# Third-party notices

<!-- Generated from the lockfile's production dependencies: `pnpm licenses list --prod --json` (2026-10-14). Regenerate rather than edit by hand. -->

Fork Horse depends on the open-source packages below. Each is used under its own license; the license text ships with each package in its published form. This list covers production dependencies only (development and test tooling is excluded).

## Pinned upstream: Cloudflare OS

The `cloudflare-os` submodule is pinned at upstream commit `8cbfb2b` and is used under the **Apache License 2.0** (see `cloudflare-os/LICENSE`). Fork Horse does not modify it.

## License summary

| License | Packages |
| --- | --- |
| MIT | 219 |
| ISC | 12 |
| Apache-2.0 | 5 |
| BSD-3-Clause | 4 |
| MPL-2.0 | 2 |
| (MIT AND BSD-3-Clause) | 1 |
| (MIT AND Zlib) | 1 |
| 0BSD | 1 |
| BSD-2-Clause | 1 |
| MIT OR Apache-2.0 | 1 |

Two packages are under **MPL-2.0**, a file-level copyleft license; they are used unmodified.


## MIT

| Package | Versions | Repository |
| --- | --- | --- |
| `@babel/runtime` | 7.29.7 | https://babel.dev/docs/en/next/babel-runtime |
| `@base-ui/react` | 1.9.0 | https://base-ui.com |
| `@base-ui/utils` | 0.5.0 | https://github.com/mui/base-ui#readme |
| `@cloudflare/config` | 0.20.0 | https://github.com/cloudflare/workers-sdk/tree/main/packages/config#readme |
| `@cloudflare/kumo` | 2.14.0 | https://github.com/cloudflare/kumo#readme |
| `@cloudflare/workers-oauth-provider` | 1.2.3 | https://github.com/cloudflare/workers-oauth-provider#readme |
| `@codemirror/state` | 6.7.6 |  |
| `@date-fns/tz` | 1.5.0 | https://github.com/date-fns/date-fns#readme |
| `@esbuild/darwin-arm64` | 0.28.1, 0.28.2 | https://github.com/evanw/esbuild#readme |
| `@floating-ui/core` | 1.8.0 | https://floating-ui.com |
| `@floating-ui/dom` | 1.8.0 | https://floating-ui.com |
| `@floating-ui/react-dom` | 2.1.9 | https://floating-ui.com/docs/react-dom |
| `@floating-ui/utils` | 0.2.12 | https://floating-ui.com |
| `@hono/node-server` | 2.1.4 | https://github.com/honojs/node-server |
| `@jridgewell/gen-mapping` | 0.3.13 | https://github.com/jridgewell/sourcemaps/tree/main/packages/gen-mapping |
| `@jridgewell/remapping` | 2.3.5 | https://github.com/jridgewell/sourcemaps/tree/main/packages/remapping |
| `@jridgewell/resolve-uri` | 3.1.2 | https://github.com/jridgewell/resolve-uri#readme |
| `@jridgewell/sourcemap-codec` | 1.5.5 | https://github.com/jridgewell/sourcemaps/tree/main/packages/sourcemap-codec |
| `@jridgewell/trace-mapping` | 0.3.31 | https://github.com/jridgewell/sourcemaps/tree/main/packages/trace-mapping |
| `@marijn/find-cluster-break` | 1.0.4 | https://code.haverbeke.berlin/marijn/find-cluster-break |
| `@modelcontextprotocol/sdk` | 1.32.1 | https://modelcontextprotocol.io |
| `@oxc-project/types` | 0.142.0 | https://oxc.rs |
| `@phosphor-icons/react` | 2.1.10 | https://phosphoricons.com |
| `@rolldown/binding-darwin-arm64` | 1.2.2 | https://rolldown.rs/ |
| `@rolldown/pluginutils` | 1.0.1 | https://github.com/rolldown/plugins/tree/main/packages/pluginutils#readme |
| `@rollup/rollup-darwin-arm64` | 4.62.4 | https://rollupjs.org/ |
| `@shikijs/core` | 4.5.0 | https://github.com/shikijs/shiki#readme |
| `@shikijs/engine-javascript` | 4.5.0 | https://github.com/shikijs/shiki#readme |
| `@shikijs/engine-oniguruma` | 4.5.0 | https://github.com/shikijs/shiki#readme |
| `@shikijs/langs` | 4.5.0 | https://github.com/shikijs/shiki#readme |
| `@shikijs/primitive` | 4.5.0 | https://github.com/shikijs/shiki#readme |
