THIRD-PARTY NOTICES FOR THE CL-BUN BINARY

This file maps copyright notices to the third-party components identified by
the upstream Bun licence inventory. Standard licence terms are installed once
in the adjacent licenses directory; component-specific multi-licence
inventories remain separate. The version-specific SOURCE-MANIFEST.txt
identifies the exact Bun, WebKit, and TinyCC source commits.

Copyright notices have been checked against the stated source revision;
entries without a copyright notice are inventory items only, not synthesized
holder claims. The embedded JavaScript fallback package closure and its exact
notices are recorded in
NODE-FALLBACK-NOTICES.txt. Its header binds the generated attribution to the
exact Bun source revision and lock digest. The third-party Rust crates linked
into the executable and their exact notices are recorded in
RUST-CRATE-NOTICES.txt, whose header binds them to the exact Bun source
revision and Cargo.lock digest.

Bun source and build system (MIT)
See the upstream LICENSE inventory and exact Bun source identified by
SOURCE-MANIFEST.txt.

WebKit, JavaScriptCore, and WebCore (LGPL-2.0-or-later)
See licenses/LGPL-2.0.txt and the exact source identified by
SOURCE-MANIFEST.txt.

TinyCC, from the oven-sh/tinycc fork and patched by Bun (LGPL-2.1-or-later)
See licenses/LGPL-2.1.txt and the exact source identified by
SOURCE-MANIFEST.txt.

uSockets and the uWebSockets fork (Apache-2.0)
Vendored in the exact Bun source revision recorded by SOURCE-MANIFEST.txt under
packages/bun-usockets. Full terms: licenses/Apache-2.0.txt. That source tree
contains no NOTICE file.

simdutf, under its MIT alternative
The exact WebKit source revision recorded by SOURCE-MANIFEST.txt vendors the
simdutf implementation under Source/WTF/wtf/simdutf. Full selected terms:
licenses/MIT.txt. Copyright notice from that source:
Copyright 2021 The simdutf authors

highway (upstream licence inventory)
Pinned by Bun at google/highway@2607d3b5b0113992fe84d3848859eae13b3b52c1.
Verbatim upstream licence inventory: licenses/highway-LICENSE.txt. That
revision contains no NOTICE file.
Copyright (c) The Highway Project Authors. All rights reserved.

TigerBeetle IO portions (Apache-2.0)
The Bun inventory identifies TigerBeetle revision
532c8b70b9142c17e07737ab6d3da68d7500cbca. Full terms:
licenses/Apache-2.0.txt. That revision contains no NOTICE file.

LLVM libc++abi __cxa_thread_atexit fallback
(Apache-2.0 WITH LLVM-exception)
The Bun inventory identifies LLVM tag llvmorg-19.1.0. The exact upstream
libc++abi licence inventory, including the LLVM exception and legacy terms, is
installed once as licenses/libcxxabi-LICENSE.txt. That revision contains no
NOTICE.TXT file.

lol-html (BSD-3-Clause)
Pinned by Bun at oven-sh/lol-html@725ce499aa9b71e38b7a2d0a9fbb6d7294a4079e.
Full terms: licenses/BSD-3-Clause.txt. Copyright notice from that revision:
Copyright (C) 2019, Cloudflare, Inc.

libwebp (BSD-3-Clause)
Pinned by Bun at webmproject/libwebp@b7e29b9d75bd31422b00c2a446d49d7af06c328d.
Verbatim terms: licenses/libwebp-COPYING.txt. Copyright notice from that revision:
Copyright (c) 2010, Google Inc. All rights reserved.

libjpeg-turbo TurboJPEG API and build system (BSD-3-Clause)
Pinned by Bun at
libjpeg-turbo/libjpeg-turbo@c85e6b905bf237038faa936dab160ebfc5da0344.
Verbatim upstream licence inventory:
licenses/libjpeg-turbo-LICENSE.txt. The complete verbatim IJG source notice is
licenses/libjpeg-turbo-README.ijg.txt.
Copyright (C) 2009-2026 D. R. Commander
Copyright (C) 2018-2023 Randy <randy408@protonmail.com>

libjpeg-derived code in libjpeg-turbo (IJG)
Copyright (C) 1991-2020 Thomas G. Lane and Guido Vollbeding.
This software is based in part on the work of the Independent JPEG Group.

Chromium proto-quic portions in lsquic (BSD-3-Clause)
Pinned with lsquic at
litespeedtech/lsquic@f812ceb9529e26717df78c6064a2ff648b949f3e.
Verbatim terms: licenses/lsquic-LICENSE.chrome.txt. Copyright notice from that
revision:
Copyright 2015 The Chromium Authors. All rights reserved.

zstd, under its BSD-3-Clause alternative
Pinned by Bun at facebook/zstd@f8745da6ff1ad1e7bab384bd1f9d742439278e99.
Verbatim terms: licenses/zstd-LICENSE.txt. Copyright notice from that revision:
Copyright (c) Meta Platforms, Inc. and affiliates. All rights reserved.

libbase64-derived base64 decode lookup table (BSD-2-Clause)
Bun 1.4.4 does not link the libbase64 library or vendor its source tree. Its
src/jsc/bindings/highway_sourcemap.cpp instead states that a base64 decode
lookup table is derived from the simdutf/aklomp decoders and reproduced
verbatim. The table bytes match aklomp/base64 revision
3a5add8652076612a8407627a42c768736a4263f, the last libbase64 revision that
Bun itself pinned before replacing that dependency with simdutf in commit
a0032d1b5c3333c6751525b658a106ed3fdb0fa1. Bun commit
c1da139f093cf7d876844518067fd490a3cf47c7 introduced the later table. The 2026
Bun commit does not record an external source revision. This record therefore
describes the verified byte match and former Bun pin; it does not assert that
revision as a recorded source pin for the later copy.
Verbatim terms and notice: licenses/libbase64-LICENSE.txt. The upstream notice
at aklomp/base64
revision 3a5add8652076612a8407627a42c768736a4263f has SHA-256
42871ad9f4e5e9255a4ec80b6c5ec9989bab6964693cf5fee6bb33f3afe39220 and
records:
Copyright (c) 2005-2007, Nick Galbreath
Copyright (c) 2015-2018, Wojciech Muła
Copyright (c) 2016-2017, Matthieu Darbois
Copyright (c) 2013-2022, Alfred Klomp

libspng (BSD-2-Clause and libpng-2.0)
Pinned by Bun at randy408/libspng@fb768002d4288590083a476af628e51c3f1d47cd.
Its spng/spng.c declares SPDX-License-Identifier: (BSD-2-Clause AND
libpng-2.0), and Bun compiles that file with SPNG_SSE set to 4 on x86-64,
which includes its SIMD filter code derived from libpng. The approved 1.4.0
bundle mapped libspng to BSD-2-Clause and zlib; that revision contains no
zlib-licensed text and the libpng-2.0 terms were missing, so the mapping was
corrected for 1.4.4. Full terms: licenses/BSD-2-Clause.txt and
licenses/libpng-2.0.txt. The latter is lines 6148-6181 of that spng/spng.c
(file SHA-256
59243c1ca05956f124c7debef763b707378b52e4dbfeaf17e6192917dd8c8dc2), verbatim.
Copyright notice from the LICENSE file of that revision:
Copyright (c) 2018-2023, Randy <randy408@protonmail.com>
Copyright notices from the libpng licence in spng/spng.c:
Copyright (c) 1995-2019 The PNG Reference Library Authors.
Copyright (c) 2018-2019 Cosmin Truta.
Copyright (c) 2000-2002, 2004, 2006-2018 Glenn Randers-Pehrson.
Copyright (c) 1996-1997 Andreas Dilger.
Copyright (c) 1995-1996 Guy Eric Schalnat, Group 42, Inc.
Copyright notices from the SSE2 filter code in spng/spng.c, which the x86-64
build compiles:
Copyright (c) 2018 Cosmin Truta
Copyright (c) 2016-2017 Glenn Randers-Pehrson

