# Third-party components

## Shipped in the application

Runtime dependencies packaged into the installer.

| Component | Version | Licence | Source |
|---|---|---|---|
| `exceljs` | 4.4.0 | MIT | npm |
| `pdfjs-dist` | 6.2.108 | Apache-2.0 | npm |
| `pptxgenjs` | 4.0.1 | MIT | npm |
| `pikepdf` | 9.11.0 | see project | PyPI |
| `pypdfium2` | 5.12.1 | see project | PyPI |
| `Pillow` | 11.3.0 | see project | PyPI |
| `openpyxl` | 3.1.5 | see project | PyPI |
| `xlrd` | 2.0.2 | see project | PyPI |
| `Electron` | 43.2.0 | MIT | npm (runtime shell) |
| `qpdf` | bundled with pikepdf | Apache-2.0 | native |
| `Tesseract OCR` | bundled, optional | Apache-2.0 | native |
| `libleptonica`, `libarchive`, `OpenSSL (libcrypto)`, `libtiff`, `libpng`, `libjpeg`, `libwebp`, `giflib`, `zstd`, `ICU` and related | vendored with Tesseract | BSD / Apache-2.0 / zlib-style | native, bundled per platform |

Python itself is embedded in the frozen sidecar (PyInstaller, GPL-exempt
bootloader licence) and is not installed on the customer's machine.

## Build-time only

11 development dependencies are used to build the
application and are **not** present in the installed product. Electron is the
exception: it is a build-time dependency that ships as the runtime shell.

## Full resolved tree

738 packages are resolved by the committed lockfile, of which
85 are platform-specific binaries -- only the ones matching a given
machine are ever installed on it. The complete list with versions and declared
licences is in `sbom.json` beside this document, and the resolved tree with
integrity hashes is in `package-lock.json` in the repository.

The inventory is generated from that lockfile rather than from an installed
`node_modules`, so it describes the same set of components whichever platform
the build ran on.