# Wavulate Third-Party Software Inventory

Generated 2026-10-21 from the installed release inputs in this workspace. This is a build snapshot, not legal advice or a compatibility opinion. Re-run after dependency or runtime changes, and verify against the exact installer contents.

The bundled FFmpeg executable is `6.1.1-essentials_build-www.gyan.dev`, configured with GPL components (`--enable-gpl`, `--enable-version3`). Its package supplies the binary's license text and build/source-reference file. Distribution obligations for this executable require specific review; this inventory does not establish that corresponding source and notices are sufficient.

Font families are inventoried separately in [FONT-LICENSES.md](FONT-LICENSES.md), with SIL Open Font License texts in `../font-licenses/`. This scan covers the installed npm production dependency tree, packaged `.venv` Python distributions, Electron/Chromium notices, and FFmpeg notice files. Packaging omits pip/setuptools build tools and CPython ensurepip; Wavulate does not invoke them.

Scanned components: 96.

| Ecosystem | Component | Version | Declared license | Included text |
|---|---|---:|---|---|
| Electron runtime | Chromium and bundled components | 41.10.7 | See included notice | [license/notice](/wavulate/legal/licenses/electron-licenses-chromium-html/LICENSES.chromium.html) |
| Electron runtime | Electron | 41.10.7 | See included notice | [license/notice](/wavulate/legal/licenses/electron-license/LICENSE) |
| Native runtime | FFmpeg (build details/source reference) | 6.1.1-essentials_build-www.gyan.dev | GPL-3.0-or-later; build enables GPL components | [license/notice](/wavulate/legal/licenses/ffmpeg-ffmpeg-exe-readme/ffmpeg.exe.README) |
| Native runtime | FFmpeg (license text) | 6.1.1-essentials_build-www.gyan.dev | GPL-3.0-or-later; build enables GPL components | [license/notice](/wavulate/legal/licenses/ffmpeg-ffmpeg-exe-license/ffmpeg.exe.LICENSE) |
| npm runtime | @derhuerst/http-basic | 8.2.4 | MIT | [license/notice](/wavulate/legal/licenses/npm-derhuerst-http-basic-8-2-4/LICENSE) |
| npm runtime | @types/node | 10.17.60 | MIT | [license/notice](/wavulate/legal/licenses/npm-types-node-10-17-60/LICENSE) |
| npm runtime | accepts | 2.0.0 | MIT | [license/notice](/wavulate/legal/licenses/npm-accepts-2-0-0/LICENSE) |
| npm runtime | agent-base | 6.0.2 | MIT | [license/notice](/wavulate/legal/licenses/npm-agent-base-6-0-2/agent-base-6.0.2-LICENSE) |
| npm runtime | append-field | 1.0.0 | MIT | [license/notice](/wavulate/legal/licenses/npm-append-field-1-0-0/LICENSE) |
| npm runtime | body-parser | 2.3.0 | MIT | [license/notice](/wavulate/legal/licenses/npm-body-parser-2-3-0/LICENSE) |
| npm runtime | buffer-from | 1.1.2 | MIT | [license/notice](/wavulate/legal/licenses/npm-buffer-from-1-1-2/LICENSE) |
| npm runtime | busboy | 1.6.0 | MIT | [license/notice](/wavulate/legal/licenses/npm-busboy-1-6-0/LICENSE) |
| npm runtime | bytes | 3.1.2 | MIT | [license/notice](/wavulate/legal/licenses/npm-bytes-3-1-2/LICENSE) |
