ChestnutChestnut website third-party notices
This software includes the components listed below, each used under the licence named beside it. Licence texts are not reproduced here; each licence is identified by its SPDX identifier and its full text is available from the SPDX licence list at spdx.org/licenses.
Components with a recorded decision (9)
certifi
MPL-2.0
Decision: Shipped unmodified inside the Python runtime. MPL-2.0 is file-level copyleft and reaches only files from the covered work; it does not extend to Chestnut's own source. The obligation is to make the covered source available, which upstream already does, and to reproduce this notice.
pathspec
MPL-2.0
Decision: A pure-Python gitignore-pattern matcher, imported unmodified inside the bundled Python runtime. Same reasoning as certifi: MPL-2.0 is file-level copyleft, reaches only files from the covered work, and does not extend to Chestnut's own source. Reproducing this notice and leaving upstream's source available is the whole obligation.
libffmpeg
LGPL-2.1-or-later
Decision: Electron's stock libffmpeg.dylib, shipped unmodified and dynamically linked, which is what LGPL section 6 permits for a proprietary work. The accompanying Chromium notices are shipped in this bundle.
@img/sharp-libvips-darwin-arm64
LGPL-3.0-or-later
Decision: libvips, pulled in by sharp for the website's build-time image optimisation. It runs on the build machine and is never sent to a browser, so no LGPL distribution obligation attaches through the website. It is listed anyway because the website page is generated from the whole production closure rather than from the true browser-served subset, which over-reports on purpose.
pyinstaller
GPL-2.0-only WITH Bootloader-exception
Decision: PyInstaller is a build tool: it is installed into the release virtual environment by requirements-build.txt and runs at package time, and no part of it except the bootloader is copied into the shipped app. It is listed here because the notices are collected from that environment rather than from the observed bundle contents, so they over-report build tooling. The bootloader that IS shipped has its own entry below, and its linking exception is what makes shipping it permissible.
PyInstaller bootloader
GPL-2.0-or-later WITH Bootloader-exception
Decision: Compiled into every shipped launcher. Upstream's linking exception exists for exactly this case and permits distributing the bootloader bound to a proprietary application without extending the GPL to it. Recorded deliberately rather than relied on by accident.
Inter
OFL-1.1
Decision: A font family, embedded and served as-is. OFL-1.1 permits bundling with software of any licence; the reserved-name and no-sale-on-its-own terms are both met. Requires this notice.
node-pty (native)
MIT
Decision: The compiled native side of node-pty, which ships as a .node binary outside the archive rather than as package source. Listed here because no manifest describes the built artifact. MIT imposes only attribution.
CPython and its statically linked libraries
