Third-Party Notices

shot2code incorporates the third-party components listed below. This file is provided for license-compliance review. shot2code itself is licensed under the MIT License; the documentation and release assets in this hub are published under the MIT License.

Principal direct dependencies, aligned with the public source on 4 October 2026. This is not a complete list and not a transitive SBOM: each component brings dependencies of its own, and the bundled runtimes below aggregate hundreds of separately licensed projects. For a deployment or compliance decision, resolve the manifests and lockfiles named in Authoritative manifests and inspect the license files shipped inside the release you are assessing.

The license column records the identifier each project declares in its own metadata at that date. It is a pointer, not a legal determination, and it does not describe that project's dependencies.

---

Bundled runtimes

These ship inside the Windows installer, which is why it unpacks to roughly 600 MB. They are the largest licensing surface in the product and none of them is a single-license component.

Chromium's full credit list is the authoritative record for both the Electron shell and the headless shell; it is reachable from any Chromium-based browser at chrome://credits and is shipped as a license file inside the respective distributions.

Backend — principal direct dependencies

Declared in backend/pyproject.toml and resolved by backend/uv.lock.

Frontend — principal direct dependencies

Declared in frontend/package.json and resolved by frontend/pnpm-lock.yaml. The frontend is compiled into static assets at build time, so its dependency tree is far larger than the direct references below.

Desktop shell

Declared in desktop/package.json.

The shipped shell is built on Electron 44.4.3 with electron-updater 6.8.9, packaged by electron-builder 26.15.3. npm audit --omit=dev reports 0 vulnerabilities for the dependencies that are actually distributed.

External services, metadata formats and optional local software

These are integrations or inputs, not bundled dependencies. Their own terms, availability and content licences apply when you choose to use them.

Build- and test-time only (not distributed)

Code that shot2code generates

The output stacks — Tailwind CSS, Bootstrap, Bulma, daisyUI, Ionic, Alpine.js, htmx, Preact, Vue, Material 3 and the rest — are referenced by generated projects, not redistributed inside the app. A generated single-file export loads them from their public CDNs, and a generated project folder declares them as ordinary dependencies that your own package manager resolves.

Their licenses therefore apply to the project you export, not to shot2code, and they are not listed here. Generated code is model output: review its licensing, correctness and security before you use it, as noted in SECURITY.md.

Authoritative manifests

Obtaining license texts

Full license texts are distributed with the packages themselves, not reproduced here. To resolve exact versions and their licenses from a checkout of the source:

cd backend;  uv tree
cd frontend; pnpm licenses list
cd desktop;  npm ls --all

Electron, Chromium and the headless shell ship their own license files inside the installed application directory; those files, not this summary, are the record for a bundled runtime.

---

If you believe a component is missing or mis-attributed, please open an issue so it can be corrected.