| npm runtime | caseless | 0.12.0 | Apache-2.0 | [license/notice](/wavulate/legal/licenses/npm-caseless-0-12-0/LICENSE) |
| npm runtime | concat-stream | 2.0.0 | MIT | [license/notice](/wavulate/legal/licenses/npm-concat-stream-2-0-0/LICENSE) |
| npm runtime | content-disposition | 1.1.0 | MIT | [license/notice](/wavulate/legal/licenses/npm-content-disposition-1-1-0/LICENSE) |
| npm runtime | content-type | 2.1.0 | MIT | [license/notice](/wavulate/legal/licenses/npm-content-type-2-1-0/LICENSE) |
| npm runtime | content-type | 1.0.5 | MIT | [license/notice](/wavulate/legal/licenses/npm-content-type-1-0-5/LICENSE) |
| npm runtime | cookie | 0.7.2 | MIT | [license/notice](/wavulate/legal/licenses/npm-cookie-0-7-2/LICENSE) |
| npm runtime | cookie-signature | 1.2.2 | MIT | [license/notice](/wavulate/legal/licenses/npm-cookie-signature-1-2-2/LICENSE) |
| npm runtime | debug | 4.4.3 | MIT | [license/notice](/wavulate/legal/licenses/npm-debug-4-4-3/LICENSE) |
| npm runtime | depd | 2.0.0 | MIT | [license/notice](/wavulate/legal/licenses/npm-depd-2-0-0/LICENSE) |
| npm runtime | encodeurl | 2.0.0 | MIT | [license/notice](/wavulate/legal/licenses/npm-encodeurl-2-0-0/LICENSE) |
| npm runtime | env-paths | 2.2.1 | MIT | [license/notice](/wavulate/legal/licenses/npm-env-paths-2-2-1/license) |
| npm runtime | escape-html | 1.0.3 | MIT | [license/notice](/wavulate/legal/licenses/npm-escape-html-1-0-3/LICENSE) |
| npm runtime | etag | 1.8.1 | MIT | [license/notice](/wavulate/legal/licenses/npm-etag-1-8-1/LICENSE) |
| npm runtime | express | 5.2.1 | MIT | [license/notice](/wavulate/legal/licenses/npm-express-5-2-1/LICENSE) |
| npm runtime | ffmpeg-static | 5.3.0 | GPL-3.0-or-later | [license/notice](/wavulate/legal/licenses/npm-ffmpeg-static-5-3-0/LICENSE) |
| npm runtime | finalhandler | 2.1.1 | MIT | [license/notice](/wavulate/legal/licenses/npm-finalhandler-2-1-1/LICENSE) |
| npm runtime | forwarded | 0.2.0 | MIT | [license/notice](/wavulate/legal/licenses/npm-forwarded-0-2-0/LICENSE) |
| npm runtime | fresh | 2.0.0 | MIT | [license/notice](/wavulate/legal/licenses/npm-fresh-2-0-0/LICENSE) |
| npm runtime | http-errors | 2.0.1 | MIT | [license/notice](/wavulate/legal/licenses/npm-http-errors-2-0-1/LICENSE) |
| npm runtime | http-response-object | 3.0.2 | MIT | [license/notice](/wavulate/legal/licenses/npm-http-response-object-3-0-2/LICENSE) |
| npm runtime | https-proxy-agent | 5.0.1 | MIT | [license/notice](/wavulate/legal/licenses/npm-https-proxy-agent-5-0-1/https-proxy-agent-5.0.1-LICENSE) |
| npm runtime | iconv-lite | 0.7.3 | MIT | [license/notice](/wavulate/legal/licenses/npm-iconv-lite-0-7-3/LICENSE) |
| npm runtime | inherits | 2.0.4 | ISC | [license/notice](/wavulate/legal/licenses/npm-inherits-2-0-4/LICENSE) |
| npm runtime | ipaddr.js | 1.9.1 | MIT | [license/notice](/wavulate/legal/licenses/npm-ipaddr-js-1-9-1/LICENSE) |
| npm runtime | is-promise | 4.0.0 | MIT | [license/notice](/wavulate/legal/licenses/npm-is-promise-4-0-0/LICENSE) |