HdrHistogram_c, under its BSD-2-Clause alternative
Pinned by Bun at
HdrHistogram/HdrHistogram_c@18c7a324383dded1451d15621cd018b0048057d0.
Verbatim upstream licence inventory: licenses/hdrhistogram-LICENSE.txt.
Copyright notices from that revision:
Copyright (c) 2012, 2013, 2014 Gil Tene
Copyright (c) 2014 Michael Barker
Copyright (c) 2014 Matt Warren
Copyright (c) 2015 Philip Orwig

brotli (MIT)
Pinned by Bun at google/brotli@db24a98aed38a16de78cc05ca15cdd8dc2a0d92d.
Full terms: licenses/MIT.txt. Copyright notice from that revision:
Copyright (c) 2009, 2010, 2013-2016 by the Brotli Authors.

mimalloc (MIT)
Pinned by Bun at oven-sh/mimalloc@92ef6587c57b262f6e6abf513f7776a2f8d12aeb.
Full terms: licenses/MIT.txt. Copyright notice from that revision:
Copyright (c) 2018-2025 Microsoft Corporation, Daan Leijen

c-ares (MIT)
Pinned by Bun at c-ares/c-ares@c7a3138dcfe3bb0eaaf10c0c24c36dc66dc790ab.
Verbatim terms: licenses/c-ares-LICENSE.txt. Copyright notices from that
revision:
Copyright (c) 1998 Massachusetts Institute of Technology
Copyright (c) 2007 - 2023 Daniel Stenberg with many contributors, see AUTHORS
file.

libuv (MIT)
Pinned by Bun at oven-sh/libuv@8023581113b276e7c1aee3f82da57ca0893faab1.
Full terms: licenses/MIT.txt. Copyright notice from that revision:
Copyright (c) 2015-present libuv project contributors.

libdeflate (MIT)
Pinned by Bun at ebiggers/libdeflate@92e6a0db9fa848d742f9eb286c92afc60f2c3dda.
Full terms: licenses/MIT.txt. Copyright notices from that revision:
Copyright 2016 Eric Biggers
Copyright 2024 Google LLC

ls-hpack (MIT)
Pinned by Bun at
litespeedtech/ls-hpack@cf0f70dd10b352194c97448eb5d00b4aa484f531.
Full terms: licenses/MIT.txt. Copyright notice from that revision:
Copyright (c) 2018 - 2023 LiteSpeed Technologies Inc

ls-qpack (MIT)
Pinned by Bun at
litespeedtech/ls-qpack@91567706c41c0d97ab8dc576873ecd472d7869fa.
Full terms: licenses/MIT.txt. Copyright notice from that revision:
Copyright (c) 2018 - 2026 LiteSpeed Technologies Inc

lsquic (MIT, except the Chromium portions above)
Pinned by Bun at
litespeedtech/lsquic@f812ceb9529e26717df78c6064a2ff648b949f3e.
Verbatim terms: licenses/lsquic-LICENSE.txt. Copyright notice from that revision:
Copyright (c) 2017 - 2026 LiteSpeed Technologies Inc

uucode-derived grapheme breaking implementation (MIT)
Bun incorporation commit 86d4d87beb1703f220ffba776f10f383841aaeb0
contains the exact uucode snapshot that Bun imported and its licence. Current
Bun source identifies its grapheme algorithm and generated tables as ported
from or derived from uucode. No external uucode revision is claimed.
Full terms: licenses/MIT.txt. The notice from that exact Bun incorporation
snapshot has SHA-256
75b52b07e8f6ed6b1700ca6e4bcff93a59258624d4fd1ab7eae4c071c860b69b and
records:
Copyright (c) 2025 Jacob Sandlund
The imported licence refers to separate Bjoern Hoehrmann and Unicode licence
files in the uucode project. They are installed separately rather than treated
as covered by the generic MIT text or the independently packaged ICU terms.

Bjoern Hoehrmann UTF-8 decoder table (MIT)
The exact Bun incorporation snapshot includes the decoder table and identifies
https://bjoern.hoehrmann.de/utf-8/decoder/dfa/ and the uucode file
licenses/LICENSE_Bjoern_Hoehrmann as its terms. The referenced upstream file
was introduced by uucode commit 731c2c0da439e71b9125cae2315e621f1e61deb4
and has SHA-256
de219cece932aad5a817bf763393d8d149d378a15d2ad5320e3331eac07626dd.
Its verbatim notice and terms are installed as
licenses/uucode-LICENSE-Bjoern-Hoehrmann.txt and record:
Copyright (c) 2008-2009 Bjoern Hoehrmann <bjoern@hoehrmann.de>

Unicode data used by uucode (Unicode-3.0)
The uucode licence imported by Bun identifies licenses/LICENSE_unicode for the
Unicode data used to generate its tables. That referenced file was added by
uucode commit 90a5dfa34a1da9d59b96417d73843c3c658f4816 and has
SHA-256
1eda5a3b026870c737b22e8bcd4954338612c790db688242e003f41a4fa95175.
Its verbatim notice and terms are installed as
licenses/uucode-LICENSE-Unicode.txt and record:
Copyright © 1991-2025 Unicode, Inc.

Those two commits establish the provenance of the referenced licence files;
they are not asserted as a source pin for the complete external uucode tree.
No external uucode revision is claimed.

picohttpparser, under its MIT alternative
Pinned by Bun at
h2o/picohttpparser@f4d94b48b31e0abae029ebeafcfd9ca0680ede58.
Verbatim dual-licence terms: licenses/picohttpparser-LICENSE.txt. Copyright
notice from the upstream source header:
Copyright (c) 2009-2014 Kazuho Oku, Tokuhiro Matsuno, Daisuke Murase,
Shigeo Mitsunari

zlib-ng (zlib)
Pinned by Bun at zlib-ng/zlib-ng@12731092979c6d07f42da27da673a9f6c7b13586.
Full terms: licenses/zlib.txt. Copyright notice from that revision:
(C) 1995-2024 Jean-loup Gailly and Mark Adler

zlib-licensed portions of libjpeg-turbo
See licenses/libjpeg-turbo-LICENSE.txt; full zlib terms are installed once as
licenses/zlib.txt.

ICU (Unicode-DFS-2016)
The exact WebKit source revision recorded by SOURCE-MANIFEST.txt vendors ICU
under Source/WTF/icu. Its verbatim licence is licenses/ICU.txt.
Copyright © 1991-2020 Unicode, Inc. All rights reserved.

