# Third-party components in the image

The image contains BentoPDF and the modules below, unmodified, at the versions listed; the licences are as each package declares it on npm (read 2026-10-10). The source links are the corresponding source of what the image serves under `/wasm/`.

| Component | Version | Licence | Source |
| --- | --- | --- | --- |
| BentoPDF | v2.8.8 (`f96cd4e5166f3d51393dfe9f3c440b5bb77802f1`) | AGPL-3.0 (or BentoPDF's commercial licence) | <https://github.com/alam00000/bentopdf/tree/v2.8.8> |
| PyMuPDF (WASM, `@bentopdf/pymupdf-wasm`) | 0.11.16 | AGPL-3.0-only | <https://github.com/alam00000/bentopdf-pymupdf-wasm>; the tarball from BentoPDF's `bentopdf-airgap-bundle/` at the commit above |
| Ghostscript (WASM, `@bentopdf/gs-wasm`) | 0.1.1 | AGPL-3.0-only | <https://github.com/alam00000/bentopdf-gs-wasm>; the tarball from BentoPDF's `bentopdf-airgap-bundle/` at the commit above |
| CoherentPDF (`coherentpdf`) | 2.5.5 | AGPL-3.0-or-later | <https://www.npmjs.com/package/coherentpdf/v/2.5.5>, <https://github.com/coherentgraphics/coherentpdf.js> |
| Tesseract.js (`tesseract.js`, `tesseract.js-core`) | 7.0.0 | Apache-2.0 | <https://github.com/naptha/tesseract.js>, <https://github.com/naptha/tesseract.js-core> |
| Tesseract language data (`@tesseract.js-data/deu`, `fra`, `ita`, `eng`) | 1.0.0 (`4.0.0_best_int`) | MIT (as published on npm) | <https://github.com/naptha/tessdata> |
| Noto Sans (OCR text layer) | noto-fonts `ffebf8c1ee449e544955a7e813c54f9b73848eac` | OFL-1.1 | <https://github.com/googlefonts/noto-fonts> |
| EmbedPDF fonts (`@embedpdf/fonts-latin`, `-arabic`, `-hebrew`) | 1.0.0 | OFL-1.1 | <https://github.com/embedpdf/embed-pdf-viewer> |

The npm tarballs are checked against the integrity hashes in `vendor.lock`, the Noto Sans file against the SHA-256 in `scripts/vendor.sh`.