Scope of this inventory: every direct dependency declared by a manifest committed to this
repository, every GitHub Action invoked directly by the versioned workflows or by the starter
workflows in workflow-templates/, every third-party script loaded at runtime by a page this
repository publishes, and the third-party brand assets vendored by the published pages.
The versioned inventory is the repository's dependency graph (Insights → Dependency graph),
which GitHub maintains from the committed manifest, lockfile and workflow files and exports as an
SBOM on request. Versions, version ranges and immutable commit pins live only in
package.json, package-lock.json and the workflow files, where Dependabot updates them; this
document deliberately does not repeat them, so it can never drift from those sources. Transitive
dependencies are pinned by the committed lockfile. The official GitHub Dependency Review action
evaluates manifest and lockfile changes on every pull request to main, the Enterprise license-compliance
rule validates licenses, and the public-site workflows install the committed npm lockfile with
lifecycle scripts disabled and run npm signature and advisory checks. The repository intentionally
has no parallel scanner, pin auditor, containerized Zizmor runtime, or policy wrapper of its own.
Licenses below were read from each package's own published manifest or from its upstream repository, not inferred.
| Component | License | Scope | Source |
|---|---|---|---|
| commonmark | BSD-2-Clause | development | https://www.npmjs.com/package/commonmark |
| prettier | MIT | development | https://www.npmjs.com/package/prettier |
The table lists each external Action repository invoked directly by the
versioned workflows or by the starter workflows in workflow-templates/.
anthropics/claude-code-action appears only in the starter workflow
workflow-templates/claude.yml, which this repository does not run and whose
pin Dependabot does not maintain, because the github-actions entry in
.github/dependabot.yml uses directory: "/" and so covers only
.github/workflows; that pin is updated by hand.
github/codeql-action is MIT-licensed, while the CodeQL CLI bundle selected by
the Action is separately governed by the
GitHub CodeQL Terms and Conditions
and the Enterprise GitHub Code Security entitlement.
The account-deletion page imports Firebase JS SDK 13.2.0 on demand from
https://www.gstatic.com/firebasejs/13.2.0/firebase-app.js and
https://www.gstatic.com/firebasejs/13.2.0/firebase-app-check.js. The SDK is
Apache-2.0 licensed and is not vendored. Its official
release notes and
CDN setup document the SDK
and its versioned CDN modules. App Check uses the official
reCAPTCHA Enterprise provider,
whose hosted browser service is governed by Google's terms. The provider loads
https://www.google.com/recaptcha/enterprise.js; no copy is hosted here.
Only the email-link request and its confirmation load these libraries. The configuration contains public web-app identifiers and a dedicated public web API key; no backend key or debug provider is included. The page sends the native App Check token only in the link request and confirmation request headers, following the custom backend guidance.
The two inline SVG paths in site/index.html are byte-for-byte copies of the
official mark-github-16.svg path from Primer Octicons v19.33.0, at immutable
commit cc4e12df6ff8292447ba9141eaa2a6f6e1c59a85 and Git blob
0e55a8ef2db1913cb35f81ae09ffdb58b5422319.
| Component | Version | Code license and brand terms | Scope | Immutable source |
|---|---|---|---|---|
GitHub Invertocat (mark-github-16) |
Octicons v19.33.0 |
Octicons code: MIT; GitHub mark: GitHub Logo Policy and Brand Toolkit | organization link in the primary navigation; GitHub followers indicator in the organization card | https://github.com/primer/octicons/blob/cc4e12df6ff8292447ba9141eaa2a6f6e1c59a85/icons/mark-github-16.svg |
The unchanged notice is also published at
site/OCTICONS-LICENSE.txt, linked from the site
footer, so it accompanies both inline GitHub marks in the Pages artifact.
The following is the complete, unmodified LICENSE text from immutable Octicons
commit cc4e12df6ff8292447ba9141eaa2a6f6e1c59a85 (Git blob
aa1fa80ed83cf856fb31c22ba56557c42ca84488, SHA-256
da259c8bd0de62713ccdcf88910aebca810644f98c2c912bad814fc79ea778df):
MIT License
Copyright (c) 2026 GitHub Inc.
