curlPro
Copyright 2026 int3re

Licensed under Apache 2.0; the full text is in the LICENSE file.

The project uses third-party code; its licences are listed below.

Dependencies (pulled in by the Go module, not stored in the repository):
  github.com/refraction-networking/utls   — BSD-3-Clause
  github.com/refraction-networking/uquic  — BSD-3-Clause and MIT
  github.com/bogdanfinn/fhttp             — BSD-3-Clause
      (vendored with a local patch to HTTP/2 flow control — docs/FHTTP-PATCH.md)
  github.com/quic-go/qpack                — MIT
  github.com/klauspost/compress           — Apache-2.0, BSD-3-Clause, MIT
  github.com/andybalholm/brotli           — MIT
  golang.org/x/net, golang.org/x/crypto   — BSD-3-Clause
  gopkg.in/yaml.v3                        — MIT and Apache-2.0

Code copied into this repository:
  internal/h3/        — a copy of http3 from github.com/refraction-networking/uquic
                        (BSD-3-Clause and MIT). The list of changes against the
                        original version is in internal/h3/README.md
  internal/qpack/static_table.go
                      — the static table from github.com/quic-go/qpack (MIT)

Tools downloaded separately, not part of the repository:
  github.com/wi1dcard/fingerproxy (echo-server) — MIT

JA4H is computed by internal/fingerprint/ja4h.go under the FoxIO License 1.1
(patent-pending): free for internal and academic use, an OEM licence required
for commercial monetisation. It is the only component under that licence, and
it can be excluded from the build entirely with -tags nofoxio; nothing else
changes. JA4 for TLS, computed elsewhere in the same package, is BSD-3.

Dependencies are vendored in vendor/ and carry their own licence files there.

The browser profiles in profiles/ were obtained two ways: by our own measurements
of live browsers and by importing the curl-impersonate signatures (MIT) — see docs/.
