1# Third-party renderer sources23The Worker vendors source from these exact Apache-2.0-licensed upstream4repositories. The commit is the source-of-truth revision used in `src/`;5the package version is included where the upstream project publishes one.67- [Kroki BlockDiag fork](https://github.com/yuzutech/blockdiag/tree/f0d23ca664462d09f19d7b8e706a5a024b7d5f4d)8 v3.4.2, commit `f0d23ca664462d09f19d7b8e706a5a024b7d5f4d`9- [SeqDiag](https://github.com/blockdiag/seqdiag/tree/9ffd7bf4e65f2508f3f7a2041f77564bc44deafa)10 3.0.0, commit `9ffd7bf4e65f2508f3f7a2041f77564bc44deafa`11- [ActDiag](https://github.com/blockdiag/actdiag/tree/f74203528d6ae3ba43898f93505e01d153677062)12 3.0.0, commit `f74203528d6ae3ba43898f93505e01d153677062`13- [NwDiag](https://github.com/blockdiag/nwdiag/tree/04bbb4581e90ea891fe826be6c82f4aaee522f26)14 3.0.0, commit `04bbb4581e90ea891fe826be6c82f4aaee522f26`; this source also15 supplies PacketDiag and RackDiag.1617The complete Apache-2.0 texts are retained in `vendor-licenses/`:18`blockdiag-LICENSE`, `seqdiag-LICENSE`, `actdiag-LICENSE`, and19`nwdiag-LICENSE`. The static registry in `src/upstream_runtime.py` is a20diagram.zip adapter: it replaces metadata entry-point discovery with the21vendored SVG drawer, all vendored node renderers, PacketDiag's renderer, and22the three built-in plugins (`attributes`, `autoclass`, `autolane`).2324## Runtime dependencies2526`uv.lock` pins the Pyodide-packaged runtime dependencies:2728- [Pillow](https://github.com/python-pillow/Pillow), 11.3.0 — HPND-style29 Pillow license; used for text measurement and image primitives.30- [funcparserlib](https://github.com/vlasov-volnov/funcparserlib), 1.0.1 —31 BSD-3-Clause.32- [webcolors](https://github.com/ubernostrum/webcolors), 25.10.0 —33 BSD-3-Clause.34- [defusedxml](https://github.com/tiran/defusedxml), 0.7.1 — Python35 Software Foundation License; used for defensive SVG parsing.3637The lock file contains the resolved URLs and hashes. Development-only38packages (`pytest`, `workers-py`, and the Workers runtime SDK) are not part of39the renderer's application dependency list.4041## Bundled font4243`src/assets/DejaVuSerif.ttf` is from the [DejaVu Fonts project](https://dejavu-fonts.github.io/).44Its Debian copyright/permission text is retained as45`vendor-licenses/dejavu-COPYRIGHT`. The file is distributed under the46Bitstream Vera terms for the original glyphs, with DejaVu changes in the47public domain; the font is used only to make Worker text metrics deterministic.4849The Worker also bundles the resolved dependencies from `uv.lock`; package50metadata and license files are carried into the generated `python_modules`51deployment directory by Pywrangler. Re-run `uv lock` deliberately when52updating dependencies and review the resulting hashes and license changes.