Shipping runtime
- MediaPipe Tasks Vision 0.10.35 — Apache-2.0 — local pose runtime.
- idb 8.0.3 — ISC — IndexedDB wrapper.
- Next.js 15.5.19 — MIT — web framework.
- React / React DOM 19.2.7 — MIT — UI runtime.
- Zod 3.25.76 — MIT — validation.
Dormant dependency
@supabase/supabase-js 2.110.1 (MIT) exists as a disabled optional integration. The current production path does not initialize it or send core data to Supabase. Enabling it would be a separate product release with its own notice and controls.
Pose model and hashes
The self-hosted Pose Landmarker Lite float16 v1 model and WASM/JS artifact hashes are pinned in the project's model manifest. MediaPipe runtime files are provided under Apache-2.0; the model source and exact hash are disclosed alongside them.
Full inventory
The project maintains THIRD_PARTY_NOTICES.md, a dependency inventory and a CycloneDX SBOM. Package and model upgrades regenerate those records.