Permission is hereby granted, free of charge, to any person obtaining a copy
of this software and associated documentation files (the "Software"), to deal
in the Software without restriction, including without limitation the rights
to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
copies of the Software, and to permit persons to whom the Software is
furnished to do so, subject to the following conditions:
The above copyright notice and this permission notice shall be included in all
copies or substantial portions of the Software.
THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
SOFTWARE.
The Octicons repository directs users of GitHub logos to the GitHub logo guidelines; its MIT code license does not replace the separate trademark and brand conditions for the mark. The primary-navigation use accompanies an outbound link to the GitHub organization. The organization-card use is a non-interactive metric indicator identifying GitHub as the source and context of the adjacent follower count. Both remain secondary to the LCV Ideas & Software identity and do not imply GitHub affiliation or endorsement.
At this revision, svg.github-mark fixes both marks to pure white (#fff), one
of the explicitly permitted colors and the highest-contrast option on their
dark backgrounds. The path geometry, proportions and aspect ratio are the
official asset; no gradient, shadow, distortion or other effect is applied.
The sponsor page loads official Mercado Pago browser scripts directly from Mercado Pago's own origin. Neither is vendored into this repository, neither carries a version pin addressable from here, and both are governed by Mercado Pago's terms rather than by an open-source license.
The two are not interchangeable and are not equally required. MercadoPago.js V2 is the SDK that
builds the Card Payment Brick secure fields and, as a side effect of constructing
new MercadoPago(publicKey, ...), sets window.MP_DEVICE_SESSION_ID automatically. security.js
is loaded with output="deviceId" and only populates window.deviceId, which the page uses as the
fallback device identifier — the precedence is explicit at site/sponsor/index.html:1380-1382,
where window.MP_DEVICE_SESSION_ID wins and the manual value is used only when it is absent.
| Component | Version | License | Scope | Source |
|---|---|---|---|---|
| MercadoPago.js V2 | v2 endpoint, unpinned | Proprietary — Mercado Pago | runtime | https://sdk.mercadopago.com/js/v2 |
Mercado Pago security.js |
v2 endpoint, unpinned | Proprietary — Mercado Pago | runtime | https://www.mercadopago.com/v2/security.js |
What is verifiable here is the shape of the integration, not a justification for it: both scripts are fetched at runtime from unversioned provider endpoints, so neither carries a version this repository can pin, and neither is vendored.
Externally hosted script — Google tag (gtag.js) on every page except site/account-deletion/index.html
Every index.html under site/, except site/account-deletion/index.html, carries the official Google tag snippet at the top of its
<head>, right after the Google Tag Manager loader described below. The snippet loads
gtag.js asynchronously from Google's own origin and then configures two tag IDs inline:
gtag("config", "AW-18511303830") for the Google Ads account and
gtag("config", "G-PK09C40XL5") for the Google Analytics 4 property. Google documents that a single
Google tag can carry several tag IDs and that a further ID is added as another config command,
so both share one loader rather than loading gtag.js twice. The script is not vendored into
this repository, carries no version pin addressable from here, and is governed by Google's terms
rather than by an open-source license (LCV-450, LCV-451).
| Component | Version | License | Scope | Source |
|---|---|---|---|---|
Google tag (gtag.js) |
live endpoint, unpinned | Proprietary — Google | runtime, every page except site/account-deletion/index.html |
https://www.googletagmanager.com/gtag/js?id=AW-18511303830 |
The account-deletion page loads neither Google tag nor Google Tag Manager, including its
<noscript> iframe, to keep personal data and credentials from the deletion flow out of tracking.
The archived privacy policies under site/privacy/1.x/ carry the same snippet in their <head>;
their policy text is unchanged.
