# Third-party software notices

SideBySide contains, links to, or loads third-party open-source software. This
file records the **direct dependencies and browser libraries intentionally used
by SideBySide** as audited on **2026-08-23**. Transitive dependencies remain
subject to their own license files shipped by the respective package managers.

SideBySide itself is licensed under **GNU AGPL v3.0**. A dependency listed here
is **not relicensed** under the AGPL; its original license continues to apply to
that component.

> This inventory is a compliance aid, not legal advice. For a release, the
> package artifacts actually shipped in the Docker image/APK remain the source
> of truth for exact copyright and NOTICE texts.

## Web / browser libraries

| Component | Version used | License | Usage / source |
|---|---:|---|---|
| BeerCSS | 3.6.13 | MIT | UI framework, loaded from jsDelivr — https://github.com/beercss/beercss |
| Leaflet | 1.9.4 | BSD-2-Clause | Maps, loaded from unpkg — https://github.com/Leaflet/Leaflet |
| lightGallery | 2.7.x | GPL-3.0 (open-source option) | Gallery and plugins, loaded from CDN — https://github.com/sachinchoolur/lightGallery |
| html2canvas | 1.4.1 | MIT | Client-side image export, loaded on demand — https://github.com/niklasvh/html2canvas |
| SortableJS | 1.15.6 | MIT | Drag-and-drop list ordering, loaded on demand — https://github.com/SortableJS/Sortable |

### lightGallery note

SideBySide uses lightGallery under its GPLv3 open-source option. SideBySide is
AGPLv3-licensed and its complete source is made available, so this use is
intended to remain within the open-source licensing path described by
lightGallery. The lightGallery GPLv3 terms continue to apply to lightGallery
itself.

## Python direct dependencies

The following entries correspond to `requirements.txt`.

| Package | Declared version/spec | License / license family |
|---|---:|---|
| alembic | 1.13.2 | MIT |
| bcrypt | 4.2.0 | Apache-2.0 |
| blinker | 1.9.0 | MIT |
| cachelib | 0.9.0 | BSD-3-Clause |
| click | 8.1.7 | BSD-3-Clause |
| Flask | 3.1.3 | BSD-3-Clause |
| Flask-Bcrypt | 1.0.1 | BSD-3-Clause |
| Flask-Caching | 2.3.0 | BSD-3-Clause |
| greenlet | >=3.1.0 | MIT |
| itsdangerous | 2.2.0 | BSD-3-Clause |
| Jinja2 | 3.1.4 | BSD-3-Clause |
| Mako | 1.3.5 | MIT |
| MarkupSafe | 2.1.5 | BSD-3-Clause |
| python-dateutil | 2.9.0.post0 | BSD-3-Clause / Apache-2.0 dual-license family |
| python-dotenv | 1.2.1 | BSD-3-Clause |
| PyJWT | 2.10.1 | MIT |
| pytz | 2024.1 | MIT |
| six | 1.16.0 | MIT |
| SQLAlchemy | 2.0.32 | MIT |
| typing_extensions | 4.12.2 | PSF-2.0 |
| tzdata | 2024.1 | Apache-2.0 |
| webauthn | 2.7.1 | BSD-3-Clause |
| Werkzeug | 3.1.6 | BSD-3-Clause |
| requests | >=2.31.0 | Apache-2.0 |
| openai | >=1.40.0 | Apache-2.0 |
| anthropic | >=0.34.0 | MIT |
| mysql-connector-python | >=9.0.0 | GPL-2.0 with Oracle Universal FOSS Exception |
| pywebpush | >=2.0.0 | MPL-2.0 |
| py-vapid | >=1.9.0 | MPL-2.0 |
| APScheduler | >=3.10.0 | MIT |
| cryptography | >=42.0.0 | Apache-2.0 OR BSD-3-Clause |
| Pillow | >=10.0.0 | HPND / Pillow License |
| Babel | >=2.14.0 | BSD-3-Clause |
| Authlib | >=1.3.2 | BSD-3-Clause |

### MySQL Connector/Python note

Oracle distributes MySQL Connector/Python under GPLv2 with an additional
Universal FOSS Exception. Oracle's FOSS exception documentation explicitly
covers interoperability with free/open-source applications; AGPLv3 is a free
software license. Keep Oracle's license information from the installed package
when redistributing a Docker image.