BoringSSL (multiple permissive licences)
Pinned by Bun at
oven-sh/boringssl@41bf9b59c2ebf277a7aa427e1ecad5cc80dd4d4f.
See the verbatim upstream inventory in licenses/boringssl-LICENSE.txt.

libarchive (multiple BSD-style and other permissive licences)
Pinned by Bun at
libarchive/libarchive@27cbc7827172698143e440801fc0ba39ccb4f1f5.
See the verbatim upstream inventory in licenses/libarchive-COPYING.txt.

SQLite (public domain)
SQLite is dedicated to the public domain by its author, D. Richard Hipp.

Embedded JavaScript polyfills (multiple permissive licences)
NODE-FALLBACK-NOTICES.txt records every lock key, unique package/version, npm
tarball URL and integrity, declared licence, and verbatim licence or notice
material shipped in each integrity-verified package archive.

typescript-go ports in bun check (Apache-2.0)
The type checker behind bun check, and the parser it shares with bun lint and
bun fmt, are ports of typescript-go and use TypeScript's diagnostic messages
and lib.*.d.ts files. Bun's src/sema/lib.rs credits typescript-go as
"Copyright Microsoft Corporation, Apache License 2.0". The retained Bun source
tree records the ported revisions in
test/cli/check/typescript-go/version.json: microsoft/typescript-go
2bd066d87f5bafd315be9f40889d0a60b9e58e0b and microsoft/TypeScript
4d4f005c8541e0255a9d8791205fdce326e462bc. Full terms:
licenses/Apache-2.0.txt. licenses/typescript-go-NOTICE.txt is the NOTICE.txt
kept in that directory, verbatim; it matches NOTICE.txt of typescript-go at
2bd066d8 apart from line endings (upstream uses CRLF). The licence file in that
directory, which also matches typescript-go's LICENSE at 2bd066d8 apart from
line endings, names no copyright holder.

ESLint ports in bun lint (MIT)
bun lint ports large parts of ESLint, including code path analysis, rule
helpers, config and comment handling, many rules with their names, options,
messages and presets, and parts of its worker and bindings code. Full terms:
licenses/MIT.txt. Copyright notice from the retained Bun source tree at
test/cli/lint/conformance/licenses/eslint.txt:
Copyright OpenJS Foundation and other contributors, <www.openjsf.org>

typescript-eslint ports in bun lint (MIT)
bun lint ports the typescript-eslint rules, type-utils and the plugin's util
helpers, and uses its presets, the typescript-estree error messages and the
scope-manager lib globals. Full terms: licenses/MIT.txt. Copyright notice from
the retained Bun source tree at
test/cli/lint/conformance/licenses/typescript-eslint.txt:
Copyright (c) 2019 typescript-eslint and other contributors

esquery port in bun lint (BSD-3-Clause)
Selectors in bun lint are a port of esquery. Full terms:
licenses/BSD-3-Clause.txt. Copyright notice from the npm package esquery
1.7.0:
Copyright (c) 2013, Joel Feenstra

regexpp, eslint-utils and other helper ports in bun lint (MIT)
bun lint has ports of @eslint-community/regexpp,
@eslint-community/eslint-utils, levn and natural-compare, and of parts of
ts-api-utils and @eslint/eslintrc. Full terms: licenses/MIT.txt. Bun records
no ported revisions; the notices below are snapshots.
Copyright notice of @eslint-community/regexpp from
eslint-community/regexpp@76b6a3aef2d53972e0a3ca5dd9e83f6bb6ec6e78:
Copyright (c) 2018 Toru Nagashima
Copyright notice of @eslint-community/eslint-utils from
eslint-community/eslint-utils@3d8d9476c382318bf1a620fc1f6a1ac14dabaaf4:
Copyright (c) 2018 Toru Nagashima
Copyright notice of levn from
gkz/levn@bfe5bbd351804304d12adc0de70e512b5f7709f3:
Copyright (c) George Zahariev
Copyright notice of natural-compare from
litejs/natural-compare-lite@a8e1e32c85713ba7d079445207a808ce6f4852f9:
Copyright (c) Lauri Rooden <lauri@rooden.ee>
The ts-api-utils 2.5.0 licence in the notices of the npm package prettier
3.9.9 names no copyright holder.
Copyright notice of @eslint/eslintrc from
eslint/eslintrc@650fa4e86d81e4e011c45a2699ba0bbd0bf7a384:
Copyright OpenJS Foundation and other contributors, <www.openjsf.org>

ajv, acorn, optionator, globals and is-core-module material in bun lint (MIT)
bun lint uses the error messages of ajv, acorn and optionator, and the lists
in globals and is-core-module. Full terms: licenses/MIT.txt.
Copyright notice of ajv from a notice snapshot at
ajv-validator/ajv@f177fe323420ccb23e1a79445fd470cbf80aee7c:
Copyright (c) 2015-2021 Evgeny Poberezkin
Copyright notice of acorn 8.17.0 from the notices of the npm package prettier
3.9.9:
Copyright (C) 2012-2022 by various contributors (see AUTHORS)
Copyright notice of optionator from a notice snapshot at
gkz/optionator@4babe25432de186943d78f8f69875d1255802f72:
Copyright (c) George Zahariev
Copyright notice from the npm package globals 16.5.0:
Copyright (c) Sindre Sorhus <sindresorhus@gmail.com> (https://sindresorhus.com)
Copyright notice from the npm package is-core-module 2.17.0:
Copyright (c) 2014 Dave Justice

espree error messages in bun lint (BSD-2-Clause)
bun lint uses the error messages of espree. Full terms:
licenses/BSD-2-Clause.txt. Copyright notice of espree 11.2.0 from the notices
of the npm package prettier 3.9.9:
Copyright (c) Open JS Foundation

V8 JSON.parse error messages in bun lint (BSD-3-Clause)
bun lint uses the JSON.parse error messages of V8. Full terms:
licenses/BSD-3-Clause.txt. Bun records no ported revision. Copyright notice
from a notice snapshot at v8/v8@3d0775b189648ce7a2a785a46f6a84028c513256:
Copyright 2014, the V8 project authors. All rights reserved.

eslint/rewrite package ports in bun lint (Apache-2.0)
bun lint has ports of parts of @eslint/plugin-kit, @eslint/config-array,
@eslint/config-helpers and @eslint/compat. Full terms:
licenses/Apache-2.0.txt. Bun records no ported revision. The licence file in
the notice snapshot at eslint/rewrite@7ff1f972972783516a243b76de98a84f3ec9ea5f
names no copyright holder, and that revision contains no NOTICE file.