Externally hosted script — Google Tag Manager container on every page except site/account-deletion/index.html
Every index.html under site/, except site/account-deletion/index.html, also carries the official Google Tag Manager snippets for the
container GTM-5W9M8KRM, placed where Google's installation screen requires: the loader script as
high as possible in <head> (the first script, ahead of the Google tag above), and the <noscript>
iframe immediately after the opening <body> tag. Only <meta charset="utf-8" /> precedes the
loader, so the encoding declaration stays within the first 1024 bytes as the HTML standard requires. The loader fetches gtm.js asynchronously from Google's
own origin; the iframe is requested only when JavaScript is unavailable. Neither is vendored
into this repository, neither carries a version pin addressable from here, and both are governed by
Google's terms rather than by an open-source license (LCV-452).
| Component | Version | License | Scope | Source |
|---|---|---|---|---|
Google Tag Manager gtm.js |
live endpoint, unpinned | Proprietary — Google | runtime, every page except site/account-deletion/index.html |
https://www.googletagmanager.com/gtm.js?id=GTM-5W9M8KRM |
Google Tag Manager noscript |
live endpoint, unpinned | Proprietary — Google | no-JavaScript, every page except site/account-deletion/index.html |
https://www.googletagmanager.com/ns.html?id=GTM-5W9M8KRM |
This is a trademark surface, not a software-license surface. The file carries no open-source license, and the absence of one is not a defect to be repaired by attaching a license: its use is governed by the mark owner's own brand terms, recorded below.
| Component | Variant | Terms | Scope | Immutable source |
|---|---|---|---|---|
| Mercado Pago logo | MP_RGB_HANDSHAKE_color_horizontal.png |
Proprietary — Mercado Pago brand terms, Versión Marzo 2025, shipped inside the package | published on sponsor page | https://http2.mlstatic.com/storage/pog-cm-admin/calm-assets/Logos%20Mercado%20Pago%202025--fb6f16c9.zip |
The committed file is byte-identical to the file of the same name inside the official package:
- committed file: SHA-256
863719a51c238ef136f6ad53b9c25e3589846e06930bce6c6df5282cd4c1340f, 35,745 bytes, 1049×426 - official package: SHA-256
bc096531b45de70a4e005bbff5183fb2a5b46a1aca6966c7be1610e5461c71b1, retrieved 30 August 2026 from the brand page https://www.mercadopago.com.br/mp/logo-oficial - matching path inside the package:
Logos Mercado Pago 2025/Uso digital - RGB/PNGs/MP_RGB_HANDSHAKE_color_horizontal.png
The horizontal colour variant is the one the brand page designates as the primary version and recommends for most cases.
The brand page is Mercado Pago's own official distribution point for the mark and states that the materials are supplied so that the logo can be used correctly on third-party sites and communications. The package's own terms sheet restricts the RGB folder to digital use and names web pages among the intended cases.
Use here is descriptive. The logo identifies the payment processor that actually processes the
contribution; it links to https://www.mercadopago.com.br; and its title and aria-label both
read Pagamento processado por Mercado Pago. No sponsorship, endorsement, partnership, or
affiliation is implied or claimed.
| Rule | Source | State at this SHA |
|---|---|---|
| RGB assets are for digital use, web pages included | package terms sheet | rendered by site/sponsor/index.html |
| PNG may be used at the supplied size or smaller, never enlarged | package terms sheet | supplied 1049×426, rendered 69×28 |
| Do not condense, stretch, or deform; keep the iso-to-logo proportion | brand page | 1049 ÷ 426 = 2.4624; 69 ÷ 28 = 2.4643 |
| Do not alter colours or typography, and apply no shadows or effects | brand page | file byte-identical, and .mp-logo carries no shadow or effect |
| Colour versions may be placed on a white background | brand page | .mp-logo sets background: #ffffff, fully opaque |
| Never on institutional cyan, institutional blue, or non-brand colours | brand page | the opaque badge is the only surface behind the mark |
Byte identity settles the stored artwork, not what the browser paints. The last three rows are
therefore evidenced from the page's own rules rather than from the file digest: .mp-logo applies
no box-shadow, filter, opacity, or other effect, and its background is fully opaque, so the
dark panel gradient behind the panel never shows through under the mark.
The asset is vendored rather than hot-linked because Mercado Pago's CDN answers HTTP 403 to requests for it from outside its own properties, so the published page cannot reference it remotely.
