Third-Party Software Notices
============================

This file lists the open-source components bundled with the FossID VS Code
extension (fossid-ide). It covers the JavaScript/TypeScript runtime
dependencies packaged into the extension host process.

The bundled scanner binary (`bin/fossid-mcp`) is the separately released
`fossid-toolbox` Rust executable. Its transitive Rust crate dependencies
and their license notices are published alongside each fossid-toolbox
release at https://github.com/fossid-ab/fossid-toolbox/releases.

-------------------------------------------------------------------------------

The following components are licensed under the MIT License
(https://opensource.org/licenses/MIT):

  @hono/node-server@1.19.14         https://github.com/honojs/node-server
  @modelcontextprotocol/sdk@1.29.0  https://github.com/modelcontextprotocol/typescript-sdk
  accepts@2.0.0                     https://github.com/jshttp/accepts
  ajv@8.20.0                        https://github.com/ajv-validator/ajv
  ajv-formats@3.0.1                 https://github.com/ajv-validator/ajv-formats
  body-parser@2.2.2                 https://github.com/expressjs/body-parser
  bytes@3.1.2                       https://github.com/visionmedia/bytes.js
  call-bind-apply-helpers@1.0.2     https://github.com/ljharb/call-bind-apply-helpers
  call-bound@1.0.4                  https://github.com/ljharb/call-bound
  content-disposition@1.1.0         https://github.com/jshttp/content-disposition
  content-type@1.0.5                https://github.com/jshttp/content-type
  cookie@0.7.2                      https://github.com/jshttp/cookie
  cookie-signature@1.2.2            https://github.com/visionmedia/node-cookie-signature
  cors@2.8.6                        https://github.com/expressjs/cors
  cross-spawn@7.0.6                 https://github.com/moxystudio/node-cross-spawn
  debug@4.4.3                       https://github.com/debug-js/debug
  depd@2.0.0                        https://github.com/dougwilson/nodejs-depd
  dunder-proto@1.0.1                https://github.com/es-shims/dunder-proto
  ee-first@1.1.1                    https://github.com/jonathanong/ee-first
  encodeurl@2.0.0                   https://github.com/pillarjs/encodeurl
  es-define-property@1.0.1          https://github.com/ljharb/es-define-property
  es-errors@1.3.0                   https://github.com/ljharb/es-errors
  es-object-atoms@1.1.1             https://github.com/ljharb/es-object-atoms
  escape-html@1.0.3                 https://github.com/component/escape-html
  etag@1.8.1                        https://github.com/jshttp/etag
  eventsource@3.0.7                 https://github.com/EventSource/eventsource
  eventsource-parser@3.0.8          https://github.com/rexxars/eventsource-parser
  express@5.2.1                     https://github.com/expressjs/express
  express-rate-limit@8.4.1          https://github.com/express-rate-limit/express-rate-limit
  fast-deep-equal@3.1.3             https://github.com/epoberezkin/fast-deep-equal
  finalhandler@2.1.1                https://github.com/pillarjs/finalhandler
  forwarded@0.2.0                   https://github.com/jshttp/forwarded
  fresh@2.0.0                       https://github.com/jshttp/fresh
  function-bind@1.1.2               https://github.com/Raynos/function-bind
  get-intrinsic@1.3.0               https://github.com/ljharb/get-intrinsic
  get-proto@1.0.1                   https://github.com/ljharb/get-proto
  gopd@1.2.0                        https://github.com/ljharb/gopd
  has-symbols@1.1.0                 https://github.com/inspect-js/has-symbols
  hasown@2.0.3                      https://github.com/inspect-js/hasOwn
  hono@4.12.15                      https://github.com/honojs/hono
  http-errors@2.0.1                 https://github.com/jshttp/http-errors
  iconv-lite@0.7.2                  https://github.com/pillarjs/iconv-lite
  ip-address@10.1.0                 https://github.com/beaugunderson/ip-address
  ipaddr.js@1.9.1                   https://github.com/whitequark/ipaddr.js