ignore pattern table in bun lint and bun fmt (MIT)
bun lint and bun fmt have a port of the pattern-to-regular-expression table of
ignore. Full terms: licenses/MIT.txt. Copyright notice from the npm package
ignore 5.3.2:
Copyright (c) 2013 Kael Zhang <i@kael.me>, contributors

is-glob and is-extglob ports in bun lint and bun fmt (MIT)
bun lint and bun fmt have ports of is-glob and is-extglob. Full terms:
licenses/MIT.txt. Copyright notices of is-glob 4.0.3 and is-extglob 2.1.1
from the notices of the npm package prettier 3.9.9:
Copyright (c) 2014-2017, Jon Schlinkert.
Copyright (c) 2014-2016, Jon Schlinkert

glob-parent port in bun lint and bun fmt (ISC)
bun lint and bun fmt have a port of glob-parent. Full terms:
licenses/ISC.txt. Copyright notice of glob-parent 5.1.2 from the notices of
the npm package prettier 3.9.9:
Copyright (c) 2015, 2019 Elan Shanker

react-hooks, import, n, react and prettier rule ports in bun lint (MIT)
The react-hooks, import, n, react and prettier rules in bun lint are ports of
the rules in eslint-plugin-react-hooks, eslint-plugin-import, eslint-plugin-n,
eslint-plugin-es-x, eslint-plugin-react and eslint-plugin-prettier, with the
Node.js version tables of eslint-plugin-n and a few functions from
jsx-ast-utils and prettier-linter-helpers. Full terms: licenses/MIT.txt.
Copyright notices from the retained Bun source tree at
test/cli/lint/conformance/licenses/eslint-plugin-react-hooks.txt,
eslint-plugin-import.txt, eslint-plugin-n.txt, eslint-plugin-react.txt and
eslint-plugin-prettier.txt, in that order:
Copyright (c) Meta Platforms, Inc. and affiliates.
Copyright (c) 2015 Ben Mosher
Copyright (c) 2015 Toru Nagashima
Copyright (c) 2014 Yannick Croissant
Copyright © 2017 Andres Suarez and Teddy Katz
Copyright notice of eslint-plugin-es-x from a notice snapshot at
eslint-community/eslint-plugin-es-x@715caa02a16b4f659d4819fb791359819b0fd15a:
Copyright (c) 2018 Toru Nagashima
Copyright notice of jsx-ast-utils from a notice snapshot at
jsx-eslint/jsx-ast-utils@7cc40c4d2b88f221eae5ec2868754d31a85d8d71:
Copyright (c) 2016 Ethan Cohen
Copyright notice from the npm package prettier-linter-helpers 1.0.1:
Copyright © 2017 Andres Suarez and Teddy Katz
Bun records no ported revision for the two snapshots.

diff-match-patch and fast-diff text diff (Apache-2.0)
The text diff used by bun test and the prettier/prettier rule has parts of
diff-match-patch and of fast-diff, which is derived from it. Full terms:
licenses/Apache-2.0.txt. The licence file in the notice snapshot at
google/diff-match-patch@62f2e689f498f9c92dbc588c58750addec9b1654 names no
copyright holder; Bun records no ported revision. Copyright notice from the
npm package fast-diff 1.3.0:
Copyright 2014-2023 Jason Chen
Neither that revision nor that package contains a NOTICE file.

oxlint rule ports in bun lint (MIT)
The unicorn, oxc, react-perf, jsx-a11y, nextjs, promise, node, jest and vitest
rules in bun lint are ports of the oxlint rules, with their messages and help
text; with an oxlint config, the other rules use oxlint and tsgolint messages
too. bun lint also ports parts of oxc_jsdoc and oxc_react_compiler. Full
terms: licenses/MIT.txt. Copyright notices from the retained Bun source tree
at test/cli/lint/conformance/licenses/oxc.txt:
Copyright (c) 2024-present VoidZero Inc. & Contributors
Copyright (c) 2023 Boshen
and at test/cli/lint/conformance/licenses/tsgolint.txt:
Copyright (c) 2025 July-present VoidZero Inc. & Contributors
Copyright (c) 2025 July typescript-eslint and other contributors

Rules that oxlint ported from ESLint plugins (MIT)
oxlint ported those rules from eslint-plugin-unicorn,
eslint-plugin-react-perf, eslint-plugin-jsx-a11y, @next/eslint-plugin-next,
eslint-plugin-n, eslint-plugin-jest and @vitest/eslint-plugin; their rule
names, options and some messages are in bun lint. Full terms:
licenses/MIT.txt. Bun records no ported revisions; except for
eslint-plugin-n, the notices below are snapshots.
Copyright notice of eslint-plugin-unicorn from
sindresorhus/eslint-plugin-unicorn@ee3edf06ba46b97e5e83e08f87d023171145cb47:
Copyright (c) Sindre Sorhus <sindresorhus@gmail.com> (https://sindresorhus.com)
Copyright notice of eslint-plugin-react-perf from
cvazac/eslint-plugin-react-perf@1a99d1e44c39d78293c5ab1a6ef6f20347c4f0b9:
Copyright (c) 2016 Charles Vazac
Copyright notice of eslint-plugin-jsx-a11y from
jsx-eslint/eslint-plugin-jsx-a11y@8f75961d965e47afb88854d324bd32fafde7acfe:
Copyright (c) 2016 Ethan Cohen
Copyright notice of @next/eslint-plugin-next from
vercel/next.js@2998a2e801caab665d603daefc7445c04309285a:
Copyright (c) 2025 Vercel, Inc.
Copyright notice of eslint-plugin-n from the retained Bun source tree at
test/cli/lint/conformance/licenses/eslint-plugin-n.txt:
Copyright (c) 2015 Toru Nagashima
Copyright notice of eslint-plugin-jest from
jest-community/eslint-plugin-jest@ee44deed3c55a9b690ee18201e2506cf91f696b2:
Copyright (c) 2018 Jonathan Kim
Copyright notice of @vitest/eslint-plugin from
vitest-dev/eslint-plugin-vitest@c5df1054a25044a7ca5baf07461b7aee1f15f5f2:
Copyright (c) 2022 - PRESENT Verité Mugabo  Makuza

eslint-plugin-promise rules by way of oxlint (ISC)
oxlint ported its promise rules from eslint-plugin-promise. Full terms:
licenses/ISC.txt. Bun records no ported revision. Copyright notice
from a notice snapshot at
eslint-community/eslint-plugin-promise@51c6308694dacaf338c42c4a3e5031583416b877:
Copyright (c) 2020, Jamund Ferguson

aria-query tables by way of oxlint (Apache-2.0)
The ARIA tables of the jsx-a11y rules come from aria-query by way of oxlint.
Full terms: licenses/Apache-2.0.txt. Bun records no ported revision.
Copyright notice from a notice snapshot at
A11yance/aria-query@c151dafa6ab17143479e5aeaa0826a3d657cc5be, which contains
no NOTICE file:
Copyright 2020 A11yance

Prettier port in bun fmt (MIT)
bun fmt is a port of Prettier: its printers for CSS, SCSS, Less, HTML, Vue,
Angular, Markdown, YAML, GraphQL and Handlebars, its document printer, its
handling of options, pragmas, ranges, cursor offsets and embedded code, and
the HTML tables it is built with.
Full terms: licenses/MIT.txt. Copyright notice from the retained Bun source
tree at test/cli/format/prettier/LICENSE:
Copyright © James Long and contributors

oxc_formatter and Biome formatter port in bun fmt (MIT)
The JavaScript and TypeScript printer of bun fmt, its JSDoc formatting and its
oxfmt-style import sorting are a port of oxc_formatter, which is a port of the
Biome formatter; the intermediate representation and its printer come from
Biome by way of oxc_formatter_core. Biome is dual-licensed under MIT or
Apache-2.0 (its repository has LICENSE-MIT and LICENSE-APACHE); it is used
under its MIT alternative. Full terms: licenses/MIT.txt. Copyright notices
from the retained Bun source tree at
test/cli/lint/conformance/licenses/oxc.txt:
Copyright (c) 2024-present VoidZero Inc. & Contributors
Copyright (c) 2023 Boshen
Copyright notices of Biome from a notice snapshot at
biomejs/biome@35c69ade9bf8c5aac23d871f1da34b0890a5aeef; Bun records no
ported revision:
Copyright (c) 2023-present Biome Developers and Contributors.
Copyright (c) 2020-2023 Rome Tools is Rome Tools, Inc. and its affiliates.