| `@shikijs/themes` | 4.5.0 | https://github.com/shikijs/shiki#readme |
| `@shikijs/types` | 4.5.0 | https://github.com/shikijs/shiki#readme |
| `@shikijs/vscode-textmate` | 10.0.2 | https://github.com/shikijs/vscode-textmate#readme |
| `@tabby_ai/hijri-converter` | 1.0.5 |  |
| `@types/estree` | 1.0.9 | https://github.com/DefinitelyTyped/DefinitelyTyped/tree/master/types/estree |
| `@types/hast` | 3.0.5 | https://github.com/DefinitelyTyped/DefinitelyTyped/tree/master/types/hast |
| `@types/mdast` | 4.0.4 | https://github.com/DefinitelyTyped/DefinitelyTyped/tree/master/types/mdast |
| `@types/node` | 26.1.0 | https://github.com/DefinitelyTyped/DefinitelyTyped/tree/master/types/node |
| `@types/react` | 19.2.18 | https://github.com/DefinitelyTyped/DefinitelyTyped/tree/master/types/react |
| `@types/unist` | 3.0.3 | https://github.com/DefinitelyTyped/DefinitelyTyped/tree/master/types/unist |
| `abort-controller` | 3.0.0 | https://github.com/mysticatea/abort-controller#readme |
| `accepts` | 2.0.0 | https://github.com/jshttp/accepts#readme |
| `ajv` | 8.20.0 | https://ajv.js.org |
| `ajv-formats` | 3.0.1 | https://github.com/ajv-validator/ajv-formats#readme |
| `async-lock` | 1.4.1 | https://github.com/rogierschouten/async-lock |
| `available-typed-arrays` | 1.0.7 | https://github.com/inspect-js/available-typed-arrays#readme |
| `aws4fetch` | 1.0.20 | https://github.com/mhart/aws4fetch#readme |
| `base64-js` | 1.5.1 | https://github.com/beatgammit/base64-js |
| `body-parser` | 2.3.0 | https://github.com/expressjs/body-parser#readme |
| `buffer` | 6.0.3 | https://github.com/feross/buffer |
| `bytes` | 3.1.2 | https://github.com/visionmedia/bytes.js#readme |
| `call-bind` | 1.0.9 | https://github.com/ljharb/call-bind#readme |
| `call-bind-apply-helpers` | 1.0.2 | https://github.com/ljharb/call-bind-apply-helpers#readme |
| `call-bound` | 1.0.4 | https://github.com/ljharb/call-bound#readme |
| `capnweb` | 0.12.0 | https://github.com/cloudflare/capnweb#readme |
| `capnweb-validate` | 0.3.0 | https://github.com/cloudflare/capnweb#readme |
| `ccount` | 2.0.1 | https://github.com/wooorm/ccount#readme |
| `character-entities-html4` | 2.1.0 | https://github.com/wooorm/character-entities-html4#readme |
| `character-entities-legacy` | 3.0.0 | https://github.com/wooorm/character-entities-legacy#readme |
| `cnfast` | 0.0.8 | https://github.com/aidenybai/cnfast#readme |
| `comma-separated-tokens` | 2.0.3 | https://github.com/wooorm/comma-separated-tokens#readme |
| `content-disposition` | 2.0.1 | https://github.com/jshttp/content-disposition#readme |
| `content-type` | 1.0.5, 2.1.0 | https://github.com/jshttp/content-type#readme |
| `cookie` | 0.7.2 | https://github.com/jshttp/cookie#readme |
| `cookie-signature` | 1.2.2 | https://github.com/visionmedia/node-cookie-signature#readme |
| `cors` | 2.8.6 | https://github.com/expressjs/cors#readme |
| `cross-spawn` | 7.0.6 | https://github.com/moxystudio/node-cross-spawn |
| `csstype` | 3.2.3 | https://github.com/frenic/csstype#readme |
| `date-fns` | 4.4.0 | https://github.com/date-fns/date-fns#readme |
| `date-fns-jalali` | 4.1.0-0 | https://github.com/date-fns-jalali/date-fns-jalali#readme |
| `debug` | 4.4.3 | https://github.com/debug-js/debug#readme |
| `decompress-response` | 6.0.0 | https://github.com/sindresorhus/decompress-response#readme |
| `define-data-property` | 1.1.4 | https://github.com/ljharb/define-data-property#readme |
| `depd` | 2.0.0 | https://github.com/dougwilson/nodejs-depd#readme |
| `dequal` | 2.0.3 | https://github.com/lukeed/dequal#readme |
