{
  "reviewedAt": "2026-09-10",
  "scope": "Byte-identical local UMD distributions and identified embedded component notices; not a security or legal clearance.",
  "bundles": [
    {
      "name": "pdf-lib",
      "version": "1.17.1",
      "file": "../vendor/pdf-lib.min.js",
      "global": "PDFLib",
      "bytes": 525099,
      "sha256": "0f9a5cad07941f0826586c94e089d89b918c46e5c17cf2d5a3c6f666e3bc694f",
      "source": "https://registry.npmjs.org/pdf-lib/-/pdf-lib-1.17.1.tgz",
      "archiveMember": "package/dist/pdf-lib.min.js",
      "archiveSha256": "a7cc1eaf12e41e612a7be581162a63b18118aefc01e90f6a1f35347b1f324a1c",
      "archiveIntegrity": "sha512-V/mpyJAoTsN4cnP31vc0wfNA1+p20evqqnap0KLoRUN0Yk/p3wN52DOEsL4oBFcLdb76hlpKPtzJIgo67j/XLw==",
      "license": "MIT (library), plus licenses of embedded components",
      "components": [
        "tslib 1.11.1 (Apache-2.0)",
        "pako 1.0.10 and 1.0.11 (MIT and Zlib)",
        "@pdf-lib/standard-fonts 1.0.0 (MIT, afm MIT, Adobe AFM and Unicode data notices)",
        "@pdf-lib/upng 1.0.1 (MIT)",
        "base64-arraybuffer-derived code (MIT; version not asserted)",
        "PDF.js and XPDF-derived streams (Apache-2.0; version not asserted)",
        "PDFKit-derived SVG path code (MIT; version not asserted)"
      ]
    },
    {
      "name": "jszip",
      "version": "3.10.2",
      "file": "../vendor/jszip.min.js",
      "global": "JSZip",
      "bytes": 97781,
      "sha256": "7f839b2d4688b845c105ebf5d2f9803075f91ea0fe72bdaac176c3a04dd3d2c1",
      "source": "https://registry.npmjs.org/jszip/-/jszip-3.10.2.tgz",
      "archiveMember": "package/dist/jszip.min.js",
      "archiveSha256": "4ee15dcb3f5433b736a41d091bcad37facee4a4aa96f9e21194789da886ac226",
      "archiveIntegrity": "sha512-3l+rb15IOWtUhU0H5MFqES/T6Kh7abYwjosBey/vD6hDt8zoEffkSC5Ws5SGtgVw3gBx2NEbhTeSW1+kWkpyTQ==",
      "license": "MIT chosen from MIT OR GPL-3.0-or-later",
      "components": [
        "pako 1.0.5 (MIT and Zlib)",
        "lie 3.3.0 (MIT)",
        "immediate 3.0.6 (MIT)",
        "setimmediate 1.0.5 (MIT)",
        "browser-pack 6.0.2 prelude (MIT)"
      ],
      "excludedRuntimeDependencies": [
        "readable-stream: browser bundle uses JSZip's own browser shim; Node stream implementation is not bundled"
      ]
    }
  ],
  "evidence": [
    "https://raw.githubusercontent.com/Hopding/pdf-lib/v1.17.1/yarn.lock",
    "https://raw.githubusercontent.com/Stuk/jszip/v3.10.2/package-lock.json",
    "pdf-lib official package/dist/pdf-lib.min.js.map: all 53 third-party source entries compared byte for byte with component package source",
    "JSZip official package/dist/jszip.js: Browserify module table and component source comparison",
    "https://github.com/Hopding/standard-fonts/tree/41a6440267de5456042c7bcbac5ec65065e2ef69/encoding_metrics"
  ],
  "licenseFiles": [
    {
      "file": "Adobe-AFM-MustRead.html",
      "sha256": "b226bfc00e1b8b8a80c7b3cfbbc322d13b4b0401f94cdeafdd93b2210ad802eb",
      "source": "https://raw.githubusercontent.com/apache/pdfbox/trunk/pdfbox/src/main/resources/org/apache/pdfbox/resources/afm/MustRead.html"
    },
    {
      "file": "Apache-2.0.txt",
      "sha256": "a7d00bfd54525bc694b6e32f64c7ebcf5e6b7ae3657be5cc12767bce74654a47",
      "source": "https://registry.npmjs.org/tslib/-/tslib-1.11.1.tgz",
      "sourceMember": "package/LICENSE.txt"
    },
    {
      "file": "JSZip-LICENSE.txt",
      "sha256": "566c953c6090b1218ca6217dd7359d45dde46581968586dc607d59a78af6a9c4",
      "source": "https://registry.npmjs.org/jszip/-/jszip-3.10.2.tgz",
      "sourceMember": "package/LICENSE.markdown"
    },
    {
      "file": "Unicode-LICENSE.txt",
      "sha256": "e7a93b009565cfce55919a381437ac4db883e9da2126fa28b91d12732bc53d96",
      "source": "https://www.unicode.org/license.txt"
    },
    {
      "file": "afm-MIT.txt",
      "sha256": "a9716380f3879603cafa6fd4383b10aec6ccb76a5b40358f1051a5880075944a",
