Attributions — FormReady

This page lists every third-party library, font and asset FormReady uses, with its version, licence and source.

Every third-party component FormReady ships, with its exact version, licence and source. Firm reuse rules: MIT / Apache-2.0 / BSD / ISC only (never GPL/AGPL); copied code is reviewed by Cipher before it ships and tested by Nova like hand-written code. Anything not listed here is original FormReady work, written in-house.

Review status: pending Lex review (required before staging sign-off) and Cipher re-check of the pinned artefacts below.

JavaScript libraries

pdf-lib — 1.17.1 — MIT

• What it is: PDF creation/manipulation library (global PDFLib).
• Used by: Passport Print Sheet PDF download; Photo to PDF, PDF Merge and PDF Compress pages; OCR (searchable-PDF writer), PDF Editor (save), Document Pack (document output + checklist PDF) and PDF Split (page extraction).
• Licence: MIT License. Copyright (c) 2019 Andrew Dillon. Licence text: https://github.com/Hopding/pdf-lib/blob/master/LICENSE.md
• Upstream: https://github.com/Hopding/pdf-lib
• Served from (pinned, with SRI): https://cdnjs.cloudflare.com/ajax/libs/pdf-lib/1.17.1/pdf-lib.min.js integrity="sha512-z8IYLHO8bTgFqj+yrPyIJnzBDf7DDhWwiEsk4sY+Oe6J2M+WQequeGS7qioI5vT6rXgVRb4K1UVQC5ER7MKzKQ==" (tag copied verbatim from Cipher's security review, R-01/R-02, docs/security-review.md.)

@pdf-lib/fontkit — 1.1.1 — MIT

• What it is: the official fontkit companion for pdf-lib (global fontkit); registers custom font embedding with pdf-lib.
• Used by: PDF Editor only — edited text is written into the saved PDF in a real font matched to the document's own (see the editor fonts below), embedded as a subset.
• Licence: MIT License. Copyright (c) 2019 Andrew Dillon. Licence text: https://github.com/Hopding/fontkit/blob/master/LICENSE.md
• Upstream: https://github.com/Hopding/fontkit (npm: @pdf-lib/fontkit)
• Served from: vendored unmodified at assets/js/vendor/fontkit.umd.min.js (same-origin), formerly loaded only by the retired classic PDF Editor page. Pinned artifact SHA-512: nN5LMjOUxjpCutlx3vCE453XaDaDYhjwM+0uYxHMo7wVW9SLhLi6kspqdcuWGrLYHkENUwtkiNeSlVflBQAQGQ==

@embedpdf/pdfium — 2.15.1 — MIT (wrapper) / BSD-style (PDFium core) — NOT USED BY THE LIVE EDITOR

• What it is: a WebAssembly build of PDFium (Google's PDF engine, the one inside Chrome) with a thin JavaScript wrapper; the retired PDF Editor v4 engine used it for true object-level text editing and deletion.
• Used by: nothing live. PDFium was vendored for the retired PDF Editor v4 engine only. The live PDF Editor (Beta) does not use it — its own footer states that true text removal needs the PDFium engine, which is not in this build.
• Licence: MIT License (wrapper). Copyright © 2024 CloudPDF, Ji Chang. PDFium core: BSD-style licence. Copyright 2014 PDFium Authors. Both licence texts are vendored beside the code.
• Upstream: https://github.com/embedpdf/embed-pdf-viewer (npm: @embedpdf/pdfium); PDFium: https://pdfium.googlesource.com/pdfium/
• Served from: vendored unmodified at assets/js/vendor/pdfium/ (same-origin): index.browser.js, pdfium.wasm, LICENSE, LICENSE.pdfium. Pinned version 2.15.1. The files remain in the repository but are not loaded by any live page.