PSF-2.0 with OpenSSL, SQLite, libffi and zlib
Decision: The interpreter PyInstaller bundles, together with the libraries CPython links statically. None is reciprocal: SQLite is public domain, zlib and libffi are permissive, and OpenSSL 3 is Apache-2.0. Attribution only.
Packages (222)
| Component | Version | Licence |
|---|---|---|
| @aws-crypto/sha256-browser | 5.2.0 | Apache-2.0 |
| @aws-crypto/sha256-js | 5.2.0 | Apache-2.0 |
| @aws-crypto/supports-web-crypto | 5.2.0 | Apache-2.0 |
| @aws-crypto/util | 5.2.0 | Apache-2.0 |
| @aws-sdk/checksums | 3.1000.26 | Apache-2.0 |
| @aws-sdk/client-cloudwatch | 3.1118.0 | Apache-2.0 |
| @aws-sdk/client-cognito-identity-provider | 3.1070.0 | Apache-2.0 |
| @aws-sdk/client-dynamodb | 3.1069.0 | Apache-2.0 |
| @aws-sdk/client-s3 | 3.1106.0 | Apache-2.0 |
| @aws-sdk/client-sesv2 | 3.1106.0 | Apache-2.0 |
| @aws-sdk/client-sts | 3.1069.0 | Apache-2.0 |
| @aws-sdk/core | 3.977.9 | Apache-2.0 |
| @aws-sdk/credential-provider-env | 3.972.70 | Apache-2.0 |
| @aws-sdk/credential-provider-http | 3.972.72 | Apache-2.0 |
| @aws-sdk/credential-provider-ini | 3.973.15 | Apache-2.0 |
| @aws-sdk/credential-provider-login | 3.972.77 | Apache-2.0 |
| @aws-sdk/credential-provider-node | 3.972.81 | Apache-2.0 |
| @aws-sdk/credential-provider-process | 3.972.70 | Apache-2.0 |
| @aws-sdk/credential-provider-sso | 3.973.14 | Apache-2.0 |
| @aws-sdk/credential-provider-web-identity | 3.972.76 | Apache-2.0 |
| @aws-sdk/dynamodb-codec | 3.973.21 | Apache-2.0 |
| @aws-sdk/endpoint-cache | 3.972.8 | Apache-2.0 |
| @aws-sdk/lib-dynamodb | 3.1069.0 | Apache-2.0 |
| @aws-sdk/middleware-endpoint-discovery | 3.972.19 | Apache-2.0 |
| @aws-sdk/middleware-sdk-s3 | 3.972.72 | Apache-2.0 |
| @aws-sdk/nested-clients | 3.997.44 | Apache-2.0 |
| @aws-sdk/s3-request-presigner | 3.1106.0 | Apache-2.0 |
| @aws-sdk/signature-v4-multi-region | 3.996.46 | Apache-2.0 |
| @aws-sdk/token-providers | 3.1116.0 | Apache-2.0 |
| @aws-sdk/types | 3.974.5 | Apache-2.0 |
| @aws-sdk/util-dynamodb | 3.996.5 | Apache-2.0 |
| @aws-sdk/util-locate-window | 3.965.8 | Apache-2.0 |
| @aws-sdk/xml-builder | 3.972.40 | Apache-2.0 |
| @aws/lambda-invoke-store | 0.3.0 | Apache-2.0 |
| @fontsource-variable/inter | 5.2.8 | OFL-1.1 |
| @img/colour | 1.1.0 | MIT |
| @img/sharp-darwin-arm64 | 0.35.5 | Apache-2.0 |
| @img/sharp-libvips-darwin-arm64 | 1.3.4 | LGPL-3.0-or-later |
| @next/env | 16.4.2 | MIT |
| @next/swc-darwin-arm64 | 16.4.2 | MIT |
| @playwright/test | 1.60.0 | Apache-2.0 |
| @radix-ui/primitive | 1.1.4 | MIT |
| @radix-ui/react-accordion | 1.2.14 | MIT |
| @radix-ui/react-collapsible | 1.1.14 | MIT |
| @radix-ui/react-collection | 1.1.10 | MIT |
| @radix-ui/react-compose-refs | 1.1.2 | MIT |
| @radix-ui/react-compose-refs | 1.1.3 | MIT |
| @radix-ui/react-context | 1.1.4 | MIT |
| @radix-ui/react-direction | 1.1.2 | MIT |
| @radix-ui/react-id | 1.1.2 | MIT |
| @radix-ui/react-label | 2.1.7 | MIT |
| @radix-ui/react-presence | 1.1.6 | MIT |
| @radix-ui/react-primitive | 2.1.3 | MIT |
