# Third-party dependencies
The project code is licensed as stated in [LICENSING.md](LICENSING.md).
Dependencies keep their own licenses. This source crate declares dependencies
through Cargo; it does not vendor their complete implementations.
## Reference dependency resolution
Inspected on 2026-10-21 against the prepared development `Cargo.lock`:
208 resolved packages, including this project, normal/build dependencies,
development dependencies and target-specific entries. This is a reference graph,
not proof of the contents of a particular executable. Library consumers may
resolve different versions; the lockfile is not committed by this library.
### Direct third-party dependencies
| [anyhow 1.0.98](https://crates.io/crates/anyhow/1.0.98) | MIT OR Apache-2.0 | Library |
| [chrono 0.4.41](https://crates.io/crates/chrono/0.4.41) | MIT OR Apache-2.0 | Library |
| [image 0.24.9](https://crates.io/crates/image/0.24.9) | MIT OR Apache-2.0 | Library |
| [pulldown-cmark 0.10.3](https://crates.io/crates/pulldown-cmark/0.10.3) | MIT | Library |
| [quick-xml 0.26.0](https://crates.io/crates/quick-xml/0.26.0) | MIT | Library |
| [scraper 0.18.1](https://crates.io/crates/scraper/0.18.1) | ISC | Library |
| [serde 1.0.228](https://crates.io/crates/serde/1.0.228) | MIT OR Apache-2.0 | Library |
| [serde_json 1.0.140](https://crates.io/crates/serde_json/1.0.140) | MIT OR Apache-2.0 | Library |
| [tempfile 3.20.0](https://crates.io/crates/tempfile/3.20.0) | MIT OR Apache-2.0 | Test/development |
| [thiserror 1.0.69](https://crates.io/crates/thiserror/1.0.69) | MIT OR Apache-2.0 | Library |
| [tokio 1.45.1](https://crates.io/crates/tokio/1.45.1) | MIT | Library |
| [usvg 0.29.0](https://crates.io/crates/usvg/0.29.0) | MPL-2.0 | Library |
| [uuid 1.17.0](https://crates.io/crates/uuid/1.17.0) | Apache-2.0 OR MIT | Library |
| [zip 0.6.6](https://crates.io/crates/zip/0.6.6) | MIT | Library |
### Other ALGFORCE libraries
`xlsxcraft = "0.1.0"` is supplied separately under AGPL-3.0-only. It generates
embedded chart workbooks. It is included in the inventory and needs its own
appropriate authorization for proprietary integration.
## MPL-2.0 components
| [cssparser 0.31.2](https://crates.io/crates/cssparser/0.31.2) | scraper -> cssparser |
| [cssparser-macros 0.6.1](https://crates.io/crates/cssparser-macros/0.6.1) | scraper -> cssparser -> cssparser-macros |
| [dtoa-short 0.3.5](https://crates.io/crates/dtoa-short/0.3.5) | scraper -> cssparser -> dtoa-short |
| [selectors 0.25.0](https://crates.io/crates/selectors/0.25.0) | scraper -> selectors |
| [usvg 0.29.0](https://crates.io/crates/usvg/0.29.0) | Direct SVG/XML dependency |
A full copy of MPL-2.0 is in [licenses/MPL-2.0.txt](licenses/MPL-2.0.txt).
Retain applicable notices; distributed covered source, including changes, stays
under MPL. Recipients of compiled MPL components need access to the corresponding
MPL source. See [MPL sections 3.1-3.4](https://www.mozilla.org/en-US/MPL/2.0/).
No MPL dependency is relicensed by this project's AGPL declaration or commercial
notice. Review secondary-license provisions separately if using that route.
## Other license expressions
Preserve `OR` choices and `AND` requirements rather than treating them as the
same operation. For example, `unicode-ident` declares
`(MIT OR Apache-2.0) AND Unicode-3.0`: the Unicode notice remains relevant when
selecting a code-license alternative. The inspected `r-efi` package offers
MIT/Apache alternatives in addition to LGPL; record the applicable choice and
target scope before drawing conclusions about that license expression.
## Generate an inventory for a release
The maintainer tool uses Rust and existing dependencies; no extra runtime is
needed. From this repository root:
```bash
cargo run --example license_inventory -- --check-package
```
For a cached build, add `--offline` to both Cargo and the tool:
```bash
cargo run --locked --offline --example license_inventory -- --offline --check-package
```
Optionally pass `--target <Rust-target-triple>` after `--` to filter the metadata
graph for a release target. The tool writes a fresh directory under ignored
`target/license-inventory/` and prints its path. It contains `inventory.json`,
the resolving `Cargo.lock` and discovered upstream license/notice files.
No local source directory paths are recorded in the JSON inventory.
Review `missingNoticeFiles`, license alternatives, source-file headers and
bundled native code. The tool collects available notices; it does not certify
compliance or create a corresponding-source archive. For distributed binaries,
provide the required source and notices for the actual release and retain an
accessible source location. See [RELEASING.md](RELEASING.md).