# Third-party notices

RepoLocus's direct runtime dependencies retain their own copyright and license notices:

| Dependency | License |
|---|---|
| Typer | MIT |
| Rich | MIT |
| HTTPX | BSD-3-Clause |
| PathSpec | MPL-2.0 |
| Platformdirs | MIT |
| FastAPI (optional API extra) | MIT |
| Uvicorn (optional API extra) | BSD-3-Clause |

The authoritative versions and transitive dependency graph are recorded in `uv.lock`. CI emits
a CycloneDX SBOM for core plus API runtime dependencies, creates a full installed-package
license report, blocks licenses requiring explicit review, and audits published dependencies
for known vulnerabilities. Each dependency's own distribution remains the authoritative source
for its copyright and complete license text.