| @radix-ui/react-primitive | 2.1.6 | MIT |
| @radix-ui/react-slot | 1.2.3 | MIT |
| @radix-ui/react-slot | 1.3.0 | MIT |
| @radix-ui/react-use-controllable-state | 1.2.3 | MIT |
| @radix-ui/react-use-effect-event | 0.0.3 | MIT |
| @radix-ui/react-use-layout-effect | 1.1.2 | MIT |
| @smithy/core | 3.33.3 | Apache-2.0 |
| @smithy/credential-provider-imds | 4.5.2 | Apache-2.0 |
| @smithy/fetch-http-handler | 5.7.2 | Apache-2.0 |
| @smithy/is-array-buffer | 2.2.0 | Apache-2.0 |
| @smithy/middleware-compression | 4.6.2 | Apache-2.0 |
| @smithy/node-http-handler | 4.11.3 | Apache-2.0 |
| @smithy/signature-v4 | 5.6.12 | Apache-2.0 |
| @smithy/types | 4.17.2 | Apache-2.0 |
| @smithy/util-buffer-from | 2.2.0 | Apache-2.0 |
| @smithy/util-utf8 | 2.3.0 | Apache-2.0 |
| @swc/helpers | 0.5.23 | Apache-2.0 |
| @types/debug | 4.1.13 | MIT |
| @types/estree | 1.0.9 | MIT |
| @types/estree-jsx | 1.0.5 | MIT |
| @types/hast | 3.0.4 | MIT |
| @types/mdast | 4.0.4 | MIT |
| @types/ms | 2.1.0 | MIT |
| @types/node | 24.19.0 | MIT |
| @types/react | 19.2.17 | MIT |
| @types/react-dom | 19.2.3 | MIT |
| @types/unist | 2.0.11 | MIT |
| @types/unist | 3.0.3 | MIT |
| @ungap/structured-clone | 1.3.2 | ISC |
| @vercel/analytics | 2.0.1 | MIT |
| @vercel/cli-config | 0.2.0 | Apache-2.0 |
| @vercel/cli-exec | 0.1.1 | Apache-2.0 |
| @vercel/oidc | 3.6.1 | Apache-2.0 |
| @vercel/oidc-aws-credentials-provider | 3.1.4 | Apache-2.0 |
| argparse | 1.0.10 | MIT |
| aws-jwt-verify | 5.2.1 | Apache-2.0 |
| bail | 2.0.2 | MIT |
| baseline-browser-mapping | 2.11.27 | Apache-2.0 |
| bowser | 2.14.1 | MIT |
| caniuse-lite | 1.0.30001814 | CC-BY-4.0 |
| ccount | 2.0.1 | MIT |
| character-entities | 2.0.2 | MIT |
| character-entities-html4 | 2.1.0 | MIT |
| character-entities-legacy | 3.0.0 | MIT |
| character-reference-invalid | 2.0.1 | MIT |
| class-variance-authority | 0.7.1 | Apache-2.0 |
| client-only | 0.0.1 | MIT |
| clsx | 2.1.1 | MIT |
| comma-separated-tokens | 2.0.3 | MIT |
| cross-spawn | 7.0.6 | MIT |
| csstype | 3.2.3 | MIT |
| debug | 4.4.3 | MIT |
| decode-named-character-reference | 1.3.0 | MIT |
| dequal | 2.0.3 | MIT |
| detect-libc | 2.1.2 | Apache-2.0 |
| devlop | 1.1.0 | MIT |
| esprima | 4.0.1 | BSD-2-Clause |
| estree-util-is-identifier-name | 3.0.0 | MIT |
| execa | 5.1.1 | MIT |
| extend | 3.0.2 | MIT |
| extend-shallow | 2.0.1 | MIT |
| fflate | 0.8.3 | MIT |
| fsevents | 2.3.2 | MIT |
| get-stream | 6.0.1 | MIT |
| gray-matter | 4.0.3 | MIT |
| hast-util-to-jsx-runtime | 2.3.6 | MIT |
| hast-util-whitespace | 3.0.0 | MIT |
| html-url-attributes | 3.0.1 | MIT |
| human-signals | 2.1.0 | Apache-2.0 |
| inline-style-parser | 0.2.7 | MIT |
| is-alphabetical | 2.0.1 | MIT |
| is-alphanumerical | 2.0.1 | MIT |
| is-decimal | 2.0.1 | MIT |
| is-extendable | 0.1.1 | MIT |
| is-hexadecimal | 2.0.1 | MIT |
| is-plain-obj | 4.1.0 | MIT |
| is-stream | 2.0.1 | MIT |
| isexe | 2.0.0 | ISC |
| jose | 5.10.0 | MIT |
| js-yaml | 3.15.2 | MIT |
| kind-of | 6.0.3 | MIT |
| longest-streak | 3.1.0 | MIT |
| lucide-react | 0.577.0 | ISC |
