VideoScope / GenVideoScope
Copyright 2026 VideoScope contributors

This product includes software developed by the VideoScope contributors and is
licensed under the Apache License, Version 2.0. See LICENSE.

Windows Connector runtime dependency review
-------------------------------------------

The Windows Connector freezes the exact Python 3.12 base plus `web` runtime
closure in `packaging/windows/requirements-runtime.lock`. It includes the
direct packages below and their locked transitives. The bundle carries the
reviewed lock, policy, this notice, the third-party inventory, and each locked
distribution's metadata/license material. Package metadata and upstream
license files remain authoritative:

- Typer — MIT License
- Rich — MIT License
- Pydantic — MIT License
- NumPy — BSD-3-Clause, 0BSD, MIT, Zlib and CC0-1.0 licensed components
- Pillow — MIT-CMU License
- opencv-python-headless — Apache License 2.0
- scenedetect-headless — BSD-3-Clause License
- Jinja2 — BSD-3-Clause License
- platformdirs — MIT License

Development and release dependencies
------------------------------------

- pytest — MIT License
- pytest-cov — MIT License
- Ruff — MIT License
- mypy — MIT License
- build — MIT License
- setuptools — MIT License
- wheel — MIT License
- httpx2 — BSD-3-Clause License
- PyInstaller — GPL-2.0-or-later with the PyInstaller bootloader exception
- Inno Setup — custom redistribution terms; generated installer output is
  distributable subject to the licenses of the packaged application files

Development dependencies are not part of the Windows runtime lock. Their
transitive dependencies retain their respective licenses and require a separate
review if redistributed.

Optional extras
---------------

The `ai`, `asr`, `ocr`, `web`, and `all` extras may install PyTorch, torchvision,
OpenCLIP, PaddleOCR, PaddlePaddle, FastAPI, Uvicorn, python-multipart, and their
transitive dependencies. They are not part of the base installation and no
model weights are bundled.

The optional `asr` extra installs faster-whisper (MIT) and its CTranslate2
runtime (MIT). VideoScope does not bundle Whisper checkpoints. Checkpoint terms
are separate from the Python packages and must be reviewed for the exact model
selected by the user.
Ollama is an external local application; its models are never bundled or pulled
by VideoScope and retain their individual terms.
Downstream users must review the licenses and model-weight terms of the exact
optional components and checkpoints they choose.

The optional DINOv2 provider uses the user-installed PyTorch/torchvision
runtime and may retrieve the facebookresearch/dinov2 torch hub repository and
checkpoint only after explicit download permission. VideoScope does not bundle
that repository or its weights. The upstream repository declares the Apache
License 2.0; users and distributors must still review the terms and model card
for the exact revision and checkpoint they use.

The optional PaddleOCR provider uses user-installed PaddleOCR and PaddlePaddle
packages and may retrieve PaddleOCR model files only after explicit download
permission. VideoScope does not bundle OCR model weights. Users and
distributors must review the software and model terms for the exact releases
and model files they use.

External FFmpeg dependency
--------------------------

VideoScope invokes user-installed ffmpeg and ffprobe executables. It does not
copy, bundle, or redistribute FFmpeg binaries. FFmpeg licensing depends on how a
particular build was configured; users and downstream distributors must review
the license information supplied with their chosen FFmpeg build.

JavaScript lock graphs
----------------------

The source dashboard directly uses React, React DOM, TypeScript, Vite, Vitest,
jsdom, and Testing Library packages. The public site has a separate dependency
graph. Production artifacts contain compiled first-party assets, not
`node_modules`. The complete non-root inventories are frozen by lockfile
SHA-256, package count, and license counts in the reviewed policy. The reviewed
graphs include MPL-2.0 packages in the public site and a CC-BY-4.0 package in
the dashboard development graph; details are in
`docs/third-party-licenses.md`. The packaged dashboard production closure is
React, React DOM and Scheduler; its exact versions, copyright notice and shared
MIT license text are redistributed in `THIRD_PARTY_NOTICES.txt`.

This automated inventory is a fail-closed release gate, not legal advice or a
legal certification. Human review remains required before redistribution.