| npm runtime | media-typer | 0.3.0 | MIT | [license/notice](/wavulate/legal/licenses/npm-media-typer-0-3-0/LICENSE) |
| npm runtime | merge-descriptors | 2.0.0 | MIT | [license/notice](/wavulate/legal/licenses/npm-merge-descriptors-2-0-0/license) |
| npm runtime | mime-db | 1.52.0 | MIT | [license/notice](/wavulate/legal/licenses/npm-mime-db-1-52-0/LICENSE) |
| npm runtime | mime-types | 3.0.2 | MIT | [license/notice](/wavulate/legal/licenses/npm-mime-types-3-0-2/LICENSE) |
| npm runtime | mime-types | 2.1.35 | MIT | [license/notice](/wavulate/legal/licenses/npm-mime-types-2-1-35/LICENSE) |
| npm runtime | ms | 2.1.3 | MIT | [license/notice](/wavulate/legal/licenses/npm-ms-2-1-3/license.md) |
| npm runtime | multer | 2.4.0 | MIT | [license/notice](/wavulate/legal/licenses/npm-multer-2-4-0/LICENSE) |
| npm runtime | negotiator | 1.1.0 | MIT | [license/notice](/wavulate/legal/licenses/npm-negotiator-1-1-0/LICENSE) |
| npm runtime | on-finished | 2.4.1 | MIT | [license/notice](/wavulate/legal/licenses/npm-on-finished-2-4-1/LICENSE) |
| npm runtime | once | 1.4.0 | ISC | [license/notice](/wavulate/legal/licenses/npm-once-1-4-0/LICENSE) |
| npm runtime | parse-cache-control | 1.0.1 | BSD-3-Clause | [license/notice](/wavulate/legal/licenses/npm-parse-cache-control-1-0-1/LICENSE) |
| npm runtime | parseurl | 1.3.3 | MIT | [license/notice](/wavulate/legal/licenses/npm-parseurl-1-3-3/LICENSE) |
| npm runtime | path-to-regexp | 8.4.2 | MIT | [license/notice](/wavulate/legal/licenses/npm-path-to-regexp-8-4-2/LICENSE) |
| npm runtime | progress | 2.0.3 | MIT | [license/notice](/wavulate/legal/licenses/npm-progress-2-0-3/LICENSE) |
| npm runtime | proxy-addr | 2.0.8 | MIT | [license/notice](/wavulate/legal/licenses/npm-proxy-addr-2-0-8/LICENSE) |
| npm runtime | qs | 6.16.0 | BSD-3-Clause | [license/notice](/wavulate/legal/licenses/npm-qs-6-16-0/LICENSE.md) |
| npm runtime | range-parser | 1.3.0 | MIT | [license/notice](/wavulate/legal/licenses/npm-range-parser-1-3-0/LICENSE) |
| npm runtime | raw-body | 3.0.2 | MIT | [license/notice](/wavulate/legal/licenses/npm-raw-body-3-0-2/LICENSE) |
| npm runtime | readable-stream | 3.6.2 | MIT | [license/notice](/wavulate/legal/licenses/npm-readable-stream-3-6-2/LICENSE) |
| npm runtime | router | 2.2.0 | MIT | [license/notice](/wavulate/legal/licenses/npm-router-2-2-0/LICENSE) |
| npm runtime | safe-buffer | 5.2.1 | MIT | [license/notice](/wavulate/legal/licenses/npm-safe-buffer-5-2-1/LICENSE) |
| npm runtime | safer-buffer | 2.1.2 | MIT | [license/notice](/wavulate/legal/licenses/npm-safer-buffer-2-1-2/LICENSE) |
| npm runtime | send | 1.2.1 | MIT | [license/notice](/wavulate/legal/licenses/npm-send-1-2-1/LICENSE) |
| npm runtime | serve-static | 2.2.1 | MIT | [license/notice](/wavulate/legal/licenses/npm-serve-static-2-2-1/LICENSE) |
| npm runtime | statuses | 2.0.2 | MIT | [license/notice](/wavulate/legal/licenses/npm-statuses-2-0-2/LICENSE) |
| npm runtime | streamsearch | 1.1.0 | MIT | [license/notice](/wavulate/legal/licenses/npm-streamsearch-1-1-0/LICENSE) |