| mdast-util-from-markdown | 2.0.3 | MIT |
| mdast-util-mdx-expression | 2.0.1 | MIT |
| mdast-util-mdx-jsx | 3.2.0 | MIT |
| mdast-util-mdxjs-esm | 2.0.1 | MIT |
| mdast-util-phrasing | 4.1.0 | MIT |
| mdast-util-to-hast | 13.2.1 | MIT |
| mdast-util-to-markdown | 2.1.2 | MIT |
| mdast-util-to-string | 4.0.0 | MIT |
| merge-stream | 2.0.0 | MIT |
| micromark | 4.0.2 | MIT |
| micromark-core-commonmark | 2.0.3 | MIT |
| micromark-factory-destination | 2.0.1 | MIT |
| micromark-factory-label | 2.0.1 | MIT |
| micromark-factory-space | 2.0.1 | MIT |
| micromark-factory-title | 2.0.1 | MIT |
| micromark-factory-whitespace | 2.0.1 | MIT |
| micromark-util-character | 2.1.1 | MIT |
| micromark-util-chunked | 2.0.1 | MIT |
| micromark-util-classify-character | 2.0.1 | MIT |
| micromark-util-combine-extensions | 2.0.1 | MIT |
| micromark-util-decode-numeric-character-reference | 2.0.2 | MIT |
| micromark-util-decode-string | 2.0.1 | MIT |
| micromark-util-encode | 2.0.1 | MIT |
| micromark-util-html-tag-name | 2.0.1 | MIT |
| micromark-util-normalize-identifier | 2.0.1 | MIT |
| micromark-util-resolve-all | 2.0.1 | MIT |
| micromark-util-sanitize-uri | 2.0.1 | MIT |
| micromark-util-subtokenize | 2.1.0 | MIT |
| micromark-util-symbol | 2.0.1 | MIT |
| micromark-util-types | 2.0.2 | MIT |
| mimic-fn | 2.1.0 | MIT |
| mnemonist | 0.38.3 | MIT |
| ms | 2.1.3 | MIT |
| nanoid | 3.3.19 | MIT |
| next | 16.4.2 | MIT |
| npm-run-path | 4.0.1 | MIT |
| obliterator | 1.6.1 | MIT |
| onetime | 5.1.2 | MIT |
| os-paths | 4.4.0 | MIT |
| parse-entities | 4.0.2 | MIT |
| path-key | 3.1.1 | MIT |
| picocolors | 1.1.1 | ISC |
| playwright | 1.60.0 | Apache-2.0 |
| playwright-core | 1.60.0 | Apache-2.0 |
| postcss | 8.5.28 | MIT |
| property-information | 7.2.0 | MIT |
| react | 19.2.4 | MIT |
| react-dom | 19.2.4 | MIT |
| react-markdown | 10.1.0 | MIT |
| remark-parse | 11.0.0 | MIT |
| remark-rehype | 11.1.2 | MIT |
| scheduler | 0.27.0 | MIT |
| section-matter | 1.0.0 | MIT |
| semver | 7.8.5 | ISC |
| sharp | 0.35.5 | Apache-2.0 |
| shebang-command | 2.0.0 | MIT |
| shebang-regex | 3.0.0 | MIT |
| signal-exit | 3.0.7 | ISC |
| source-map-js | 1.2.2 | BSD-3-Clause |
| space-separated-tokens | 2.0.2 | MIT |
| sprintf-js | 1.0.3 | BSD-3-Clause |
| stringify-entities | 4.0.4 | MIT |
| strip-bom-string | 1.0.0 | MIT |
| strip-final-newline | 2.0.0 | MIT |
| stripe | 22.3.2 | MIT |
| style-to-js | 1.1.21 | MIT |
| style-to-object | 1.0.14 | MIT |
| styled-jsx | 5.1.6 | MIT |
| tailwind-merge | 3.3.1 | MIT |
| trim-lines | 3.0.1 | MIT |
| trough | 2.2.0 | MIT |
| tslib | 2.8.1 | 0BSD |
| undici-types | 7.24.6 | MIT |
| unified | 11.0.5 | MIT |
| unist-util-is | 6.0.1 | MIT |
| unist-util-position | 5.0.0 | MIT |
| unist-util-stringify-position | 4.0.0 | MIT |
| unist-util-visit | 5.1.0 | MIT |
| unist-util-visit-parents | 6.0.2 | MIT |
| vfile | 6.0.3 | MIT |
| vfile-message | 4.0.3 | MIT |
| which | 2.0.2 | ISC |
| xdg-app-paths | 5.5.1 | MIT |
| xdg-portable | 7.3.0 | MIT |
| zod | 4.6.7 | MIT |
| zwitch | 2.0.4 | MIT |