      "source": "https://chbrown.github.io/licenses/MIT/#2015-2018"
    },
    {
      "file": "base64-arraybuffer-MIT.txt",
      "sha256": "f3eca6ff762533fa5a77caf954a143e48afa204668cf97dce758c45a9e006be3",
      "source": "https://registry.npmjs.org/base64-arraybuffer/-/base64-arraybuffer-0.2.0.tgz",
      "sourceMember": "package/LICENSE-MIT"
    },
    {
      "file": "browser-pack-MIT.txt",
      "sha256": "435a6722c786b0a56fbe7387028f1d9d3f3a2d0fb615bb8fee118727c3f59b7b",
      "source": "https://registry.npmjs.org/browser-pack/-/browser-pack-6.0.2.tgz",
      "sourceMember": "package/LICENSE"
    },
    {
      "file": "embedded-NOTICES.txt",
      "sha256": "97033ec3dd24a68fa4f70b2b12360c0172bac8d31c939ed7b6dfb3c97d670329",
      "source": "Official pdf-lib source map, decoded font metric Notice fields, and upstream encoding table headers"
    },
    {
      "file": "immediate-MIT.txt",
      "sha256": "809e66de579fb7d92503848bbe6d1f348f4f6521a71e5d294fe7cc0c87a3b4ff",
      "source": "https://registry.npmjs.org/immediate/-/immediate-3.0.6.tgz",
      "sourceMember": "package/LICENSE.txt"
    },
    {
      "file": "lie-MIT.txt",
      "sha256": "5c81b0caa98593408b03125efa25efe622341ed87ae55561968828cd887d64a4",
      "source": "https://registry.npmjs.org/lie/-/lie-3.3.0.tgz",
      "sourceMember": "package/license.md"
    },
    {
      "file": "pako-1.0.10-MIT.txt",
      "sha256": "a04665b3b2de56c66730c1f720f528175739e4104f79073614aa611da1e85539",
      "source": "https://registry.npmjs.org/pako/-/pako-1.0.10.tgz",
      "sourceMember": "package/LICENSE"
    },
    {
      "file": "pako-1.0.11-MIT.txt",
      "sha256": "a04665b3b2de56c66730c1f720f528175739e4104f79073614aa611da1e85539",
      "source": "https://registry.npmjs.org/pako/-/pako-1.0.11.tgz",
      "sourceMember": "package/LICENSE"
    },
    {
      "file": "pako-1.0.5-MIT.txt",
      "sha256": "a04665b3b2de56c66730c1f720f528175739e4104f79073614aa611da1e85539",
      "source": "https://registry.npmjs.org/pako/-/pako-1.0.5.tgz",
      "sourceMember": "package/LICENSE"
    },
    {
      "file": "pako-zlib.txt",
      "sha256": "d8b499598e43d755ea8918448128259ff01820c50d94d5a48c8883d0a594ddb1",
      "source": "https://registry.npmjs.org/pako/-/pako-1.0.11.tgz",
      "sourceMember": "package/lib/zlib/README"
    },
    {
      "file": "pdf-lib-MIT.txt",
      "sha256": "f2c9fc00fdb66eb99ac156ba52d734af66d8d309f65753ae809ad34ee2883bcb",
      "source": "https://registry.npmjs.org/pdf-lib/-/pdf-lib-1.17.1.tgz",
      "sourceMember": "package/LICENSE.md"
    },
    {
      "file": "pdfkit-MIT.txt",
      "sha256": "427d01cbe37b367b97f2ea655935d94f4ed03ed11343c3c00e78c8366df810cc",
      "source": "https://registry.npmjs.org/pdfkit/-/pdfkit-0.10.0.tgz",
      "sourceMember": "package/LICENSE"
    },
    {
      "file": "setimmediate-MIT.txt",
      "sha256": "c4b4ad3a5746f1f5249a6dd90396ec519264e1bb02e01e48a6522c48a3a97cb4",
      "source": "https://registry.npmjs.org/setimmediate/-/setimmediate-1.0.5.tgz",
      "sourceMember": "package/LICENSE.txt"
    },
    {
      "file": "standard-fonts-MIT.txt",
      "sha256": "45cc2bb9957ed43f5c7f5eb1912f9f670730394d614079510477cae626194649",
      "source": "https://registry.npmjs.org/@pdf-lib/standard-fonts/-/standard-fonts-1.0.0.tgz",
      "sourceMember": "package/LICENSE.md"
    },
    {
      "file": "tslib-CopyrightNotice.txt",
      "sha256": "19246466cb51e46c12b22e43b4d2703ac981cb4295d061d6e20609bd5845510b",
      "source": "https://registry.npmjs.org/tslib/-/tslib-1.11.1.tgz",
      "sourceMember": "package/CopyrightNotice.txt"
    },
    {
      "file": "upng-MIT.txt",
      "sha256": "c1fb8861eca211bf5aea574358aba7039396c0c1824c2a1477cc126d398efd89",
      "source": "https://registry.npmjs.org/@pdf-lib/upng/-/upng-1.0.1.tgz",
      "sourceMember": "package/LICENSE"
    }
  ]
}