# PixelGuru 3.4.0: third-party license summary

Generated 2026-09-30T21:58:31.837Z by scripts/sbom.mjs from the CycloneDX SBOMs in this folder
(683 unique components: 197 npm, 480 cargo, 6 firmware).

## Flagged (copyleft or unknown)

**Strong copyleft (GPL/AGPL…): 1**

| Ecosystem | Component | Version | License | Class | In |
|---|---|---|---|---|---|
| cargo | cssparser | 0.37.0 | MPL-2.0 | weak-copyleft | cargo-pg-launcher.cdx.json, cargo-tauri-plugin-pg-mobile.cdx.json, cargo-pg-studio.cdx.json |
| cargo | cssparser-macros | 0.7.1 | MPL-2.0 | weak-copyleft | cargo-pg-launcher.cdx.json, cargo-tauri-plugin-pg-mobile.cdx.json, cargo-pg-studio.cdx.json |
| cargo | dtoa-short | 0.3.5 | MPL-2.0 | weak-copyleft | cargo-pg-launcher.cdx.json, cargo-tauri-plugin-pg-mobile.cdx.json, cargo-pg-studio.cdx.json |
| cargo | option-ext | 0.2.0 | MPL-2.0 | weak-copyleft | cargo-pg-launcher.cdx.json, cargo-tauri-plugin-pg-mobile.cdx.json, cargo-pg-studio.cdx.json |
| cargo | rusty_link | 0.4.9 | GPL-2.0-or-later | strong-copyleft | cargo-pg-fwsim.cdx.json, cargo-pg-net.cdx.json, cargo-pg-launcher.cdx.json, cargo-pg-studio-core.cdx.json, cargo-pg-studio.cdx.json |
| cargo | selectors | 0.38.0 | MPL-2.0 | weak-copyleft | cargo-pg-launcher.cdx.json, cargo-tauri-plugin-pg-mobile.cdx.json, cargo-pg-studio.cdx.json |
| cargo | serialport | 4.10.1 | MPL-2.0 | weak-copyleft | cargo-pg-studio-core.cdx.json, cargo-pg-studio.cdx.json |
| cargo | symphonia | 0.6.1 | MPL-2.0 | weak-copyleft | cargo-pg-player.cdx.json, cargo-pg-launcher.cdx.json, cargo-pg-studio-core.cdx.json, cargo-pg-studio.cdx.json |
| cargo | symphonia-bundle-flac | 0.6.1 | MPL-2.0 | weak-copyleft | cargo-pg-player.cdx.json, cargo-pg-launcher.cdx.json, cargo-pg-studio-core.cdx.json, cargo-pg-studio.cdx.json |
| cargo | symphonia-bundle-mp3 | 0.6.1 | MPL-2.0 | weak-copyleft | cargo-pg-player.cdx.json, cargo-pg-launcher.cdx.json, cargo-pg-studio-core.cdx.json, cargo-pg-studio.cdx.json |
| cargo | symphonia-codec-aac | 0.6.1 | MPL-2.0 | weak-copyleft | cargo-pg-player.cdx.json, cargo-pg-launcher.cdx.json, cargo-pg-studio-core.cdx.json, cargo-pg-studio.cdx.json |
| cargo | symphonia-codec-pcm | 0.6.1 | MPL-2.0 | weak-copyleft | cargo-pg-player.cdx.json, cargo-pg-launcher.cdx.json, cargo-pg-studio-core.cdx.json, cargo-pg-studio.cdx.json |
| cargo | symphonia-codec-vorbis | 0.6.1 | MPL-2.0 | weak-copyleft | cargo-pg-player.cdx.json, cargo-pg-launcher.cdx.json, cargo-pg-studio-core.cdx.json, cargo-pg-studio.cdx.json |
| cargo | symphonia-common | 0.6.1 | MPL-2.0 | weak-copyleft | cargo-pg-player.cdx.json, cargo-pg-launcher.cdx.json, cargo-pg-studio-core.cdx.json, cargo-pg-studio.cdx.json |
| cargo | symphonia-core | 0.6.1 | MPL-2.0 | weak-copyleft | cargo-pg-player.cdx.json, cargo-pg-launcher.cdx.json, cargo-pg-studio-core.cdx.json, cargo-pg-studio.cdx.json |
| cargo | symphonia-format-isomp4 | 0.6.1 | MPL-2.0 | weak-copyleft | cargo-pg-player.cdx.json, cargo-pg-launcher.cdx.json, cargo-pg-studio-core.cdx.json, cargo-pg-studio.cdx.json |
| cargo | symphonia-format-ogg | 0.6.1 | MPL-2.0 | weak-copyleft | cargo-pg-player.cdx.json, cargo-pg-launcher.cdx.json, cargo-pg-studio-core.cdx.json, cargo-pg-studio.cdx.json |
| cargo | symphonia-format-riff | 0.6.1 | MPL-2.0 | weak-copyleft | cargo-pg-player.cdx.json, cargo-pg-launcher.cdx.json, cargo-pg-studio-core.cdx.json, cargo-pg-studio.cdx.json |
| cargo | symphonia-metadata | 0.6.1 | MPL-2.0 | weak-copyleft | cargo-pg-player.cdx.json, cargo-pg-launcher.cdx.json, cargo-pg-studio-core.cdx.json, cargo-pg-studio.cdx.json |
| firmware | arduino-esp32 | 3.3.12 | LGPL-2.1-or-later | weak-copyleft | firmware.cdx.json |
| npm | mediabunny | 1.60.0 | MPL-2.0 | weak-copyleft | npm-studio.cdx.json, npm-launcher.cdx.json, npm-pgc.cdx.json |
| npm | webgl-constants | 1.1.1 | UNKNOWN | unknown | npm-studio.cdx.json, npm-launcher.cdx.json, npm-pgc.cdx.json |