  is-promise@4.0.0                  https://github.com/then/is-promise
  jose@6.2.3                        https://github.com/panva/jose
  json-schema-traverse@1.0.0        https://github.com/epoberezkin/json-schema-traverse
  math-intrinsics@1.1.0             https://github.com/es-shims/math-intrinsics
  media-typer@1.1.0                 https://github.com/jshttp/media-typer
  merge-descriptors@2.0.0           https://github.com/sindresorhus/merge-descriptors
  mime-db@1.54.0                    https://github.com/jshttp/mime-db
  mime-types@3.0.2                  https://github.com/jshttp/mime-types
  ms@2.1.3                          https://github.com/vercel/ms
  negotiator@1.0.0                  https://github.com/jshttp/negotiator
  object-assign@4.1.1               https://github.com/sindresorhus/object-assign
  object-inspect@1.13.4             https://github.com/inspect-js/object-inspect
  on-finished@2.4.1                 https://github.com/jshttp/on-finished
  parseurl@1.3.3                    https://github.com/pillarjs/parseurl
  path-key@3.1.1                    https://github.com/sindresorhus/path-key
  path-to-regexp@8.4.2              https://github.com/pillarjs/path-to-regexp
  pkce-challenge@5.0.1              https://github.com/crouchcd/pkce-challenge
  proxy-addr@2.0.7                  https://github.com/jshttp/proxy-addr
  range-parser@1.2.1                https://github.com/jshttp/range-parser
  raw-body@3.0.2                    https://github.com/stream-utils/raw-body
  require-from-string@2.0.2         https://github.com/floatdrop/require-from-string
  router@2.2.0                      https://github.com/pillarjs/router
  safer-buffer@2.1.2                https://github.com/ChALkeR/safer-buffer
  send@1.2.1                        https://github.com/pillarjs/send
  serve-static@2.2.1                https://github.com/expressjs/serve-static
  shebang-command@2.0.0             https://github.com/kevva/shebang-command
  shebang-regex@3.0.0               https://github.com/sindresorhus/shebang-regex
  side-channel@1.1.0                https://github.com/ljharb/side-channel
  side-channel-list@1.0.1           https://github.com/ljharb/side-channel-list
  side-channel-map@1.0.1            https://github.com/ljharb/side-channel-map
  side-channel-weakmap@1.0.2        https://github.com/ljharb/side-channel-weakmap
  statuses@2.0.2                    https://github.com/jshttp/statuses
  toidentifier@1.0.1                https://github.com/component/toidentifier
  type-is@2.0.1                     https://github.com/jshttp/type-is
  unpipe@1.0.0                      https://github.com/stream-utils/unpipe
  vary@1.1.2                        https://github.com/jshttp/vary
  zod@4.3.6                         https://github.com/colinhacks/zod

-------------------------------------------------------------------------------

The following components are licensed under the ISC License
(https://opensource.org/licenses/ISC):

  inherits@2.0.4                    https://github.com/isaacs/inherits
  isexe@2.0.0                       https://github.com/isaacs/isexe
  once@1.4.0                        https://github.com/isaacs/once
  setprototypeof@1.2.0              https://github.com/wesleytodd/setprototypeof
  which@2.0.2                       https://github.com/isaacs/node-which
  wrappy@1.0.2                      https://github.com/npm/wrappy
  zod-to-json-schema@3.25.2         https://github.com/StefanTerdell/zod-to-json-schema

-------------------------------------------------------------------------------

The following components are licensed under the BSD 3-Clause License
(https://opensource.org/licenses/BSD-3-Clause):

  fast-uri@3.1.0                    https://github.com/fastify/fast-uri
  qs@6.15.1                         https://github.com/ljharb/qs

-------------------------------------------------------------------------------

The following components are licensed under the BSD 2-Clause License
(https://opensource.org/licenses/BSD-2-Clause):

  json-schema-typed@8.0.2           https://github.com/RemyRylan/json-schema-typed