pdf.js — 3.11.174 — Apache-2.0

• What it is: Mozilla's PDF renderer (global pdfjsLib).
• Used by: PDF Compress (page rendering); OCR (page rendering + existing text-layer read), PDF Editor (page rendering), PDF Split and PDF to Image (page rendering, thumbnails), Document Validator (page sizes). PDF Merge does not load pdf.js — it reads page counts with pdf-lib. (Original line corrected per Lex review L-A1, 2026-10-22; extended for the expansion tools the same day.)
• Licence: Apache License, Version 2.0. Copyright 2023 Mozilla Foundation. Licence text ships inside the worker file header and at https://github.com/mozilla/pdf.js/blob/master/LICENSE
• Upstream: https://github.com/mozilla/pdf.js
• Main script, served from (pinned, with SRI): https://cdnjs.cloudflare.com/ajax/libs/pdf.js/3.11.174/pdf.min.js integrity="sha512-q+4liFwdPC/bNdhUpZx6aXDx/h77yEQtn4I1slHydcbZK34nLaR3cAeYSJshoxIOq3mjEf7xJE8YWIUHMn+oCQ=="
• Worker: pdf.worker.min.js 3.11.174 is vendored unmodified at assets/js/vendor/pdf.worker.min.js (same-origin) because SRI cannot cover a Worker loaded from a CDN (Cipher R-02). Source of the vendored copy: https://cdnjs.cloudflare.com/ajax/libs/pdf.js/3.11.174/pdf.worker.min.js

Tesseract.js — 5.1.1 — Apache-2.0 (SELF-HOSTED)

• What it is: OCR engine — a WebAssembly port of the Tesseract OCR engine (tesseract.js + tesseract.js-core 5.1.1) with English and Hindi language data from the tessdata project.
• Used by: OCR — PDF to Text page, the Document Match Checker, and Photo to PDF's OCR-to-Word mode.
• Licence: Apache License, Version 2.0 (tesseract.js, tesseract.js-core and tessdata). Licence texts ship inside the vendored directory.
• Upstream: https://github.com/naptha/tesseract.js · https://github.com/tesseract-ocr/tessdata
• Served from: our own origin only — assets/vendor/tesseract-5.1.1/ (no CDN, no third-party request; SHA-512 manifest in assets/vendor/tesseract-5.1.1/VENDOR-MANIFEST.txt, verified against the npm tarballs; adopted per Cipher's security review).

Fabric.js — 5.3.1 — MIT — NOT SHIPPED

• What it is: Canvas object-model library (global fabric) for an annotation layer (text, images, drawing, highlighting, shapes, whiteout, signatures).
• Used by: nothing live. Fabric.js was used by the retired PDF Editor v4 engine only. The live PDF Editor (Beta) does not use it, and no Fabric.js file ships with FormReady. The pinned cdnjs URL and SRI hash below are retained only as the record of the retired v4 pin.
• Licence: MIT License. Copyright (c) 2008–2015 Printio (Juriy Zaytsev, Maxim Chernyak). Licence text: https://github.com/fabricjs/fabric.js/blob/master/LICENSE
• Upstream: https://github.com/fabricjs/fabric.js
• Retired v4 pin (not loaded by any page): https://cdnjs.cloudflare.com/ajax/libs/fabric.js/5.3.1/fabric.min.js integrity="sha512-CeIsOAsgJnmevfCi2C7Zsyy6bQKi43utIjdA87Q0ZY84oDqnI0uwfM9+bKiIkI75lUeI00WG/+uJzOmuHlesMA==" (the file internally self-reports 5.3.0 — a known upstream quirk; the pinned bytes are cdnjs's 5.3.1 build.)