| npm runtime | string_decoder | 1.3.0 | MIT | [license/notice](/wavulate/legal/licenses/npm-string-decoder-1-3-0/LICENSE) |
| npm runtime | type-is | 2.1.0 | MIT | [license/notice](/wavulate/legal/licenses/npm-type-is-2-1-0/LICENSE) |
| npm runtime | type-is | 1.6.18 | MIT | [license/notice](/wavulate/legal/licenses/npm-type-is-1-6-18/LICENSE) |
| npm runtime | typedarray | 0.0.6 | MIT | [license/notice](/wavulate/legal/licenses/npm-typedarray-0-0-6/LICENSE) |
| npm runtime | unpipe | 1.0.0 | MIT | [license/notice](/wavulate/legal/licenses/npm-unpipe-1-0-0/LICENSE) |
| npm runtime | util-deprecate | 1.0.2 | MIT | [license/notice](/wavulate/legal/licenses/npm-util-deprecate-1-0-2/LICENSE) |
| npm runtime | vary | 1.1.2 | MIT | [license/notice](/wavulate/legal/licenses/npm-vary-1-1-2/LICENSE) |
| npm runtime | wrappy | 1.0.2 | ISC | [license/notice](/wavulate/legal/licenses/npm-wrappy-1-0-2/LICENSE) |
| Python runtime | anyio | 4.15.1 | MIT | [license/notice](/wavulate/legal/licenses/python-anyio-4-15-1/LICENSE) |
| Python runtime | av | 19.0.1 | BSD-3-Clause | [license/notice](/wavulate/legal/licenses/python-av-19-0-1/LICENSE.txt) |
| Python runtime | certifi | 2026.7.22 | MPL-2.0 | [license/notice](/wavulate/legal/licenses/python-certifi-2026-7-22/LICENSE) |
| Python runtime | click | 8.5.0 | BSD-3-Clause | [license/notice](/wavulate/legal/licenses/python-click-8-5-0/LICENSE.txt) |
| Python runtime | colorama | 0.4.6 | OSI Approved :: BSD License | [license/notice](/wavulate/legal/licenses/python-colorama-0-4-6/LICENSE.txt) |
| Python runtime | ctranslate2 | 4.8.2 | MIT | [license/notice](/wavulate/legal/licenses/python-ctranslate2-4-8-2/ctranslate2-4.8.2-LICENSE) |
| Python runtime | faster-whisper | 1.2.1 | MIT | [license/notice](/wavulate/legal/licenses/python-faster-whisper-1-2-1/LICENSE) |
| Python runtime | filelock | 4.0.12 | MIT | [license/notice](/wavulate/legal/licenses/python-filelock-4-0-12/LICENSE) |
| Python runtime | flatbuffers | 25.12.19 | Apache-2.0 | [license/notice](/wavulate/legal/licenses/python-flatbuffers-25-12-19/LICENSE) |
| Python runtime | fsspec | 2026.9.0 | BSD-3-Clause | [license/notice](/wavulate/legal/licenses/python-fsspec-2026-9-0/LICENSE) |
| Python runtime | h11 | 0.16.0 | MIT | [license/notice](/wavulate/legal/licenses/python-h11-0-16-0/LICENSE.txt) |
| Python runtime | hf-xet | 1.7.0 | Apache-2.0 | [license/notice](/wavulate/legal/licenses/python-hf-xet-1-7-0/LICENSE) |
| Python runtime | httpcore | 1.0.9 | BSD-3-Clause | [license/notice](/wavulate/legal/licenses/python-httpcore-1-0-9/LICENSE.md) |
| Python runtime | httpx | 0.28.1 | BSD-3-Clause | [license/notice](/wavulate/legal/licenses/python-httpx-0-28-1/LICENSE.md) |
| Python runtime | huggingface_hub | 1.33.0 | Apache-2.0 | [license/notice](/wavulate/legal/licenses/python-huggingface-hub-1-33-0/LICENSE) |
| Python runtime | idna | 3.20 | BSD-3-Clause | [license/notice](/wavulate/legal/licenses/python-idna-3-20/LICENSE.md) |