| `devlop` | 1.1.0 | https://github.com/wooorm/devlop#readme |
| `diff3` | 0.0.3 | https://github.com/axosoft/diff3#readme |
| `dunder-proto` | 1.0.1 | https://github.com/es-shims/dunder-proto#readme |
| `ee-first` | 1.1.1 | https://github.com/jonathanong/ee-first#readme |
| `encodeurl` | 2.0.0 | https://github.com/pillarjs/encodeurl#readme |
| `es-define-property` | 1.0.1 | https://github.com/ljharb/es-define-property#readme |
| `es-errors` | 1.3.0 | https://github.com/ljharb/es-errors#readme |
| `es-object-atoms` | 1.1.2 | https://github.com/ljharb/es-object-atoms#readme |
| `esbuild` | 0.28.1, 0.28.2 | https://github.com/evanw/esbuild#readme |
| `escape-html` | 1.0.3 | https://github.com/component/escape-html#readme |
| `etag` | 1.8.1 | https://github.com/jshttp/etag#readme |
| `event-target-shim` | 5.0.1 | https://github.com/mysticatea/event-target-shim |
| `events` | 3.3.0 | https://github.com/Gozala/events#readme |
| `eventsource` | 3.0.7 | https://github.com/EventSource/eventsource#readme |
| `eventsource-parser` | 3.1.1 | https://github.com/rexxars/eventsource-parser#readme |
| `express` | 5.3.0 | https://expressjs.com/ |
| `express-rate-limit` | 8.7.1 | https://github.com/express-rate-limit/express-rate-limit |
| `fast-deep-equal` | 3.1.3 | https://github.com/epoberezkin/fast-deep-equal#readme |
| `fdir` | 6.5.0 | https://github.com/thecodrr/fdir#readme |
| `finalhandler` | 2.1.1 | https://github.com/pillarjs/finalhandler#readme |
| `for-each` | 0.3.5 | https://github.com/Raynos/for-each |
| `forwarded` | 0.2.0 | https://github.com/jshttp/forwarded#readme |
| `framer-motion` | 12.43.0 | https://github.com/motiondivision/motion#readme |
| `fresh` | 2.0.0 | https://github.com/jshttp/fresh#readme |
| `fsevents` | 2.3.3 | https://github.com/fsevents/fsevents |
| `function-bind` | 1.1.2 | https://github.com/Raynos/function-bind |
| `get-intrinsic` | 1.3.0 | https://github.com/ljharb/get-intrinsic#readme |
| `get-proto` | 1.0.1 | https://github.com/ljharb/get-proto#readme |
| `gopd` | 1.2.0 | https://github.com/ljharb/gopd#readme |
| `has-property-descriptors` | 1.0.2 | https://github.com/inspect-js/has-property-descriptors#readme |
| `has-symbols` | 1.1.0 | https://github.com/ljharb/has-symbols#readme |
| `has-tostringtag` | 1.0.2 | https://github.com/inspect-js/has-tostringtag#readme |
| `hasown` | 2.0.4 | https://github.com/inspect-js/hasOwn#readme |
| `hast-util-to-html` | 9.0.5 | https://github.com/syntax-tree/hast-util-to-html#readme |
| `hast-util-whitespace` | 3.0.0 | https://github.com/syntax-tree/hast-util-whitespace#readme |
| `hono` | 4.13.13 | https://hono.dev |
| `html-void-elements` | 3.0.0 | https://github.com/wooorm/html-void-elements#readme |
| `http-errors` | 2.0.1 | https://github.com/jshttp/http-errors#readme |
| `iconv-lite` | 0.7.3 | https://github.com/pillarjs/iconv-lite |
| `ignore` | 5.3.2 | https://github.com/kaelzhang/node-ignore#readme |
| `ip-address` | 10.7.3 | https://github.com/beaugunderson/ip-address#readme |
| `ipaddr.js` | 1.9.1 | https://github.com/whitequark/ipaddr.js#readme |
| `is-callable` | 1.2.7 | https://github.com/inspect-js/is-callable#readme |
| `is-promise` | 4.0.0 | https://github.com/then/is-promise#readme |
| `is-typed-array` | 1.1.15 | https://github.com/inspect-js/is-typed-array#readme |
| `isarray` | 2.0.5 | https://github.com/juliangruber/isarray |
| `isomorphic-git` | 1.42.2 | https://isomorphic-git.org/ |
| `jose` | 6.2.12 | https://github.com/panva/jose |
