# Third-Party Notices

Label Castle vendors the following third-party code and fonts under `js/`
and `fonts/` rather than installing them from npm, so the app works fully
offline (see `docs/current-state.md`, Tech Stack). This file records what's
vendored, its version, and its license, per each project's own terms.

## PapaParse

- **File:** `js/papaparse.min.js`
- **Version:** 5.4.1
- **License:** MIT
- **Source:** https://www.papaparse.com/

## JsBarcode

- **File:** `js/JsBarcode.all.min.js`
- **Version:** 3.11.5
- **License:** MIT
- **Source:** https://github.com/lindell/JsBarcode

## QRCode.js

- **File:** `js/qrcode.min.js`
- **Version:** no tagged release exists upstream (checked September 2026:
  no git tags, no GitHub releases). The only version signal in the source
  repo is `bower.json`'s `"version": "0.0.1"` — recorded here as that
  field's value, not as a confirmed release version. Our vendored copy is
  byte-identical to upstream commit
  `04f46c6a0708418cb7b96fc563eacae0fbf77674` (the tip of `master` at time
  of comparison), which is the more reliable reference point.
- **License:** MIT
- **Source:** https://github.com/davidshimjs/qrcodejs
- Wraps Kazuhiko Arase's QR code implementation; both attributions are
  carried in the license banner restored at the top of the vendored file.

## DOMPurify

- **Files:** `js/dompurify.min.js`, `js/DOMPurify-LICENSE.txt`
- **Version:** 3.4.15
- **License:** Apache-2.0 OR MPL-2.0 (dual-licensed; `js/DOMPurify-LICENSE.txt`
  carries the Apache-2.0 text)
- **Source:** https://github.com/cure53/DOMPurify
- Used to sanitize saved cell HTML from project files and autosave before it
  ever reaches `innerHTML` — see `docs/current-state.md`, State model
  ("Untrusted input").

## SheetJS Community Edition

- **Files:** `js/xlsx.full.min.js`, `js/SheetJS-LICENSE.txt`
- **Version:** 0.20.3
- **License:** Apache-2.0
- **Source:** https://cdn.sheetjs.com/ (the `xlsx-0.20.3.tgz` tarball's
  `package/dist/xlsx.full.min.js` and `package/LICENSE`, byte-identical;
  SHA-256 of the script
  `cc015130aa8521e7f088f88898eba949ccdcbfb38df0bd129b44b7273c3a6f41`).
  Not the npm `xlsx` package, which stopped at 0.18.5 and has known
  vulnerabilities.
- The full build rather than `xlsx.mini.min.js`: mini can't read legacy
  `.xls` or `.xlsb` workbooks. Used to read Excel and other spreadsheet
  files in the browser, alongside PapaParse for CSV.

## Atkinson Hyperlegible Next

- **Files:** `fonts/AtkinsonHyperlegibleNext-Variable.woff2`,
  `fonts/AtkinsonHyperlegibleNext-OFL.txt`
- **License:** SIL Open Font License 1.1
- **Source:** https://github.com/googlefonts/atkinson-hyperlegible-next

## Fredoka

- **Files:** `fonts/Fredoka-Variable.woff2`, `fonts/Fredoka-OFL.txt`
- **License:** SIL Open Font License 1.1
- **Source:** https://github.com/hafontia-zz/Fredoka-One
- Vendored as a subset (Latin + Latin Extended, wght axis only) — see
  `docs/current-state.md`, Tech Stack for details.