vpn/THIRD_PARTY_NOTICES.md

Third-party notices

This file is intentionally explicit about components that may be bundled. Native artifacts are not committed to this repository; their version and SHA-256 are pinned here and in the fetch script.

Component	Use	Version/commit	License	Source
Flet	Python UI/runtime packaging	pinned by uv.lock	Apache-2.0	https://github.com/flet-dev/flet
FreeTurn mobile API	Future Android FreeTurn transport; currently excluded because its gomobile runtime conflicts with libbox	samosvalishe/free-turn-proxy commit 065385e656085a06bf8079958bf1b563901db64f; reviewed AAR SHA-256 112207f15bd5c93500be13e249f884dec0768d0f542599b3e24f641837483a6e	GPL-3.0	https://github.com/samosvalishe/free-turn-proxy
FreeTurn Android reference	lifecycle/API reference only; not a source dependency	inspected only	GPL-3.0	https://github.com/samosvalishe/turn-proxy-android
sing-box-lx / libbox	Android VLESS + AmneziaWG 3.x VPN/proxy engine	v1.14.1-lx.8, tag commit 8e12ec7db6a77130fcc63b7c545d3a41f895f30a; AAR SHA-256 beab998c9d0a46826db0d654b5315fa6a25d9e1cbf8cb10c547e757444c26d80	GPL-3.0-or-later with additional naming restriction in upstream LICENSE	https://github.com/Leadaxe/sing-box-lx
XTLS/libXray	optional future VLESS mobile binding; not currently bundled	not bundled	MPL-2.0	https://github.com/XTLS/libXray
FastAPI / Uvicorn / Pydantic / qrcode	Python app/backend dependencies	pinned by uv.lock	respective upstream licenses	PyPI

The Android reference applications are not copied. Distribution of an APK containing libbox.so must comply with sing-box-lx's GPL and additional LICENSE term; the MIT license applies only to original code and does not relicense the combined binary.