JSZip — 3.10.1 — MIT (elected)

• What it is: ZIP file creation in the browser (global JSZip).
• Used by: Document Pack (pack download + share), PDF Split (one-PDF-per-page mode) and PDF to Image (download-all).
• Licence: upstream is dual-licensed MIT OR GPLv3; FormReady elects the MIT option. Copyright (c) 2009–2016 Stuart Knightley, David Duponchel, Franz Buchinger, António Afonso. Licence text: https://github.com/Stuk/jszip/blob/main/LICENSE.markdown
• Upstream: https://github.com/Stuk/jszip
• Served from (pinned, with SRI): https://cdnjs.cloudflare.com/ajax/libs/jszip/3.10.1/jszip.min.js integrity="sha512-XMVd28F1oH/O71fzwBnV7HucLxVwtxf26XV8P4wPk26EDxuGZ91N8bsOttmnomcCD3CS5ZMRL50H0GgOHvegtg=="

qrcode-generator — 1.4.4 — MIT

• What it is: QR Code generation library (global qrcode).
• Used by: QR Code Generator page only.
• Licence: MIT License. Copyright (c) 2009 Kazuhiko Arase. Licence text ships in the file header.
• Upstream: https://github.com/kazuhikoarase/qrcode-generator
• Served from (pinned, with SRI): https://cdnjs.cloudflare.com/ajax/libs/qrcode-generator/1.4.4/qrcode.min.js integrity="sha512-ZDSPMa/JM1D+7kdg2x3BsruQ6T/JpJo3jWDWkCZsP+5yVyp1KfESqLI+7RqB5k24F7p2cV7i2YHh/890y6P6Sw=="

Cropper.js — NOT ADOPTED

Cropper.js (MIT, https://github.com/fengyuanchen/cropperjs) was evaluated for the Exam Resizer crop UI under the firm's open-source reuse permission. It was not adopted: the crop UI shipped in Phase 1 is hand-built in-house (FRUI.createCropStage in assets/js/ui.js — fixed-aspect crop box, pointer-drag repositioning, zoom) and already meets the spec. No Cropper.js code, CSS or assets ship with FormReady. Recorded here so the evaluation is auditable.

FFmpeg.wasm (@ffmpeg/ffmpeg + @ffmpeg/core) — NOT ADOPTED

Evaluated for the Video to Audio tool (licence gate: docs/licence-gate-additions.md, 22 Oct 2026). The JS wrapper is MIT, but the distributed Wasm core is declared GPL-2.0-or-later (built with GPL components including x264/x265 and the non-free fdk-aac). FormReady ships MIT/Apache/BSD/OFL code only, so FFmpeg.wasm is not adopted: no FFmpeg code, Wasm or assets ship with FormReady. Video to Audio uses the browser's own Web Audio / WebCodecs platform instead.

lamejs (and forks) — NOT ADOPTED

Evaluated for MP3 encoding in the Video to Audio tool (same gate). lamejs is a JavaScript rewrite of libmp3lame; its own LICENSE file imposes LGPL terms, and the maintained fork @breezystack/lamejs declares LGPL-3.0. LGPL fails the house rule, so lamejs is not adopted in any form: no LAME-derived code ships with FormReady, and the tool does not promise MP3 output — it labels the format the user's browser actually produces (WAV, or a browser-encoded format where supported).

Fonts (self-hosted, no font CDN at runtime)

Served from assets/fonts/ on our own origin. Both are licensed under the SIL Open Font License, Version 1.1 (https://scripts.sil.org/OFL).

Fredoka — variable font, weights 500/600 used

• Files: assets/fonts/fredoka-500.woff2, assets/fonts/fredoka-600.woff2
• Licence: SIL OFL 1.1. Copyright 2021 The Fredoka Project Authors. Full licence text ships with the site at assets/fonts/OFL.txt.
• Source: Google Fonts — https://fonts.google.com/specimen/Fredoka (upstream: https://github.com/googlefonts/fredoka)

Nunito — weights 400/600/700/800 used

• Files: assets/fonts/nunito-400.woff2, assets/fonts/nunito-600.woff2, assets/fonts/nunito-700.woff2, assets/fonts/nunito-800.woff2
• Licence: SIL OFL 1.1. Copyright 2014 The Nunito Project Authors. Full licence text ships with the site at assets/fonts/OFL.txt.
• Source: Google Fonts — https://fonts.google.com/specimen/Nunito (upstream: https://github.com/googlefonts/nunito)

