# Third-Party Notices

MemRelay is licensed under `AGPL-3.0-only`. The following table records the principal runtime, build, and user-interface components included by the source tree or production images. Exact transitive versions are fixed by `backend/uv.lock`, `frontend/pnpm-lock.yaml`, the Basic Memory submodule lockfile, and the container image definitions.

| Component | Version | License | Source |
| --- | --- | --- | --- |
| Basic Memory | 0.22.1 | AGPL-3.0-or-later | <https://github.com/basicmachines-co/basic-memory> |
| Bitwarden CLI | 2026.7.0 | GPL-3.0-only | <https://github.com/bitwarden/clients> |
| paraphrase-multilingual-MiniLM-L12-v2 | pinned by image build | Apache-2.0 | <https://huggingface.co/sentence-transformers/paraphrase-multilingual-MiniLM-L12-v2> |
| Python | 3.12 | PSF-2.0 | <https://www.python.org/> |
| FastAPI | 0.116.1 | MIT | <https://github.com/fastapi/fastapi> |
| FastMCP | 3.3.1 | Apache-2.0 | <https://github.com/jlowin/fastmcp> |
| Pydantic / pydantic-settings | 2.x | MIT | <https://github.com/pydantic/pydantic> |
| SQLAlchemy | 2.0.43 | MIT | <https://github.com/sqlalchemy/sqlalchemy> |
| Alembic | 1.16.4 | MIT | <https://github.com/sqlalchemy/alembic> |
| Uvicorn | 0.35.0 | BSD-3-Clause | <https://github.com/encode/uvicorn> |
| HTTPX | 0.28.1 | BSD-3-Clause | <https://github.com/encode/httpx> |
| cryptography | 45.0.6 | Apache-2.0 OR BSD-3-Clause | <https://github.com/pyca/cryptography> |
| argon2-cffi | 25.1.0 | MIT | <https://github.com/hynek/argon2-cffi> |
| croniter | 6.0.0 | MIT | <https://github.com/pallets-eco/croniter> |
| openpyxl | 3.1.5 | MIT | <https://foss.heptapod.net/openpyxl/openpyxl> |
| python-docx | 1.2.0 | MIT | <https://github.com/python-openxml/python-docx> |
| python-pptx | 1.0.2 | MIT | <https://github.com/scanny/python-pptx> |
| pypdf | 5.9.0 | BSD-3-Clause | <https://github.com/py-pdf/pypdf> |
| Pillow | 11.3.0 | HPND | <https://github.com/python-pillow/Pillow> |
| Vue | 3.5.x | MIT | <https://github.com/vuejs/core> |
| Vue Router | 4.5.x | MIT | <https://github.com/vuejs/router> |
| Pinia | 3.0.x | MIT | <https://github.com/vuejs/pinia> |
| Vue I18n | 11.x | MIT | <https://github.com/intlify/vue-i18n> |
| Element Plus | 2.10.x | MIT | <https://github.com/element-plus/element-plus> |
| CodeMirror | 6.x | MIT | <https://github.com/codemirror/dev> |
| marked | 18.0.7 | MIT | <https://github.com/markedjs/marked> |
| DOMPurify | 3.4.12 | Apache-2.0 OR MPL-2.0 | <https://github.com/cure53/DOMPurify> |
| Vite | 7.x | MIT | <https://github.com/vitejs/vite> |
| Node.js | 22 | MIT | <https://github.com/nodejs/node> |
| uv | 0.8.4 | Apache-2.0 OR MIT | <https://github.com/astral-sh/uv> |
| gosu | Debian package version | Apache-2.0 | <https://github.com/tianon/gosu> |
| Git | Debian package version | GPL-2.0-only | <https://git-scm.com/> |
| Tesseract OCR | Debian package version | Apache-2.0 | <https://github.com/tesseract-ocr/tesseract> |
| Poppler utilities | Debian package version | GPL-2.0-or-later | <https://poppler.freedesktop.org/> |
| Alpine Linux backup image | 3.22 | Multiple open-source licenses | <https://www.alpinelinux.org/> |

The Basic Memory source and its license are available under `third_party/basic-memory/`. License texts and attribution files for Python and JavaScript transitive packages are available from their respective source distributions and installed package metadata. Container redistributors should preserve this notice, the root `LICENSE`, and any license files added by upstream image packages.