Notes:

- Weak copyleft (LGPL/MPL/EPL) components are used unmodified; obligations and the review of each are listed in docs/RELEASE.md "Licenses".
- OpenWiFiSync (GPL) was consulted as a research reference only (docs/research, research-scratch/, git-ignored); no code of it is
  compiled into any artifact, so it is not a dependency and appears in no SBOM.
- `UNKNOWN` means the package metadata carries no SPDX license; each must be checked by hand before publishing.

## Components per license

| License | Components |
|---|---|
| MIT | 253 |
| MIT OR Apache-2.0 | 252 |
| Apache-2.0 OR MIT | 41 |
| UNLICENSED | 25 |
| MPL-2.0 | 19 |
| Unicode-3.0 | 18 |
| Apache-2.0 | 16 |
| Unlicense OR MIT | 12 |
| ISC | 8 |
| BSD-3-Clause | 6 |
| Zlib OR Apache-2.0 OR MIT | 3 |
| Zlib | 2 |
| Apache-2.0 OR ISC OR MIT | 2 |
| MIT OR Zlib OR Apache-2.0 | 2 |
| UNLICENSED (PixelGuru proprietary) | 2 |
| OFL-1.1 | 2 |
| 0BSD OR MIT OR Apache-2.0 | 1 |
| BSD-3-Clause AND MIT | 1 |
| BSD-3-Clause OR MIT | 1 |
| MIT OR Apache-2.0 OR BSD-3-Clause | 1 |
| Apache-2.0 AND MIT | 1 |
| CC0-1.0 OR MIT-0 OR Apache-2.0 | 1 |
| Apache-2.0  OR  MIT | 1 |
| MIT OR BSD-3-Clause | 1 |
| MIT AND BSD-3-Clause | 1 |
| Apache-2.0 OR MIT OR BSL-1.0 OR CC0-1.0 | 1 |
| MIT OR Apache-2.0 OR Zlib | 1 |
| Apache-2.0 AND ISC | 1 |
| GPL-2.0-or-later | 1 |
| Apache-2.0 OR BSL-1.0 | 1 |
| (MIT OR Apache-2.0) AND Unicode-3.0 | 1 |
| BSD-2-Clause OR Apache-2.0 OR MIT | 1 |
| LGPL-2.1-or-later | 1 |
| (MIT AND Zlib) | 1 |
| 0BSD | 1 |
| UNKNOWN | 1 |