| Python runtime | numpy | 2.5.3 | BSD-3-Clause AND 0BSD AND MIT AND Zlib AND CC0-1.0 | [license/notice](/wavulate/legal/licenses/python-numpy-2-5-3/LICENSE.txt), [license/notice](/wavulate/legal/licenses/python-numpy-2-5-3/LICENSE.md), [license/notice](/wavulate/legal/licenses/python-numpy-2-5-3/LICENSE-2.txt), [license/notice](/wavulate/legal/licenses/python-numpy-2-5-3/LICENSE), [license/notice](/wavulate/legal/licenses/python-numpy-2-5-3/LICENSE-2.md), [license/notice](/wavulate/legal/licenses/python-numpy-2-5-3/LICENSE-3.md), [license/notice](/wavulate/legal/licenses/python-numpy-2-5-3/LICENSE-4.md), [license/notice](/wavulate/legal/licenses/python-numpy-2-5-3/LICENSE-5.md), [license/notice](/wavulate/legal/licenses/python-numpy-2-5-3/LICENSE-6.md), [license/notice](/wavulate/legal/licenses/python-numpy-2-5-3/LICENSE-7.md), [license/notice](/wavulate/legal/licenses/python-numpy-2-5-3/LICENSE-8.md), [license/notice](/wavulate/legal/licenses/python-numpy-2-5-3/LICENSE-3.txt), [license/notice](/wavulate/legal/licenses/python-numpy-2-5-3/COPYING), [license/notice](/wavulate/legal/licenses/python-numpy-2-5-3/LICENSE-2), [license/notice](/wavulate/legal/licenses/python-numpy-2-5-3/LICENSE-9.md), [license/notice](/wavulate/legal/licenses/python-numpy-2-5-3/LICENSE-3) |
| Python runtime | onnxruntime | 1.30.0 | MIT | [license/notice](/wavulate/legal/licenses/python-onnxruntime-1-30-0/onnxruntime-1.30.0-LICENSE) |
| Python runtime | packaging | 26.3 | Apache-2.0 OR BSD-2-Clause | [license/notice](/wavulate/legal/licenses/python-packaging-26-3/LICENSE), [license/notice](/wavulate/legal/licenses/python-packaging-26-3/LICENSE.APACHE), [license/notice](/wavulate/legal/licenses/python-packaging-26-3/LICENSE.BSD) |
| Python runtime | protobuf | 7.36.2 | 3-Clause BSD License | [license/notice](/wavulate/legal/licenses/python-protobuf-7-36-2/LICENSE) |
| Python runtime | PyYAML | 6.0.3 | MIT | [license/notice](/wavulate/legal/licenses/python-pyyaml-6-0-3/LICENSE) |
| Python runtime | tokenizers | 0.23.2 | Apache-2.0 | [license/notice](/wavulate/legal/licenses/python-tokenizers-0-23-2/LICENSE) |
| Python runtime | tqdm | 4.70.1 | MPL-2.0 AND MIT | [license/notice](/wavulate/legal/licenses/python-tqdm-4-70-1/LICENCE) |
| Python runtime | typing_extensions | 4.16.0 | PSF-2.0 | [license/notice](/wavulate/legal/licenses/python-typing-extensions-4-16-0/LICENSE) |

Version-specific license sources for the six explicitly audited components are recorded in `release-compliance/remediation-report.md`.

## Release follow-up checks

- Confirm corresponding-source delivery and applicable obligations for the GPL-enabled FFmpeg build before public distribution. Consult FFmpeg's exact build notice and its legal guidance.
- Verify these generated files are present in the final NSIS and portable artifacts, not merely in the development tree.
- Re-run this inventory from the precise packaged Python environment and verify actual release contents.
- Review third-party assets, fonts, downloaded speech-model terms, and platform runtimes separately if their versions or distribution packaging change.