# Third-Party Notices

The browser VM feasibility implementation uses or is informed by the following
third-party projects. Exact dependency versions and review notes are recorded
in `.docs/dependency-review.md` and `.docs/vm-upstream-review.md`.

- **v86** (`0.5.432`, commit `f3d4472a9c934b9ad78a311f5849ba711a296d23`),
  BSD-2-Clause. The full notice is in
  `third_party/licenses/v86-BSD-2-Clause.txt`.
- **Berkeley SoftFloat** (Release 3e), embedded in v86 under BSD-3-Clause. The
  notice is in `third_party/licenses/v86-SoftFloat-BSD-3-Clause.txt`.
- **Zstandard** (`1.4.5` decompressor), embedded in v86 under the selected
  BSD-3-Clause option. The notice is in
  `third_party/licenses/v86-zstd-1.4.5-BSD-3-Clause.txt`.
- **QEMU floppy controller code**, adapted in v86 under MIT. The notice is in
  `third_party/licenses/v86-QEMU-Floppy-MIT.txt`.
- **xterm.js** (`@xterm/xterm` `6.0.0`, `@xterm/addon-fit` `0.11.0`, and
  `@xterm/addon-webgl` `0.19.0`), MIT. The full notice is in
  `third_party/licenses/xterm.js-MIT.txt`.
- **browser-shell**, MIT. Its lifecycle and terminal integration were reviewed
  as design input; its full attribution is in
  `third_party/licenses/browser-shell-MIT.txt`.
- **SeaBIOS** (`rel-1.16.2`), LGPL-3.0-or-later. The Nix guest output carries
  the full upstream license beside the pinned BIOS binaries. Production
  distribution must also provide the required corresponding-source and build
  information.
- **Iosevka Nerd Font** (`3.4.0+33.2.1` in the pinned nixpkgs input), primarily
  SIL Open Font License 1.1 with Nerd Fonts glyphs under their upstream
  licenses. The Nix guest output carries the applicable license texts beside
  the generated WOFF2 file.
- **Fastfetch** (`2.66.0` from the pinned nixpkgs input), MIT. The guest uses a
  minimal i686 build with embedded yyjson and no optional desktop integration.
  The full notice is in `third_party/licenses/fastfetch-MIT.txt` and is also
  carried by the Nix guest output.

The production web package must include these notices with the distributed
JavaScript, WebAssembly, BIOS, and font assets. That packaging check belongs to
the public showcase checkpoint and is not satisfied by a Vite directory alone.
The static package includes the embedded v86 notices above. Before public
release, the guest closure's complete license and corresponding-source
inventory described in `.docs/vm-upstream-review.md` remains a release-hardening
gate.