The brand page describes a minimum size and a maximum reduction, but presents both only as a figure. On 30 August 2026 that figure's URL served the same image as the logo-versions figure — confirmed by downloading both at two resolutions and comparing digests, which matched. No numeric minimum is therefore published at the official source. The binding rule from the package's own terms sheet, which states no minimum and forbids only enlargement, is satisfied.
Copyright © 2026 Mercado Pago Instituição de Pagamento Ltda., CNPJ 10.573.521/0001-91. The mark belongs to its owner; nothing in this repository transfers, licenses, or sublicenses it.
Vendored brand asset — profile/assets/google-play-oficial.png and site/assets/google-play-oficial.png
This is a trademark surface, not a software-license surface. The file carries no open-source license, and the absence of one is not a defect to be repaired by attaching a license: its use is governed by the mark owner's own brand terms, recorded below.
| Component | Variant | Terms | Scope | Immutable source |
|---|---|---|---|---|
| Google Play badge | pt-br_badge_web_generic.png |
Proprietary — Google Play badge guidelines | published in the organization profile, this repository's README, and both site pages | https://play.google.com/intl/pt-BR/badges/static/images/badges/pt-br_badge_web_generic.png |
- committed file: SHA-256
e1ad5e03f636d94b05448c1f156e39b012b9e1d772b730d9e27d066695531a6b, 17,728 bytes, 646×250, 8-bit RGBA - retrieved 16 September 2026 from Google's own badge endpoint, which answered HTTP 200
- the two committed copies are byte-identical to that download and to each other
The Portuguese variant is the one matching the language of every surface that renders it.
https://play.google.com/intl/en_us/badges/ redirects to the Partner Marketing Hub badge page
(https://partnermarketinghub.withgoogle.com/brands/google-play/google-play/lockups-icons-badges/),
which publishes the rules verified below.
Use here is descriptive. The badge identifies the store that distributes the organization's Android
editions and links to the organization's own developer page,
https://play.google.com/store/apps/dev?id=8615566246127797211. No sponsorship, endorsement,
partnership, or affiliation is implied or claimed.
| Rule | Source | State at this SHA |
|---|---|---|
| Digital badge height must be at least 28 px | Partner Marketing Hub | rendered at height="56" on all four surfaces |
| Do not change the badge colour | Partner Marketing Hub | file byte-identical; no filter, opacity, or colour rule applies to it |
| Do not remove, rearrange, or otherwise adjust the badge | Partner Marketing Hub | file byte-identical; scaling is uniform, width: auto against the fixed height |
| Clear space of at least one quarter of the badge height (14 px) | Partner Marketing Hub | site 22.4 px above and 40 px below; sponsor page 20 px above and 24 px below |
| Always use current artwork from Partner Marketing Hub | Partner Marketing Hub | downloaded 16 September 2026; digest recorded above |
Byte identity settles the stored artwork, not what the browser paints. The colour and clear-space
rows are therefore evidenced from the pages' own rules: .footer__store and .footer-store carry
only margin and sizing, and each badge is the sole element of a centred block, so the horizontal
clear space is the remaining width of a footer far wider than the rendered 145 px. On the two
Markdown surfaces the badge occupies its own centred paragraph and receives GitHub's default
paragraph spacing, which exceeds the 14 px minimum.
The badge exists to drive downloads or pre-registration on Google Play. At this SHA the developer page carries the organization profile but lists no application, because the Android editions are still at the governance baseline stage, so the badge resolves to a catalogue with nothing yet to download or pre-register. This is recorded rather than claimed as compliant; it resolves itself when the first Android edition publishes.
Google Play and the Google Play logo are trademarks of Google LLC. The mark belongs to its owner; nothing in this repository transfers, licenses, or sublicenses it.
The original content of this repository owned by LCV Ideas & Software is proprietary to it. Copyright © 2026 LCV Ideas & Software. All rights reserved. See LICENSE and NOTICE. Contributor-owned material may be incorporated only under the separate documented written terms and local gate defined in INBOUND.md, and must be listed here or in NOTICE before merge.
The components listed above remain subject to their respective licenses and terms; the repository's proprietary terms do not replace or restrict those licenses or claim ownership of that material.