License texts are copied from installed packages or identified upstream sources. Their copyright wording is retained. A missing notice or an unconfirmed version remains marked for review; no replacement permission is invented.
The index loads when this section is reached. The downloads work without JavaScript.
Scope and evidence
This is an installed production dependency graph, not a claim that every package is executed in the browser. Build tools, server SDKs and browser libraries have different roles. Platform-specific optional packages absent on the audit machine are listed separately in the JSON index. Each build regenerates notices for its actual installation.
The lock-file SHA-256 identifies the dependency input. Upstream snapshots name their source and revision; current-branch evidence is marked for version review. Source and asset changes are described in the related notices.
25d7cb44bba009004fa3af60d3c5211382b4b574ea5165f0162e917d6b21aa01Read project uses and acknowledgements · Report an attribution issue