.0.0 | Google ESLint / Prettier configuration | Apache-2.0 |
| ESLint / @eslint/js | 10.13.0 / 10.0.1 | JavaScript lint and recommended rules | MIT |
| @stylistic/eslint-plugin | 5.10.0 | One statement per line enforcement | MIT |
| Espree | 10.4.0 | Bounded style-transition AST comparison | BSD-2-Clause |
| globals | 17.13.0 | Separate page, Worker and Node lint environments | MIT |
| TypeScript | 5.9.3 | GTS development peer dependency; no TS runtime | Apache-2.0 |

GTS resolves ESLint and @eslint/js to the project's pinned versions through npm overrides; its temporary-file dependency is overridden to tmp 0.2.7 (MIT). These are development tools only. The resolved configuration was exercised against every current production JS source, and the final npm audit reports zero vulnerabilities. See [STYLE-AUDIT.md](STYLE-AUDIT.md) for scope and the separate clean-code findings.

The Rust formatting comparator in `tests/rust-style-equivalence/` pins syn 2.0.119, proc-macro2 1.0.107 and quote 1.0.47 (MIT OR Apache-2.0), plus unicode-ident 1.0.27 ((MIT OR Apache-2.0) AND Unicode-3.0), in its own Cargo.lock. They parse and compare source only during development; they do not add production dependencies or enter the WASM. Production Cargo.toml and Cargo.lock are unchanged by formatting. See [RUST-FORMAT.md](RUST-FORMAT.md) for the bounded comparison and runtime regression evidence.

The previous `generated/engine.js` is application business code. It is not counted again because it does not execute in this candidate; original counts and baseline evidence are retained in earlier reports. Third-party compiler output is excluded only when unmodified; all our runtime adaptations are counted.