| `json-schema-traverse` | 1.0.0 | https://github.com/epoberezkin/json-schema-traverse#readme |
| `jsonc-parser` | 3.3.1 | https://github.com/microsoft/node-jsonc-parser#readme |
| `math-intrinsics` | 1.1.0 | https://github.com/es-shims/math-intrinsics#readme |
| `mdast-util-to-hast` | 13.2.1 | https://github.com/syntax-tree/mdast-util-to-hast#readme |
| `media-typer` | 1.1.1 | https://github.com/jshttp/media-typer#readme |
| `merge-descriptors` | 2.0.0 | https://github.com/sindresorhus/merge-descriptors#readme |
| `micromark-util-character` | 2.1.1 | https://github.com/micromark/micromark/tree/main#readme |
| `micromark-util-encode` | 2.0.1 | https://github.com/micromark/micromark/tree/main#readme |
| `micromark-util-sanitize-uri` | 2.0.1 | https://github.com/micromark/micromark/tree/main#readme |
| `micromark-util-symbol` | 2.0.1 | https://github.com/micromark/micromark/tree/main#readme |
| `micromark-util-types` | 2.0.3 | https://github.com/micromark/micromark/tree/main#readme |
| `mime-db` | 1.54.0 | https://github.com/jshttp/mime-db#readme |
| `mime-types` | 3.0.2 | https://github.com/jshttp/mime-types#readme |
| `mimic-response` | 3.1.0 | https://github.com/sindresorhus/mimic-response#readme |
| `minimist` | 1.2.8 | https://github.com/minimistjs/minimist |
| `minimisted` | 2.0.1 | https://github.com/kt3k/minimisted#readme |
| `motion` | 12.43.0 | https://github.com/motiondivision/motion#readme |
| `motion-dom` | 12.43.0 | https://github.com/motiondivision/motion#readme |
| `motion-utils` | 12.39.0 | https://github.com/motiondivision/motion#readme |
| `ms` | 2.1.3 | https://github.com/vercel/ms#readme |
| `nanoid` | 3.3.17 | https://github.com/ai/nanoid#readme |
| `negotiator` | 1.1.0 | https://github.com/jshttp/negotiator#readme |
| `object-assign` | 4.1.1 | https://github.com/sindresorhus/object-assign#readme |
| `object-inspect` | 1.13.4 | https://github.com/inspect-js/object-inspect |
| `on-finished` | 2.4.1 | https://github.com/jshttp/on-finished#readme |
| `oniguruma-parser` | 0.12.2 | https://github.com/slevithan/oniguruma-parser#readme |
| `oniguruma-to-es` | 4.3.6 | https://github.com/slevithan/oniguruma-to-es#readme |
| `parseurl` | 1.3.3 | https://github.com/pillarjs/parseurl#readme |
| `path-key` | 3.1.1 | https://github.com/sindresorhus/path-key#readme |
| `path-to-regexp` | 8.4.2 | https://github.com/pillarjs/path-to-regexp#readme |
| `picomatch` | 4.0.5 | https://github.com/micromatch/picomatch |
| `pify` | 4.0.1 | https://github.com/sindresorhus/pify#readme |
| `pkce-challenge` | 5.0.1 | https://github.com/crouchcd/pkce-challenge#readme |
| `possible-typed-array-names` | 1.1.0 | https://github.com/ljharb/possible-typed-array-names#readme |
| `postcss` | 8.5.25 | https://postcss.org/ |
| `process` | 0.11.10 | https://github.com/shtylman/node-process#readme |
| `property-information` | 7.2.0 | https://github.com/wooorm/property-information#readme |
| `proxy-addr` | 2.0.8 | https://github.com/jshttp/proxy-addr#readme |
| `range-parser` | 1.3.0 | https://github.com/jshttp/range-parser#readme |
| `raw-body` | 3.0.2 | https://github.com/stream-utils/raw-body#readme |
| `react` | 19.2.8 | https://react.dev/ |
| `react-day-picker` | 9.14.0 | https://daypicker.dev |
| `react-dom` | 19.2.8 | https://react.dev/ |
| `readable-stream` | 4.8.0 | https://github.com/nodejs/readable-stream |
| `regex` | 6.1.0 | https://github.com/slevithan/regex#readme |
| `regex-recursion` | 6.0.2 | https://github.com/slevithan/regex-recursion#readme |
| `regex-utilities` | 2.3.0 | https://github.com/slevithan/regex-utilities#readme |