PDF Editor matched fonts — assets/fonts/v3/ (60 files, ~974 KB total)

Used ONLY by the PDF Editor: when edited text must be re-typeset, it is written in the closest legal match to the document's own font — the genuine open font when one exists (tier 1), a metric-compatible clone for the common proprietary fonts (tier 2), or a family fallback (tier 3). Files are subset WOFF builds (Latin basic + Latin-1 + punctuation + ₹/€/™ + fi/fl ligatures), produced by scripts/build-font-assets.py from the OFL sources below and loaded lazily — only the family + style an edit actually needs (~13–25 KB). All SIL Open Font License 1.1; the licence text ships with the fonts at assets/fonts/v3/OFL.txt.

• Plus Jakarta Sans (tier 1 — genuine; app-generated PDFs) — Copyright 2020 The Plus Jakarta Sans Project Authors (github.com/tokotype/PlusJakartaSans)
• Inter (tier 1) — Copyright 2016 The Inter Project Authors (github.com/rsms/inter)
• Roboto (tier 1) — Copyright 2011 The Roboto Project Authors (github.com/googlefonts/roboto-classic)
• Open Sans (tier 1; also the sans family fallback) — Copyright 2020 The Open Sans Project Authors (github.com/googlefonts/opensans)
• Poppins (tier 1) — Copyright 2020 The Poppins Project Authors (github.com/itfoundry/Poppins)
• Montserrat (tier 1) — Copyright 2011 The Montserrat Project Authors (github.com/JulietaUla/Montserrat)
• Lato (tier 1) — Copyright (c) 2011-2015 by tyPoland Lukasz Dziedzic, with Reserved Font Name "Lato" (via google/fonts, ofl/lato)
• Nunito (tier 1) — Copyright 2014 The Nunito Project Authors (github.com/googlefonts/nunito)
• Work Sans (tier 1) — Copyright 2019 The Work Sans Project Authors (github.com/weiweihuanghuang/Work-Sans)
• Carlito (tier 2 — metric clone of Calibri) — Copyright 2013 The Carlito Project Authors (github.com/googlefonts/carlito)
• Caladea (tier 2 — metric clone of Cambria) — Copyright 2012 The Caladea Project Authors (github.com/huertatipografica/Caladea)
• Gelasio (tier 2 — metric clone of Georgia) — Copyright 2022 The Gelasio Project Authors (github.com/SorkinType/Gelasio)
• Liberation Sans / Serif / Mono (tier 2/3 — metric clones of Arial / Times New Roman / Courier New; Serif and Mono are also the serif and mono family fallbacks) — Digitized data copyright (c) 2010 Google Corporation; Copyright (c) 2012 Red Hat, Inc. Liberation Fonts 2.1.5 (github.com/liberationfonts; TTFs taken from the Debian fonts-liberation 2.1.5 package)

Icons and illustrations

• Icon sprite (assets/img/icons.svg): original line icons drawn in-house for FormReady (24×24 grid, 1.8 stroke, round caps — see the comment header inside the file). No third-party icon set (Lucide, Feather, Heroicons, Material or otherwise) was copied or adapted.
• Logo and hero illustration (assets/img/logo.svg, assets/img/hero.svg, assets/img/empty.svg): original in-house artwork created for FormReady.

Everything else

All HTML, CSS (assets/css/styles.css, components.css, motion.css — claymorphism design system by Rio) and JavaScript (assets/js/, except the vendored pdf.js worker noted above) are original work by the NexaForge team for FormReady. Analytics and advertising on FormReady are provided by Google Analytics and Google AdSense — see the Privacy Policy for what they measure and how to opt out. No other analytics, advertising or tracking libraries are used.