Third-Party Notices

Open-source software distributed with HIVEMIND. This page is generated from THIRD-PARTY-NOTICES.md in the HIVEMIND source tree and is the notice given to recipients of the covered code.

HIVEMIND is built with open-source software. This file lists the third-party runtime dependencies whose licenses ask that recipients be given notice, states how each is used, and points to the authoritative license text that ships inside each package. Permissively licensed dependencies (MIT, ISC, BSD, Apache-2.0 without a NOTICE file) are not individually reproduced here; their license terms travel in their own npm packages.

Last audited: 2026-08-01 (frontend runtime dependencies).

mediabunny 1.52.2

  • SPDX: MPL-2.0 (Mozilla Public License, Version 2.0)
  • Version: 1.52.2 (pinned exactly in frontend/package.json)
  • Integrity: sha512-HIgqL2BAWsWJtaqZRrqcrv7cEajQtCT9noR0dO8cGLKZKML9mmL4BjZOtm6j5I9qAp0v/hr/NmRZhuR6HZyQ7Q== (npm subresource integrity for https://registry.npmjs.org/mediabunny/-/mediabunny-1.52.2.tgz, as recorded in frontend/package-lock.json). This hash is what pins the exact bytes the "used unmodified" statement below refers to.
  • Used for: WebCodecs-based media muxing and demuxing in the in-browser video export path (VE2 W5). It is imported and shipped UNMODIFIED as an npm dependency; none of its source files are altered.
  • License text: the full Mozilla Public License 2.0 is distributed inside the package at node_modules/mediabunny/LICENSE, and is available canonically at https://www.mozilla.org/en-US/MPL/2.0/ (SPDX: https://spdx.org/licenses/MPL-2.0.html).
  • MPL-2.0 is file-level copyleft. Because the package is used unmodified, no HIVEMIND source file becomes subject to the MPL; the obligation satisfied here is preservation of this notice and availability of the covered files' license, which the unmodified upstream package provides.

dompurify

  • SPDX: MPL-2.0 OR Apache-2.0 (dual-licensed). HIVEMIND elects the Apache-2.0 option, whose terms are permissive.
  • Used for: HTML sanitization.
  • License text: distributed inside the package at node_modules/dompurify/LICENSE; Apache-2.0 canonically at https://www.apache.org/licenses/LICENSE-2.0.

Maintenance

When a runtime dependency is added, changed, or removed, re-run the audit (node over frontend/package.json dependencies, flagging any license that is not MIT/ISC/BSD/Apache-2.0/0BSD/CC0/Unlicense) and update this file in the same change. A dependency whose license requires notice must never land without its entry here.

This file is served, so editing it is the whole update

THIS FILE IS THE ONLY COPY. It is served to recipients at /legal/licenses (frontend/src/app/(legal)/legal/licenses/page.tsx), which reads this exact file from disk at BUILD time and renders it. There is deliberately no second copy of this text anywhere in the tree, because a hand-maintained duplicate would drift the first time a dependency changed, and a stale license notice is worse than an ugly one. So: edit this file, redeploy hosting, and the served notice follows. Do not paste any of this text into a page, a component, or a CMS document.

Three properties of that page are load-bearing and are pinned by frontend/test/thirdPartyNotices.test.mts, which fails if any of them is lost:

  • it reads THIS filename, through the shared NOTICES_FILENAME constant;
  • it is behind NO auth, NO feature flag, and NOT behind SiteContentGate (a live CMS document must never be able to replace a license notice);
  • the public /editor route, which is what actually hands an anonymous visitor the MPL-2.0 covered bundle, links to it.

The page throws at build if this file cannot be read. That is intentional: a red build is a much cheaper failure than shipping the covered bundle with no notice attached.

One rule for editing prose here: the renderer understands only headings, paragraphs, bullet lists, fences, and horizontal rules, and it REFLOWS paragraph text. Anything that must keep its exact line breaks (verbatim license text, an address block) must sit inside a fence, or it will be reflowed into prose. A dropped line fails the test suite; a reflowed one does not.

Why any of this is required (VE2 W5/W6): mediabunny is MPL-2.0 and rides inside the in-browser video export bundle. MPL asks that recipients of the covered code be given notice, and a file in a private repository gives notice to nobody who receives it. Before the served page existed, this file satisfied the audit but not the obligation.