| `require-from-string` | 2.0.2 | https://github.com/floatdrop/require-from-string#readme |
| `reselect` | 5.3.0 | https://github.com/reduxjs/reselect#readme |
| `rolldown` | 1.2.2 | https://rolldown.rs/ |
| `rollup` | 4.62.4 | https://rollupjs.org/ |
| `router` | 2.2.0 | https://github.com/pillarjs/router#readme |
| `safe-buffer` | 5.2.1 | https://github.com/feross/safe-buffer |
| `safer-buffer` | 2.1.2 | https://github.com/ChALkeR/safer-buffer#readme |
| `scheduler` | 0.27.0 | https://react.dev/ |
| `send` | 1.2.1 | https://github.com/pillarjs/send#readme |
| `serve-static` | 2.2.1 | https://github.com/expressjs/serve-static#readme |
| `set-function-length` | 1.2.2 | https://github.com/ljharb/set-function-length#readme |
| `shebang-command` | 2.0.0 | https://github.com/kevva/shebang-command#readme |
| `shebang-regex` | 3.0.0 | https://github.com/sindresorhus/shebang-regex#readme |
| `shiki` | 4.5.0 | https://github.com/shikijs/shiki#readme |
| `side-channel` | 1.1.1 | https://github.com/ljharb/side-channel#readme |
| `side-channel-list` | 1.0.1 | https://github.com/ljharb/side-channel-list#readme |
| `side-channel-map` | 1.0.1 | https://github.com/ljharb/side-channel-map#readme |
| `side-channel-weakmap` | 1.0.2 | https://github.com/ljharb/side-channel-weakmap#readme |
| `simple-concat` | 1.0.1 | https://github.com/feross/simple-concat |
| `simple-get` | 4.0.1 | https://github.com/feross/simple-get |
| `space-separated-tokens` | 2.0.2 | https://github.com/wooorm/space-separated-tokens#readme |
| `statuses` | 2.0.2 | https://github.com/jshttp/statuses#readme |
| `string_decoder` | 1.3.0 | https://github.com/nodejs/string_decoder |
| `stringify-entities` | 4.0.4 | https://github.com/wooorm/stringify-entities#readme |
| `supports-color` | 10.2.2 | https://github.com/chalk/supports-color#readme |
| `tinyglobby` | 0.2.17 | https://superchupu.dev/tinyglobby |
| `to-buffer` | 1.2.2 | https://github.com/browserify/to-buffer |
| `toidentifier` | 1.0.1 | https://github.com/component/toidentifier#readme |
| `trim-lines` | 3.0.1 | https://github.com/wooorm/trim-lines#readme |
| `type-is` | 2.1.0 | https://github.com/jshttp/type-is#readme |
| `typed-array-buffer` | 1.0.3 | https://github.com/inspect-js/typed-array-buffer#readme |
| `undici-types` | 8.3.0 | https://undici.nodejs.org |
| `unist-util-is` | 6.0.1 | https://github.com/syntax-tree/unist-util-is#readme |
| `unist-util-position` | 5.0.0 | https://github.com/syntax-tree/unist-util-position#readme |
| `unist-util-stringify-position` | 4.0.0 | https://github.com/syntax-tree/unist-util-stringify-position#readme |
| `unist-util-visit` | 5.1.0 | https://github.com/syntax-tree/unist-util-visit#readme |
| `unist-util-visit-parents` | 6.0.2 | https://github.com/syntax-tree/unist-util-visit-parents#readme |
| `unpipe` | 1.0.0 | https://github.com/stream-utils/unpipe#readme |
| `unplugin` | 3.3.0 | https://unplugin.unjs.io |
| `use-sync-external-store` | 1.7.0 | https://github.com/react/react#readme |
| `vary` | 1.1.2 | https://github.com/jshttp/vary#readme |
| `vfile` | 6.0.3 | https://github.com/vfile/vfile#readme |
| `vfile-message` | 4.0.3 | https://github.com/vfile/vfile-message#readme |
| `vite` | 7.3.6 | https://vite.dev |
| `webpack-virtual-modules` | 0.6.2 | https://github.com/sysgears/webpack-virtual-modules#readme |
| `which-typed-array` | 1.1.24 | https://github.com/inspect-js/which-typed-array#readme |
| `zod` | 4.4.3, 4.6.5 | https://zod.dev |
| `zwitch` | 2.0.4 | https://github.com/wooorm/zwitch#readme |

