# Third-party notices

WhiskerJS is original code licensed under the Apache License 2.0, except for
the two small adapted parts listed below. Each adapted part also carries a
header comment in its source file naming the source package, version, file
and licence. No other third-party code is included, and WhiskerJS has no
runtime dependencies.

## 1. FingerprintJS 5.3.0

- Source: npm package `@fingerprintjs/fingerprintjs` version 5.3.0, file
  `dist/fp.esm.js`, function `getMathFingerprint`.
- Adapted into: `src/collectors/math.ts`.
- What was adapted: the list of Math operations, their empirical input
  constants and the polyfill expressions. The surrounding code is original.
- Licence: MIT, full text below.

```
MIT License

Copyright (c) 2025 FingerprintJS, Inc

Permission is hereby granted, free of charge, to any person obtaining a copy
of this software and associated documentation files (the "Software"), to deal
in the Software without restriction, including without limitation the rights
to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
copies of the Software, and to permit persons to whom the Software is
furnished to do so, subject to the following conditions:

The above copyright notice and this permission notice shall be included in all
copies or substantial portions of the Software.

THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
SOFTWARE.
```

## 2. fpscanner 1.0.8

- Source: npm package `fpscanner` version 1.0.8, file
  `src/signals/mediaCodecs.ts`, constants `AUDIO_CODECS` and `VIDEO_CODECS`.
- Adapted into: `src/collectors/codecs.ts`.
- What was adapted: the audio and video MIME type strings only. The probing
  code is original.
- Licence: MIT, full text below.

```
The MIT License (MIT)

Copyright (c) 2017 antoinevastel <antoine.vastel@gmail.com>

Permission is hereby granted, free of charge, to any person obtaining a copy
of this software and associated documentation files (the "Software"), to deal
in the Software without restriction, including without limitation the rights
to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
copies of the Software, and to permit persons to whom the Software is
furnished to do so, subject to the following conditions:

The above copyright notice and this permission notice shall be included in all
copies or substantial portions of the Software.

THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
SOFTWARE.
```

## Studied for ideas only (no code included)

These public references were read for techniques. Nothing from them is
included in WhiskerJS, so no licence text is reproduced for them.

| Reference | Version read | Licence | Used for |
| --- | --- | --- | --- |
| FingerprintJS (`@fingerprintjs/fingerprintjs`) | 5.3.0 | MIT | Ideas: double canvas render to detect noise, screen orientation normalisation, media feature probes, vendor flavour globals, Client Hints with GREASE filtering and the Permissions Policy marker, CPU architecture by the NaN sign bit, screen frame, Intl locale, Apple Pay and Private Click Measurement, font preferences, audio base latency, content-blocker bait probes |
| ThumbmarkJS (`@thumbmarkjs/thumbmarkjs`) | 1.12.0 | MIT | Ideas: component layout, offline audio graph, speech voices as a signal, permission states, JS heap limit, font detection by canvas measureText. Its API and telemetry calls were not used |
| BotD (`@fingerprintjs/botd`) | 2.0.0 | MIT | Ideas: automation globals and headless markers, eval length and productSub engine checks, the notification permission quirk, plugin and mimeType type checks |
| fpscanner | 1.0.8 | MIT | Ideas: software renderer and webdriver checks, keyboard layout map, WebGPU adapter info, the canvas tamper probe, iframe cross-check, writable webdriver, impossible hardware, the sectioned fsid identifier and the nonce and timestamp anti-replay idea (its XOR obfuscation is not used) (beyond the adapted MIME lists above) |
| CreepJS | licence checked on the default branch (MIT); source not read | MIT | Ideas only: lie detection through native function source, names and own properties; a clean iframe realm as reference; Proxy detection by printed name; plugin and mimeType consistency. The name is not used |
| Bowser | 2.14.1 | MIT | Ideas: browser class detection from the user agent |
| ClientJS | 0.2.1 | Apache-2.0 | Ideas: font and plugin probes |