postcss and other parser ports in bun fmt (MIT)
bun fmt has ports of the parsers in postcss, postcss-scss, postcss-less,
postcss-selector-parser, postcss-media-query-parser, postcss-values-parser,
angular-html-parser, graphql-js, @glimmer/syntax, simple-html-tokenizer and
@angular/compiler, and of parts of yaml-unist-parser and
angular-estree-parser. Full terms: licenses/MIT.txt. Copyright notices from
the notices of the npm package prettier 3.9.9, for postcss 8.5.16, postcss-scss
4.0.9, postcss-less 6.0.0, postcss-selector-parser 2.2.3, postcss-values-parser
2.0.1, angular-html-parser 10.12.0, graphql 17.0.2, @glimmer/syntax 0.95.0,
simple-html-tokenizer 0.5.11, @angular/compiler 22.0.6, yaml-unist-parser
3.2.0 and angular-estree-parser 15.5.0, in that order:
Copyright 2013 Andrey Sitnik <andrey@sitnik.es>
Copyright 2013 Andrey Sitnik <andrey@sitnik.ru>
Copyright (c) 2013 Andrey Sitnik <andrey@sitnik.ru>
Copyright (c) 2016 Denys Kniazevych <webschik@gmail.com>
Copyright (c) 2016 Pat Sissons <patricksissons@gmail.com>
Copyright (c) 2017 Andrew Powell <andrew@shellscape.org>
Copyright (c) Ben Briggs <beneb.info@gmail.com> (http://beneb.info)
Copyright (c) Andrew Powell <andrew@shellscape.org>
Copyright (c) Ika <ikatyang@gmail.com> (https://github.com/ikatyang)
Copyright (c) GraphQL Contributors
Copyright (c) 2015 Tilde, Inc.
Copyright (c) 2014 Yehuda Katz and contributors
Copyright (c) 2010-2026 Google LLC. https://angular.dev/license
Copyright (c) Ika <ikatyang@gmail.com> (https://github.com/ikatyang)
Copyright (c) Ika <ikatyang@gmail.com> (https://github.com/ikatyang)
The postcss-media-query-parser 0.2.3 record there contains no licence text
and names no copyright holder.

@handlebars/parser and yaml ports in bun fmt (ISC)
bun fmt also has a port of @handlebars/parser and of one file of yaml. Full
terms: licenses/ISC.txt. The @handlebars/parser 2.2.2 record
in the notices of the npm package prettier 3.9.9 contains no licence text and
names no copyright holder. Copyright notice of yaml 2.9.0 from the same
notices:
Copyright Eemeli Aro <eemeli@gmail.com>

Import sorting ports in bun fmt (Apache-2.0)
Import sorting in bun fmt has ports of @trivago/prettier-plugin-sort-imports
and @ianvs/prettier-plugin-sort-imports, and of organizeImports.ts in
TypeScript. Full terms: licenses/Apache-2.0.txt. Bun records no ported
revisions. The licence files in the notice snapshots at
trivago/prettier-plugin-sort-imports@d9c690fdbfe46334ec2bfb86a75ebde43c6a0fc6
and ianvs/prettier-plugin-sort-imports@26bc50bd2f9846898fa3f8f4bac82cc1f55d7480
name no copyright holder, and those revisions contain no NOTICE file. The
TypeScript 6.0.3 licence in the notices of the npm package prettier 3.9.9
names no copyright holder; the npm package typescript 6.0.3 contains no NOTICE
file, and every third-party notice in its ThirdPartyNoticeText.txt is
reproduced in licenses/typescript-go-NOTICE.txt.

jest-docblock, Rust crate and other ports in bun fmt (MIT)
bun fmt has ports of jest-docblock and the crates sort-package-json and
oxc-toml (a fork of taplo), and of parts of @babel/generator, micromark and
editorconfig-without-wasm. Its character width tables are generated from
emoji-regex, get-east-asian-width and narrow-emojis. Full terms:
licenses/MIT.txt. Bun records no ported revisions; the GitHub notices below
are snapshots.
Copyright notices of jest-docblock 30.4.0 from the notices of the npm package
prettier 3.9.9:
Copyright (c) Meta Platforms, Inc. and affiliates.
Copyright Contributors to the Jest project.
Copyright notice of the sort-package-json crate from
oxc-project/sort-package-json@f493a866b42552a61f83295d232ee2c52dcf9d01:
Copyright (c) 2024-present VoidZero Inc. & Contributors
Copyright notices of oxc-toml from
oxc-project/oxc-toml@394611978d6a6a3aecc515a0f0994ac8305a9dba:
Copyright (c) 2025 Boshen (oxc-toml - Formatter-only fork)
Copyright (c) 2020 Ferenc Tamás (Original Taplo project)
Copyright notice of @babel/generator from
babel/babel@44e867b1f3e056af75fe808d10d79ad5cf8683f0:
Copyright (c) 2014-present Sebastian McKenzie and other contributors
Copyright notices of micromark 4.0.2, editorconfig-without-wasm 0.0.7,
emoji-regex 10.6.0, get-east-asian-width 1.6.0 and narrow-emojis 0.0.3 from
the notices of the npm package prettier 3.9.9, in that order:
Copyright (c) Titus Wormer <tituswormer@gmail.com>
Copyright © 2012 EditorConfig Team
Copyright Mathias Bynens <https://mathiasbynens.be/>
Copyright (c) Sindre Sorhus <sindresorhus@gmail.com> (https://sindresorhus.com)
Copyright (c) fisker Cheung <lionkay@gmail.com> (https://www.fiskercheung.com/)

prettier-plugin-tailwindcss port in bun fmt (MIT)
Tailwind class sorting in bun fmt is a port of parts of
prettier-plugin-tailwindcss. Full terms: licenses/MIT.txt. Bun records no
ported revision. Copyright notice from a notice snapshot at
tailwindlabs/prettier-plugin-tailwindcss@5b27f947f5d3e6de8702dc40d4054e02fbf4cdd8:
Copyright (c) Tailwind Labs Inc.

prettier-plugin-svelte and Svelte parser ports in bun fmt (MIT)
Svelte formatting in bun fmt is a port of prettier-plugin-svelte and of the
template parser of Svelte. Full terms: licenses/MIT.txt. Bun records no
ported revisions. Copyright notices from notice snapshots in the npm packages
prettier-plugin-svelte 4.1.1 and svelte 5.57.0:
Copyright (c) 2019 [Contributors](https://github.com/sveltejs/prettier-plugin-svelte/graphs/contributors)
Copyright (c) 2016-2025 [Svelte Contributors](https://github.com/sveltejs/svelte/graphs/contributors)

npm sort-package-json and git-hooks-list ports in bun fmt (MIT)
With prettier-plugin-packagejson in a Prettier config, bun fmt sorts
package.json with a port of the npm package sort-package-json and the list in
git-hooks-list. Full terms: licenses/MIT.txt. Copyright notices from the npm
packages sort-package-json 3.7.1 and git-hooks-list 4.2.1:
Copyright (c) 2015 Keith Cirkel
Copyright (c) fisker Cheung <lionkay@gmail.com> (https://www.fiskercheung.com/)