## ISC

| Package | Versions | Repository |
| --- | --- | --- |
| `@ungap/structured-clone` | 1.4.0 | https://github.com/ungap/structured-clone#readme |
| `d3-array` | 3.2.4 | https://d3js.org/d3-array/ |
| `d3-geo` | 3.1.1 | https://d3js.org/d3-geo/ |
| `inherits` | 2.0.4 | https://github.com/isaacs/inherits#readme |
| `internmap` | 2.0.3 | https://github.com/mbostock/internmap/ |
| `isexe` | 2.0.0 | https://github.com/isaacs/isexe#readme |
| `once` | 1.4.0 | https://github.com/isaacs/once#readme |
| `picocolors` | 1.1.1 | https://github.com/alexeyraspopov/picocolors#readme |
| `setprototypeof` | 1.2.0 | https://github.com/wesleytodd/setprototypeof |
| `which` | 2.0.2 | https://github.com/isaacs/node-which#readme |
| `wrappy` | 1.0.2 | https://github.com/npm/wrappy |
| `zod-to-json-schema` | 3.25.2 | https://github.com/StefanTerdell/zod-to-json-schema#readme |

## Apache-2.0

| Package | Versions | Repository |
| --- | --- | --- |
| `clean-git-ref` | 2.0.1 | https://github.com/TheSavior/clean-git-ref#readme |
| `crc-32` | 1.2.2 | https://sheetjs.com/ |
| `detect-libc` | 2.1.2 | https://github.com/lovell/detect-libc#readme |
| `fast-diff` | 1.3.0 | https://github.com/jhchen/fast-diff#readme |
| `typescript` | 5.9.3, 6.0.3 | https://www.typescriptlang.org/ |

## BSD-3-Clause

| Package | Versions | Repository |
| --- | --- | --- |
| `fast-uri` | 3.1.8 | https://github.com/fastify/fast-uri |
| `ieee754` | 1.2.1 | https://github.com/feross/ieee754#readme |
| `qs` | 6.16.0 | https://github.com/ljharb/qs |
| `source-map-js` | 1.2.1 | https://github.com/7rulnik/source-map-js |

## MPL-2.0

| Package | Versions | Repository |
| --- | --- | --- |
| `lightningcss` | 1.33.0 | https://github.com/parcel-bundler/lightningcss#readme |
| `lightningcss-darwin-arm64` | 1.33.0 | https://github.com/parcel-bundler/lightningcss#readme |

## (MIT AND BSD-3-Clause)

| Package | Versions | Repository |
| --- | --- | --- |
| `sha.js` | 2.4.12 | https://github.com/crypto-browserify/sha.js |

## (MIT AND Zlib)

| Package | Versions | Repository |
| --- | --- | --- |
| `pako` | 1.0.11 | https://github.com/nodeca/pako |

## 0BSD

| Package | Versions | Repository |
| --- | --- | --- |
| `tslib` | 2.8.1 | https://www.typescriptlang.org/ |

## BSD-2-Clause

| Package | Versions | Repository |
| --- | --- | --- |
| `json-schema-typed` | 8.0.2 | https://github.com/RemyRylan/json-schema-typed/tree/main/dist/node |

## MIT OR Apache-2.0

| Package | Versions | Repository |
| --- | --- | --- |
| `@cloudflare/workers-types` | 5.20261011.1 | https://github.com/cloudflare/workerd#readme |