f08055c7ae
Upgrade the JavaScript bundles inlined into the offline HTML export: DOMPurify 3.1.7 -> 3.4.9 (clears 10 OSV advisories), marked 12.0.2 -> 18.0.5, highlight.js 11.9.0 -> 11.11.1. mermaid 10.9.6 and MathJax 3.2.2 are kept (no known CVEs) and now guarded rather than chased. Pin every bundle in assets/web_export/MANIFEST.json (npm name, version, source, sha256, licence) and add tool/check_bundled_js.dart: it verifies each file still matches the manifest hash and queries the OSV database for known vulnerabilities. Wired as `make deps-check`, into `check-full`, and into CI next to the licence check. THIRD_PARTY_NOTICES.md updated for the now-standalone DOMPurify bundle. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
80 lines
3.5 KiB
Markdown
80 lines
3.5 KiB
Markdown
# Third-Party Notices
|
|
|
|
OciDeck is licensed under the EUPL-1.2 (see [`LICENSE.md`](LICENSE.md)). It
|
|
builds on, and bundles, third-party components that remain under their own
|
|
licences. This file lists them; each component's full licence text is available
|
|
from its project or package page.
|
|
|
|
## Bundled runtime assets
|
|
|
|
Shipped inside the app and embedded into the **offline HTML export**
|
|
(`assets/web_export/`) and the UI:
|
|
|
|
| Component | Used for | Licence |
|
|
| --- | --- | --- |
|
|
| [marked](https://github.com/markedjs/marked) | Markdown → HTML in the export | MIT |
|
|
| [highlight.js](https://github.com/highlightjs/highlight.js) | Code highlighting in the export | BSD-3-Clause |
|
|
| [DOMPurify](https://github.com/cure53/DOMPurify) | Sanitises the rendered Markdown before it hits the DOM in the export | Apache-2.0 / MPL-2.0 |
|
|
| [Mermaid](https://github.com/mermaid-js/mermaid) | Diagrams in the export | MIT |
|
|
| [MathJax](https://github.com/mathjax/MathJax) (`tex-svg.js`) | Math rendering in the export | Apache-2.0 |
|
|
| [EB Garamond](https://github.com/octaviopardo/EBGaramond12) font | Bundled deck font | SIL Open Font License 1.1 |
|
|
|
|
The exact pinned version, source URL and SHA-256 of every vendored JS bundle
|
|
live in [`assets/web_export/MANIFEST.json`](assets/web_export/MANIFEST.json).
|
|
`make deps-check` verifies each file still matches that manifest and queries the
|
|
[OSV](https://osv.dev) database for known vulnerabilities.
|
|
|
|
## Vendored (forked) plugins
|
|
|
|
Kept in `third_party/` and wired in via `pubspec.yaml` (path dependency /
|
|
`dependency_overrides`). Both are forks of upstream plugins with local native
|
|
changes; see [`docs/ARCHITECTURE.md`](docs/ARCHITECTURE.md#vendored-forks).
|
|
|
|
| Component | Origin | Licence | Local changes |
|
|
| --- | --- | --- | --- |
|
|
| `desktop_multi_window` | [MixinNetwork/flutter-plugins](https://github.com/MixinNetwork/flutter-plugins) | MIT | Added native macOS window placement/fullscreen/close methods for the dual-screen presenter |
|
|
| `screen_retriever_macos` | [leanflutter/screen_retriever](https://github.com/leanflutter/screen_retriever) | MIT | Packaging fix for recent Xcode/CocoaPods |
|
|
|
|
## Dart & Flutter packages
|
|
|
|
Direct dependencies (see `pubspec.yaml` for exact version constraints). Each is
|
|
distributed under its own OSI-approved licence as published on
|
|
[pub.dev](https://pub.dev); most are MIT, BSD-3-Clause, or Apache-2.0.
|
|
|
|
- `flutter`, `flutter_localizations` (Flutter SDK — BSD-3-Clause)
|
|
- `flutter_riverpod`
|
|
- `file_picker`
|
|
- `path_provider`, `path`
|
|
- `uuid`
|
|
- `screen_retriever`, `window_manager`
|
|
- `shared_preferences`
|
|
- `pasteboard`
|
|
- `pdf`
|
|
- `archive`
|
|
- `video_player`
|
|
- `characters`
|
|
- `url_launcher`
|
|
- `desktop_drop`
|
|
- `image`
|
|
- `flutter_highlight`, `highlight`
|
|
- `flutter_math_fork`
|
|
- `wakelock_plus`
|
|
- `fl_chart`
|
|
- `cupertino_icons`
|
|
|
|
> To regenerate an authoritative, version-pinned licence inventory you can use a
|
|
> tool such as `flutter pub deps` together with a licence-collection package.
|
|
|
|
## Licence audit
|
|
|
|
A scan of all resolved Dart/Flutter packages (direct **and** transitive) and the
|
|
bundled assets found only OSI-approved open-source licences — MIT, BSD
|
|
(2-/3-Clause), Apache-2.0, MPL-2.0, and the SIL Open Font License 1.1. No
|
|
proprietary or source-unavailable components are included. (The only MPL-2.0
|
|
dependency is `dbus`, used on Linux.) Re-run such a scan after changing
|
|
dependencies.
|
|
|
|
Run it yourself with `make licenses` (or `dart run tool/check_licenses.dart`).
|
|
The policy, method, and latest result are documented in
|
|
[`docs/LICENSE_COMPLIANCE.md`](docs/LICENSE_COMPLIANCE.md).
|
|
|