# THIRD PARTY NOTICES — supplemental investigation (not release clearance)

Scope: 22 deployed image package-manifest occurrences lacking a recognized license file in their own directory. App image sha256:7d2f98da27703a819f19f7e3d38907935c03d77e0c9dd18f0176923546903bd7. Attribution references and original texts below are preserved in notice-upstream/; names in the inventory may describe build tooling rather than browser-shipped code. Actual Next output bundle attribution remains to be audited separately. Do not distribute this as a complete notices bundle.

## Bounded notice-text resolutions — 9 of 22 occurrences

- @esbuild/linux-x64 0.28.2: MIT; exact package metadata identifies evanw/esbuild. Original project license at commit 609683d892977362a0f99026cb74b96263d728a9: https://raw.githubusercontent.com/evanw/esbuild/609683d892977362a0f99026cb74b96263d728a9/LICENSE.md. `notice-upstream/esbuild-upstream.md`, SHA256 b40ec5baec7bb34fa5b1c09521fa3cd52d5fad7adafed74932a2010d3612a681. This resolves project license text, not a binary/source-correspondence audit. Build tooling, not established browser payload.
- @edge-runtime/cookies 6.0.0, @edge-runtime/ponyfill 4.0.0, @edge-runtime/primitives 6.0.0: MIT original LICENSE.md in exact corresponding npm version tarballs from https://registry.npmjs.org/@edge-runtime/cookies/-/cookies-6.0.0.tgz, https://registry.npmjs.org/@edge-runtime/ponyfill/-/ponyfill-4.0.0.tgz, https://registry.npmjs.org/@edge-runtime/primitives/-/primitives-6.0.0.tgz. Three retained *-LICENSE.md files have SHA256 e4f76a7a19ef2989dd79339bd3abf8afcf1d6f065e5a10c76c19415ffd727eb3. These occur under Next compiled server tree; client delivery not established.
- murmurhash-js 1.0.0: MIT copyright and original text in exact repository commit README https://raw.githubusercontent.com/mikolalysenko/murmurhash-js/72aabce3f52cb8f16245692a69fd35951e165af0/README.md; `notice-upstream/murmur-README.md` SHA256 a6df412756139a6706db058a33f8aa39b9e280facf7f1587e86f6680f9e5cbb6. Client/server inclusion requires bundle trace.
- postgres 3.4.9: Unlicense, original upstream v3.4.9 text https://github.com/porsager/postgres/blob/v3.4.9/UNLICENSE; `notice-upstream/postgres-3.4.9-UNLICENSE` SHA256 d770ea4f8155fc1cc3792960eee1d3da30c91f51423fe2666a6cd810499f25a1. Server-side DB client.
- @sigstore/verify 3.1.1: Apache-2.0 package metadata and repository license at version metadata gitHead c1dc7d4778a450787fc72b083f2490ad02b714c6, https://raw.githubusercontent.com/sigstore/sigstore-js/c1dc7d4778a450787fc72b083f2490ad02b714c6/LICENSE; `notice-upstream/sigstore-upstream` SHA256 364a130d2ca340bd56eb1e6d045fc6929bb0f9d0aa018f2c1949b29517e1cdd0. Bundled npm tooling, not established browser payload; separately check NOTICE and bundled sources.
- spdx-exceptions 2.5.0: README at gitHead 3aa64bec339abc6a3eca00c3436aaa7e154b8799 contains Linux Foundation attribution and CC BY 3.0 statement, https://raw.githubusercontent.com/kemitchell/spdx-exceptions.json/3aa64bec339abc6a3eca00c3436aaa7e154b8799/README.md; original `notice-upstream/spdx-exceptions-README.md` SHA256 554b19eee11d2964e9f7b244e47944c08d52ca75539260a04f3227e6c0144513; official license text https://creativecommons.org/licenses/by/3.0/legalcode.txt `notice-upstream/cc-by-3.txt` SHA256 e6bc9e9c474700b708f568bac9e5a8a9bcb2b1dad53442f5ba449fcb848b8e76. Bundled npm tooling.
- spdx-license-ids 3.0.23: exact README at gitHead a2a975daf48bbc2afdc8e7c304405b44c656fd53 states CC0 https://raw.githubusercontent.com/jslicense/spdx-license-ids/a2a975daf48bbc2afdc8e7c304405b44c656fd53/README.md, SHA256 b4807793db6058c819f76c023362b7d522b3d19c9b41563fcc01c2b2c5b1ccd3; official text https://creativecommons.org/publicdomain/zero/1.0/legalcode.txt `notice-upstream/cc0-1.txt` SHA256 a2010f343487d3f7618affe54f789f5487602331c0a8d03f49e9a7c547cf0499. Bundled npm tooling.

## Unresolved — 13 occurrences

| Package occurrences | Exact missing work |
|---|---|
| @img/sharp-libvips-linux-x64 and linuxmusl-x64 1.3.4 | Package metadata says LGPL-3.0-or-later, but repository LICENSE is Apache-2.0 for project wrapper; do not substitute it for bundled libvips/dependencies. Match binary build/source, third-party notices and LGPL source/redistribution obligations. |
| @next/env, @next/swc-linux-x64-gnu, @next/swc-linux-x64-musl 16.4.2 | Existing Next 16.4.2 MIT text is present, but verify each exact package/binary and SWC bundled third-party notices and source before treating it as complete. |
| @oxlint/binding-linux-x64-gnu and musl 1.89.0 | Exact package tarballs have no license text; retrieve tagged source license and any bundled Rust/native notices for each build. |
| @rolldown/binding-linux-x64-gnu and musl 1.2.14 | Exact package tarballs have no license text; match tagged source and bundled native notices. |
| client-only 0.0.1 (two deployed occurrences), server-only 0.0.1 | Tarballs lack license text and repository mapping. Determine exact original authorship/copyright and notice from version-matched Next/React distribution; do not substitute generic MIT. |
| @npmcli/agent 4.0.2 | Exact package declares ISC and identifies gitHead, but package tarball and repository tree have no identifiable project license text; locate version-matched copyright/license from authoritative maintainer. |

## Additional limits
These nine findings close only the identified notice-text gap, not all notices or distribution obligations. Hosted service versus source ZIP/container distribution must be assessed separately. The app contains 156 approved products and culinary data whose attribution, permission and freshness require separate review. No runtime, user data or publication was changed.