### FFmpeg note

SideBySide no longer installs `imageio-ffmpeg` as a required Python dependency.
The supported Docker and native Linux installers install the operating-system
`ffmpeg` package instead. This avoids silently bundling a second FFmpeg binary
inside a Python wheel. FFmpeg is normally LGPL-2.1-or-later and can become
GPL-2.0-or-later depending on build options and external libraries. A published
Docker image that contains FFmpeg must retain the distribution's FFmpeg license
notices and satisfy the terms applicable to that actual package/build. The
application keeps a best-effort optional `imageio_ffmpeg` fallback for custom
environments that install it themselves.

## Android / native application direct dependencies

| Component | Version used | License |
|---|---:|---|
| Android Browser Helper | 2.5.0 | Apache-2.0 |
| AndroidX Core | 1.15.0 (native) | Apache-2.0 |
| AndroidX Activity Compose | 1.9.3 | Apache-2.0 |
| AndroidX Lifecycle Runtime Compose | 2.8.7 | Apache-2.0 |
| AndroidX Lifecycle ViewModel Compose | 2.8.7 | Apache-2.0 |
| AndroidX Navigation Compose | 2.8.4 | Apache-2.0 |
| AndroidX Compose BOM / UI / Material3 / Material Icons | BOM 2024.10.01 | Apache-2.0 |
| Coil Compose | 2.7.0 | Apache-2.0 |
| kotlinx-serialization-json | 1.7.3 | Apache-2.0 |
| kotlinx-coroutines-android | 1.9.0 | Apache-2.0 |
| Kotlin / Gradle build tooling | build-time | Apache-2.0 family / respective upstream notices |

The Android build also resolves transitive Maven dependencies. When publishing
an APK/AAB, generate or retain the license/NOTICE material from the exact
resolved dependency graph used for that release.

## Map data and external services

SideBySide's default map setup uses OpenStreetMap services:

- **OpenStreetMap data** — Open Database License (ODbL); visible attribution is
  required. SideBySide links the attribution to
  https://www.openstreetmap.org/copyright.
- **OpenStreetMap standard raster tiles** — subject to the OSM Foundation Tile
  Usage Policy in addition to the data attribution requirements.
- **Nominatim public geocoder** — subject to the OSM Foundation Nominatim Usage
  Policy, including application identification, visible attribution and a
  maximum request rate. SideBySide triggers geocoding only on an explicit
  search action and identifies itself in the server-side User-Agent.

Self-hosters with material traffic should configure their own map tile/geocoder
provider rather than depend on the community-funded public endpoints.

## Inherited images and demo assets

The repository contains images inherited from the SharedMoments codebase,
including setup illustrations, demo photos/profile images, screenshots and
placeholder images. No separate per-file license or source attribution was
found in the audited repository snapshot. They are therefore tracked in
`docs/ASSET-PROVENANCE.md` as **inherited / provenance not independently
verified**.

Before a broad public binary or marketing release, replace any inherited photo
whose provenance cannot be demonstrated with an image you own or a clearly
licensed replacement. This is the main remaining non-code provenance risk
identified by this audit.

## Release rule

Before publishing a Docker image, APK/AAB, release ZIP or other binary:

1. build from a tagged/committed source revision;
2. make the Corresponding Source for exactly that revision public;
3. retain this file plus `LICENSE` and `NOTICE.md`;
4. retain license/NOTICE files shipped inside Python/Maven/OS packages;
5. verify FFmpeg's actual build license if an FFmpeg binary is included;
6. generate a dependency report from the exact release environment; and
7. complete `docs/COMPLIANCE-CHECKLIST.md`.