@yarnpkg/extensions package extension table (BSD-2-Clause)
The Yarn Berry lockfile migration applies the packageExtensions table that
Yarn ships as @yarnpkg/extensions. Upstream's LICENSE inventory does not list
it; Bun credits it in src/install/yarn_berry/builtin_extensions.rs, line 1.
Full terms: licenses/BSD-2-Clause.txt. Bun records no ported version, so the
notice below is a snapshot. The npm package @yarnpkg/extensions 2.0.7 contains
no licence file; its registry metadata names yarnpkg/berry commit
923f69827c77fe5cf4f6c28c0cab3c02a256abf0 as its source. LICENSE.md at that
commit has SHA-256
238d933f5c226cc197bd1dae2ad0c468e157b4cba8ed844f81549ba6db777dc4 and
records:
Copyright (c) 2016-present, Yarn Contributors.
All rights reserved.

ws port in the built-in ws module (MIT)
Bun's built-in ws module ports lib/websocket.js, websocket-server.js,
event-target.js, stream.js, extension.js and subprotocol.js from ws 8.22.0.
Upstream's LICENSE inventory does not list it; Bun credits it in
src/js/thirdparty/ws.ts, lines 3-4. Full terms: licenses/MIT.txt. The npm
package ws 8.22.0 (archive integrity
sha512-Ydggc987+RO0AnWtZ/7Wq9FtNvcrL1b/RO0ud9mWjUPgDrsAAwQSF51sm2hm1XofbU/4jkpGEsLFsZZxU+1DOg==)
contains a LICENSE file with SHA-256
2b29dcfe0d6471f7e8c92c5fb38c9f93edee10330937055440192f1832b1ecef that
records:
Copyright (c) 2011 Einar Otto Stangvik <einaros@gmail.com>
Copyright (c) 2013 Arnout Kazemier and contributors
Copyright (c) 2016 Luigi Pinca and contributors

regex-syntax parser port in bun lint, under its MIT alternative
bun lint reports the errors of Rust's regex crate for patterns in oxlint rule
options with a port of the regex-syntax 0.8 parser. Upstream's LICENSE
inventory does not list it; Bun credits it in
src/lint/linter/config/rust_regex.rs, line 4. regex-syntax is dual-licensed
under MIT or Apache-2.0; the MIT alternative is selected. Full terms:
licenses/MIT.txt. The port has no Unicode tables. Bun's Cargo.lock at
38afee6c84fcf48c0edb2466aa4b27d287a59c30 resolves regex-syntax 0.8.10, whose
crates.io archive has SHA-256
dc897dd8d9e8bd1ed8cdad82b5966c3e0ecae09fb1907d58efaa013543185d0a. Its
LICENSE-MIT has SHA-256
6485b8ed310d3f0340bf1ad1f47645069ce4069dcc6bb46c7d5c6faf41de1fdb and records:
Copyright (c) 2014 The Rust Project Developers

fast-glob validate port (MIT)
Bun's glob pattern code ports validate from the fast-glob crate 1.1.1, which
oxlint and oxfmt use to reject a pattern. Upstream's LICENSE inventory does
not list it; Bun credits it in src/glob/pattern.rs, line 529. Full terms:
licenses/MIT.txt. The crates.io archive of fast-glob 1.1.1, with SHA-256
6d3f5d15b86ff37d2d23719f90657a53d5399abe0736dacb9e5fbe549314d349, contains
no licence file; its Cargo.toml declares MIT and its .cargo_vcs_info.json
names oxc-project/fast-glob commit 3b6c31c39a676257fd1d95c338025b64f3f0395a.
LICENSE at that commit has SHA-256
7fb47d7306f9a3ba25b44e7b9a94a300548a46709ed27753e28deac8e868b1cd and
records:
Copyright (c) 2025-present VoidZero Inc. & Contributors
Copyright (c) 2024 shulaoda
Copyright (c) 2023 Devon Govett

@eslint/json rule ports in bun lint (Apache-2.0)
bun lint has the json/json, json/jsonc and json/json5 languages and ports of
the rules of @eslint/json 2.1.1. Upstream's LICENSE inventory does not list
it; Bun credits it in src/lint/json/lib.rs, lines 1-3, as "Copyright
Nicholas C. Zakas, Apache License 2.0", and names the version in
src/lint/rule.rs, line 189. Full terms: licenses/Apache-2.0.txt. The npm
package @eslint/json 2.1.1 (archive integrity
sha512-ffVzPZALaJzxuo46ggBtJ9c8YBWKLMh/R35aFBHk/dRobmFNortJlHJfBWbHGuydoFeVZbvPy0PLX2wvCI9T9w==)
contains a LICENSE file with SHA-256
c71d239df91726fc519c6eb72d318ec65820627232b2f796219e87dcf35d0ab4, the same
bytes as test/cli/lint/conformance/licenses/@eslint-json.txt in the retained
Bun tree. That file is the Apache License 2.0 and names no copyright holder.
Neither the package nor eslint/json at
412ad094b434a1795a1eef991915811b5ee8c6a6, the commit the registry records for
2.1.1, contains a NOTICE file.

@eslint/markdown rule ports in bun lint (MIT)
bun lint has the markdown/commonmark and markdown/gfm languages and ports of
the rules of @eslint/markdown 8.0.3. Upstream's LICENSE inventory does not
list it; Bun credits it in src/lint/markdown/lib.rs, lines 1-3, and names the
version in src/lint/rule.rs, line 191. Full terms: licenses/MIT.txt. The npm
package @eslint/markdown 8.0.3 (archive integrity
sha512-rBTSSShrq7e4O+PWfeE4azH4/CWPNrC+VGxBXiW00o3vYVJnznsZiDayj3KC9JztIMVRZxZHn2nrDIUau/4j7A==)
contains a LICENSE file with SHA-256
e203beec1e9160d048b328e016764c26899892d62756df6f38d417342757089d, the same
bytes as test/cli/lint/conformance/licenses/@eslint-markdown.txt in the
retained Bun tree, that records:
Copyright OpenJS Foundation and other contributors, https://openjsf.org

github-slugger port in bun lint (ISC)
The markdown rules of bun lint compute heading ids with a port of
github-slugger 2.0.0. Upstream's LICENSE inventory does not list it; Bun
credits it in src/lint/markdown/slugger.rs, line 1. Full terms:
licenses/ISC.txt. The npm package github-slugger 2.0.0 (archive integrity
sha512-IaOQ9puYtjrkq7Y0Ygl9KDZnrf/aiUJYUpVf89y8kyaxbRG7Y1SrX/jaumrv81vc61+kiMempujsM3Yw7w5qcw==)
contains a LICENSE file with SHA-256
542aefa99456832996da0cc63b14d8b89f04a30ba403e241dbe3e5aaf49fa372 that
records:
Copyright (c) 2015, Dan Flettre <fletd01@yahoo.com>

