Runtime: Archiver 8.0.0 — MIT — https://github.com/archiverjs/node-archiver
Full license: public/vendor/Archiver-LICENSE.txt.
Exact transitive dependency versions and license identifiers: package-lock.json.
The project pins readdir-glob > minimatch to 11.0.1 using npm overrides:
https://github.com/advisories/GHSA-g3hv-75wg-m249
The public endpoint never accepts user-provided glob patterns.

Development inspector: yauzl 3.4.0 (MIT), buffer-crc32 1.0.0 (MIT).
These packages inspect generated fixtures and are not used by the HTTP server.
Development DOM tests: jsdom 31.0.0 (MIT), https://github.com/jsdom/jsdom.
JSDOM is used only for tests, not by the browser workshop or the HTTP server.
Bootstrap 5.3.8 — MIT — local public/vendor/bootstrap.min.css.
Full license: public/vendor/Bootstrap-LICENSE.txt.
Workshop source code: MIT; see LICENSE.