Attributions

Wordpairs Third-Party Attributions

Wordpairs is licensed under GNU GPL version 2 only (GPL-2.0-only). Next.js, React, React DOM, pg, openid-client and @supabase/supabase-js are the six installed, exactly pinned runtime dependencies. Supabase SSR and Zod were reviewed planning options; they are not installed or needed by the current opaque-session and explicit-parser implementation. Vitest, TypeScript, Biome, MSW, React Testing Library, jsdom, Playwright and the fixture libraries/type packages below are installed as development/test dependencies. The CycloneDX npm generator is reserved for Phase 7 and is not installed. package.json and package-lock.json identify installed packages; this document also preserves reviewed future options separately. Update this inventory to match any lockfile change and keep required upstream notices when distributing builds.

Runtime dependencies

Package	Planned use	Reviewed version	Registry version record	License	Upstream
next	Vercel application framework and routing	16.4.3	npm registry	MIT	Next.js
react	User interface components	19.3.1	npm registry	MIT	React
react-dom	Browser rendering for React	19.3.1	npm registry	MIT	React
pg	Server-only PostgreSQL connections to Supabase with one checked-out client per transaction	8.23.1	npm registry	MIT	node-postgres
@supabase/supabase-js	Supabase Postgres API, Auth, and Realtime client	2.118.0	npm registry	MIT	Supabase JS
openid-client	Server-side OpenID Connect client	6.8.8	npm registry	MIT	openid-client

Development and test dependencies

Package	Planned use	Reviewed version	Registry version record	License	Upstream
typescript	Static type checking	6.0.3	npm registry	Apache-2.0	TypeScript
@biomejs/biome	Lint and formatting checks for application and test sources	2.6.3	npm registry	MIT OR Apache-2.0	Biome
@types/react	React type declarations	19.3.0	npm registry	MIT	DefinitelyTyped
@types/react-dom	React DOM type declarations	19.3.0	npm registry	MIT	DefinitelyTyped
@types/node	Node.js type declarations	26.6.5	npm registry	MIT	DefinitelyTyped
@types/pg	Type declarations for the server-only PostgreSQL driver	8.23.1	npm registry	MIT	DefinitelyTyped pg
vitest	Unit and integration test runner	5.0.5	npm registry	MIT	Vitest
@testing-library/react	Component behavior tests	16.3.3	npm registry	MIT	React Testing Library
@testing-library/user-event	User interaction simulation	14.6.8	npm registry	MIT	user-event
@testing-library/jest-dom	DOM accessibility and state matchers	7.0.1	npm registry	MIT	jest-dom
jsdom	Browser-like DOM test environment	30.1.3	npm registry	MIT	jsdom
msw	Mock HTTP and WebSocket service boundaries in tests	3.0.3	npm registry	MIT	Mock Service Worker
@playwright/test	Browser-level acceptance tests	1.64.1	npm registry	Apache-2.0	Playwright
@cyclonedx/cyclonedx-library	Validate test archive fixtures against the bundled official CycloneDX 1.6 schema	10.3.0	npm registry	Apache-2.0	CycloneDX JavaScript library
ajv	JSON Schema engine used by the CycloneDX fixture validator	8.20.0	npm registry	MIT	Ajv
ajv-formats	Standard format validators required by the CycloneDX schema engine	3.0.1	npm registry	MIT	ajv-formats
ajv-formats-draft2019	Draft 2019 format validators required by the CycloneDX schema engine	1.6.1	npm registry	MIT	ajv-formats-draft2019
yauzl	Inspect and extract temporary ZIP release fixtures in tests	3.4.0	npm registry	MIT	yauzl
yazl	Construct temporary ZIP release fixtures in tests	3.3.1	npm registry	MIT	yazl
@types/yauzl	Type declarations for ZIP fixture inspection	2.10.3	npm registry	MIT	DefinitelyTyped yauzl
@types/yazl	Type declarations for ZIP fixture construction	3.3.0	npm registry	MIT	DefinitelyTyped yazl

Reviewed options not installed

Package	Planning disposition	Reviewed version	License	Upstream
@supabase/ssr	Superseded by application-owned opaque sessions; no current runtime use	0.12.7	MIT	Supabase SSR
zod	Superseded by explicit transport parsers and domain validation; no current runtime use	4.6.7	MIT	Zod
@cyclonedx/cyclonedx-npm	Future Phase 7 deployment SWBOM generator	6.0.1	Apache-2.0	CycloneDX npm generator

These are historical version/license review records, not current registry recommendations. Revalidate any option before adding it to the lockfile.

License compatibility policy

The Apache-2.0 entries above are development or build tools and are not bundled with the game. Do not copy, embed, or ship third-party code or assets in the GPL-2.0-only game until their license compatibility and required notices have been checked. The SWBOM records declared licenses; it does not make a compatibility decision.

External assets and content

The Mermaid-rendered workflow SVGs embed the Recursive Variable font for diagram labels. The font includes its SIL Open Font License 1.1 notice in the SVG source.

Asset	Use	License	Source / notice
Recursive Variable font (embedded in the Mermaid-generated workflow SVGs under docs/word_association_*.svg)	Diagram labels only; not an application runtime dependency	SIL Open Font License 1.1	Recursive project; copyright and license notice are embedded in each generated SVG.
Unicode CaseFolding data, version 18.0.0, Copyright © 2026 Unicode, Inc.	Full default Unicode case folding for exact answer comparison; generated C+F mapping in src/domain/unicode-casefold.json	Unicode-3.0 (permissive data/software redistribution with notice)	Versioned upstream data; original data and complete copyright/permission notice are preserved in third_party/unicode/. SHA-256: a004797658a457bec4dc11683e39f69249ea3b595b752dbea6721c4c9f587b0d.

The six category concepts use twelve AI-generated and recomposed WebP backgrounds created with the built-in image-generation tool. The artwork guide and provenance manifest retain the prompts, generation/recomposition steps, delivery dimensions and file hashes. Generation provenance does not establish third-party rights clearance. Static catalog hints are project-authored text and contain no song lyrics or copied descriptions. Other architecture diagrams are authored as project SVGs. Add source, creator, license, and required credit wording here before introducing external assets or content.