eslint-scope classes in the bun lint plugin worker (BSD-2-Clause)
The worker that runs JavaScript lint plugins reproduces the classes of
eslint-scope with their public methods. Upstream's LICENSE inventory does not
list it; Bun names it in src/lint/js_plugin/worker/scope.js, lines 3-5, and
release builds embed that script (src/lint/js_plugin/schema.rs). The classes
of @typescript-eslint/scope-manager in the same script are covered by the
typescript-eslint section. Full terms: licenses/BSD-2-Clause.txt. Bun records
no eslint-scope version, so the notice below is a snapshot: eslint-scope
9.1.2, the newest release in the ^9.1.2 range that eslint 10.12.0, the ESLint
version Bun's globals tables name, depends on. Its npm archive (integrity
sha512-xS90H51cKw0jltxmvmHy2Iai1LIqrfbw57b79w/J7MfvDfkIkFZ+kj6zC3BjtUwh150HsSSdxXZcsuv72miDFQ==)
contains a LICENSE file with SHA-256
d3a724e2ed749f172ff70b62a1d0631b7d4b0ea273782365a3464d4e2d6b6dbd that
records:
Copyright JS Foundation and other contributors, https://js.foundation
Copyright (C) 2012-2013 Yusuke Suzuki (twitter: @Constellation) and other contributors.

@babel/code-frame port in bun lint (MIT)
bun lint prints code frames with a port of codeFrameColumns from
@babel/code-frame 7. Upstream's LICENSE inventory does not list it; Bun
credits it in src/lint/utils/code_frame.rs, line 1, and in
src/lint/react_compiler/eslint.rs, line 5. Full terms: licenses/MIT.txt. Bun
names no minor version, so the notice below is a snapshot of
@babel/code-frame 7.29.7, the newest 7.x release. Its npm archive (integrity
sha512-Aup7aUOfpbAUg2ROOJN6Iw5f9DMBlzu0mIkm/malLQFN/YQgO48wCj0Kxa3sEHJvPVFg7siR+qRInwXd2qhQKw==)
contains a LICENSE file with SHA-256
117da2af0d4ce0fe1c8e19b5cff9dcd806adf973d328d27b11d4448c4ff24f76 that
records:
Copyright (c) 2014-present Sebastian McKenzie and other contributors

javascript-globals and globals tables in bun lint (MIT)
The tables of global variables in bun lint are generated in part from the
javascript-globals crate 1.6.0 and from the npm package globals 13.24.0, as
used by eslint 8.57.1. Upstream's LICENSE inventory does not list them; Bun
names them in src/lint/linter/globals/tables.rs, lines 1-3. The other
sources named there (eslint 10.12.0, globals 16.5.0 and
@typescript-eslint/scope-manager 8.71.1) are covered by the ESLint, globals
and typescript-eslint sections. Full terms: licenses/MIT.txt. The crates.io
archive of javascript-globals 1.6.0, with SHA-256
72b7a751979390f3210d9d08e8096b15135b93f8bb4040a02f07f4bfe4360b4c, contains
no licence file; its Cargo.toml declares MIT and its .cargo_vcs_info.json
names oxc-project/javascript-globals commit
3ffe35147733e66564dda48e88e103ddea0db458. LICENSE at that commit and the
licence file of the npm package globals 13.24.0 (archive integrity
sha512-AhO5QUcj8llrbG09iWhPU2B204J1xnPeL8kQmVorSsy+Sjj1sk8gIyh6cUocGmH4L0UuhAJy+hJMRA4mgA4mFQ==)
both have SHA-256
5c932d88256b4ab958f64a856fa48e8bd1f55bc1d96b8149c65689e0c61789d3 and record:
Copyright (c) Sindre Sorhus <sindresorhus@gmail.com> (https://sindresorhus.com)

eslint-module-utils ports in bun lint (MIT)
The import rules of bun lint port unambiguous, pkgUp, readPkgUp, resolve and
moduleVisitor from eslint-module-utils, the helper package of
eslint-plugin-import. Upstream's LICENSE inventory does not list it; Bun
credits it in src/lint/plugins/import_export_record.rs, line 3,
src/lint/plugins/import_package_path.rs, line 1,
src/lint/plugins/import_resolve.rs, line 1, and
src/lint/plugins/module_visitor.rs, line 1. Full terms: licenses/MIT.txt. Bun
records no eslint-module-utils version, so the notice below is a snapshot:
eslint-module-utils 2.14.0, the newest release in the ^2.12.1 range that
eslint-plugin-import 2.32.0, the version Bun names in
src/lint/plugins/import_export_map.rs, depends on. Its npm archive (integrity
sha512-W2WCRZ9Dqntd+2u8jJcVMV2PKulc6RdLgUUoh/yQr3uB6lo/ZOeGx11sv60/8S4QFFKNslAlWhr9u0Ef7ZW6Ig==)
contains a LICENSE file with SHA-256
7829efc4266fad5f57f7fc489429a3b35d0c62183c0bd617ef6591f64c980c92 that
records:
Copyright (c) 2015 Ben Mosher

Prettier dependency tables in bun fmt (MIT)
bun fmt uses tables that Prettier takes from its dependencies: HTML element
data from html-ua-styles, @prettier/html-tags, html-element-attributes and
@prettier/html-event-attributes, and identifier data from
is-es5-identifier-name. Upstream's LICENSE inventory does not list them; Bun
names them in src/format/html/data.rs, lines 1-2, and
src/format/js/utils/es5_identifier_tables.rs, lines 1-3. Bun follows Prettier
3.9.9, whose package.json pins html-ua-styles 0.5.0, @prettier/html-tags
2.2.0, html-element-attributes 3.5.0, @prettier/html-event-attributes 0.0.2
and is-es5-identifier-name 1.0.1. Full terms: licenses/MIT.txt. Each npm
archive matched the registry's sha512 integrity. The licence file of
html-element-attributes 3.5.0 has SHA-256
dd1081884a92952802f4803110a6bb543acea9a814c786d58605b4c1219b5ebb; those of
the other four packages are identical, with SHA-256
a4062b09c0c9f2c837997f22ebd4840bffe712ab262f5dfa231226131f41ef3f. They
record, in that order:
Copyright (c) Titus Wormer <tituswormer@gmail.com>
Copyright (c) fisker Cheung <lionkay@gmail.com> (https://www.fiskercheung.com/)

Third-party Rust crates (multiple permissive licences and MPL-2.0)
RUST-CRATE-NOTICES.txt records every third-party Rust crate linked into the
executable: the normal, non-proc-macro dependencies of bun_runtime with its
default features on x86_64 Linux, resolved from Bun's Cargo.lock, each with
its archive checksum, declared licence, the terms it is used under, and its
verbatim licence files. The approved 1.4.0 bundle did not attribute these
crates. Three of them, cssparser 0.36.0, selectors 0.33.0 and dtoa-short
0.3.5, which lol-html uses, are MPL-2.0; their records say where their exact
Source Code Form is. Full MPL-2.0 terms: licenses/MPL-2.0.txt, the verbatim
LICENSE of the cssparser 0.36.0 crate (SHA-256
fab3dd6bdab226f1c08630b1dd917e11fcb4ec5e1e020e2c16f83a0a13863e85).

llhttp (MIT)
Bun compiles llhttp into the executable from
src/jsc/bindings/node/http/llhttp/. The README.md there says the sources are
llhttp 9.4.2, byte for byte as Node.js vendors them in deps/llhttp at nodejs/node
110840f2c74, plus one patch. The approved 1.4.0 bundle, which had llhttp
9.3.0, did not attribute it. Full terms: licenses/MIT.txt. In deps/llhttp of
nodejs/node at 110840f2c74d774d885d5823e454f26798ebcad0, LICENSE has SHA-256
628168d68bb5a8a17e0bbefb3bd74e326e1edc20583d76f52f457c82c921867d and
LICENSE-MIT has SHA-256
ebca854e0134cd256d673627c20499f42577eb74bacf08b9f25b626a73c91277. They
record, in that order:
Copyright © 2018 Fedor Indutny
Copyright Fedor Indutny, 2018.

Mozilla NSS root certificate data (MPL-2.0)
Bun embeds the root certificates of Mozilla NSS certdata.txt, filtered to
CAs trusted for TLS server authentication: packages/bun-usockets/root_certs.der,
which src/runtime/socket/bundled_root_certs.rs embeds, is generated from
packages/bun-usockets/certdata.txt, which generate-root-certs.mjs takes from
the NSS repository. In the approved 1.4.0 bundle the same data was
packages/bun-usockets/src/crypto/root_certs.h and was not attributed. Full
terms: licenses/MPL-2.0.txt. Source Code Form: certdata.txt (SHA-256
3ec2b4d240dc12c747eaf450061db84af757c483bbda302f9e29ceb5d70be510) is part of
the Bun source that SOURCE-MANIFEST.txt identifies, and upstream it is in the
NSS repository at hg.mozilla.org/projects/nss; Bun does not record the NSS
release. Its notice, lines 2-4 of that file:
# This Source Code Form is subject to the terms of the Mozilla Public
# License, v. 2.0. If a copy of the MPL was not distributed with this
# file, You can obtain one at http://mozilla.org/MPL/2.0/.

Lightning CSS and Servo derived code in Bun's CSS parser (MPL-2.0)
Bun's CSS parser in src/css is derived from Lightning CSS and from Servo, as
src/css/README.md says, thanking Devon Govett and contributors. The approved
1.4.0 bundle, which had the same code, did not attribute it. Full terms:
licenses/MPL-2.0.txt. Source Code Form: the derived code is part of the Bun
source that SOURCE-MANIFEST.txt identifies. Bun records no ported revision.
The licence files in the snapshots parcel-bundler/lightningcss at
cbeaf83b76b2113b3c4024931116cdca027f8385 (SHA-256
5eba353fe5076ac3432177f8ab1cf75e3afcd0584251e37c3bfead5f447d040e) and
servo/servo at 8f064d183f3b4572c99d57db1e020cdeb0f41ab6 (SHA-256
1af2d2b02d9c86030d29ed77117ca7a1b0e4b6ff35bcf8eeb124867d0f5cb59e) are the
MPL-2.0 text; each names no copyright holder.

md4c-derived Markdown parser (MIT)
Bun's Markdown parser in src/md follows md4c's implementation and cites it
throughout, for example src/md/parser.rs, line 303. The approved 1.4.0
bundle, which had the same code, did not attribute it. Full terms:
licenses/MIT.txt. Bun records no md4c version, so the notice below is a
snapshot: LICENSE.md of mity/md4c at its release v0.6.0,
7fc1815a5eeba2af7d6120a76202bf59f3b6e6e4 (SHA-256
e547c9a66c120b19f9838a1f7c2f51137f5c71ba27b70c3611b673f2cdb4e02e), records:
Copyright © 2016-2026 Martin Mitáš

React Compiler in src/react_compiler (MIT)
Bun's React Compiler integration in src/react_compiler ports the React
Compiler's Rust crates from facebook/react; src/react_compiler/hir/mod.rs,
line 32, calls that code "ported verbatim from facebook/react upstream", and
files such as src/react_compiler/hir/assert_terminal_blocks_exist.rs keep the
React notice in their first lines. The approved 1.4.0 bundle, which had the
same code, did not attribute it. Full terms: licenses/MIT.txt. Bun records no
ported revision, so the notice below is a snapshot: LICENSE of facebook/react
at fd51cb10dd154aee73e4e7948005c02968651c3d (SHA-256
da6d3703ed11cbe42bd212c725957c98da23cbff1998c05fa4b3d976d1a58e93) records:
Copyright (c) Meta Platforms, Inc. and affiliates.

Preact in the development error overlay (MIT)
The error overlay of Bun's development server, packages/bun-error, is bundled
with Preact by scripts/build/codegen.ts and embedded through
src/runtime/server/DevErrorPage.rs. The approved 1.4.0 bundle, which had the
same overlay, did not attribute it. Full terms: licenses/MIT.txt.
packages/bun-error/bun.lock pins preact 10.27.2 with integrity
sha512-5SYSgFKSyhCbk6SrXyMpqjb5+MQBgfvEKE/OC+PujcY34sOpqtr+0AZQtPYx5IA6VxynQ7rUPCtKzyovpj9Bpg==;
the npm archive matched it and contains a LICENSE file with SHA-256
1fe6958409c8c257a70c587a18b6f7f412b179b456630790d30b2ec9a8e4b7d4 that
records:
Copyright (c) 2015-present Jason Miller

Node.js-derived code (MIT)
Bun's Node.js compatibility layer ports code from Node.js: JavaScript in
src/js, where files such as src/js/node/child_process.ts keep Node's Joyent
notice, and Rust in src/runtime/node and src/node_path, which
src/node_path/lib.rs describes as Node's path.posix and path.win32
algorithms. Where Bun ports a specific change it names the Node.js revision,
for example nodejs/node 52a8ace880 in src/js/node/_http_client.ts, line 234.
The approved 1.4.0 bundle, which had such code, did not attribute it. Full
terms: licenses/MIT.txt. LICENSE of nodejs/node at
52a8ace880dbd92a96f2e15255a63e383dc28ca8 (SHA-256
5888dbb9a1d2b18f2c3e6c5f6af1b39de658372b402a0577b002777f14c62ace) licenses
Node.js under these notices:
Copyright Node.js contributors. All rights reserved.
Copyright Joyent, Inc. and other Node contributors. All rights reserved.

ci-info port (MIT)
Bun detects CI environments with a port of ci-info 4.0.0, credited in
src/bun_core/ci_info.rs, line 1. In the approved 1.4.0 bundle the same port
was src/runtime/cli/ci_info.rs and was not attributed. Full terms:
licenses/MIT.txt. The npm package ci-info 4.0.0 (archive integrity
sha512-TdHqgGf9odd8SXNuxtUBVx8Nv+qZOejE6qyqiy5NtbYYQOeFa6zmHkxlPzmaLxWWHsU6nJmB7AETdVPi+2NBUg==)
contains a LICENSE file with SHA-256
f58943cb354fb2707fea2f7b26b04e6014ddb56835cdfd414c9d2c6c59165b64 that
records:
Copyright (c) 2016 Thomas Watson Steen
