pdf-lib 1.17.1, MIT, by Andrew Dillon and contributors.
Official package: https://www.npmjs.com/package/pdf-lib/v/1.17.1
Source: https://github.com/Hopding/pdf-lib/tree/v1.17.1
Registry tarball: https://registry.npmjs.org/pdf-lib/-/pdf-lib-1.17.1.tgz
Fetched with npm pack from official registry on 2026-11-07.
Registry integrity: sha512-V/mpyJAoTsN4cnP31vc0wfNA1+p20evqqnap0KLoRUN0Yk/p3wN52DOEsL4oBFcLdb76hlpKPtzJIgo67j/XLw==
Vendored UMD file SHA-256: 0f9a5cad07941f0826586c94e089d89b918c46e5c17cf2d5a3c6f666e3bc694f
Bundle includes pdf-lib dependencies; upstream licence retained verbatim.
No runtime CDN or external API is used.

Third-party notices are included beside the library for its declared runtime dependencies:
@pdf-lib/standard-fonts 1.0.0 (MIT), @pdf-lib/upng 1.0.1 (MIT), pako 1.0.11 (MIT/Zlib), tslib 1.11.1 (Apache-2.0 notice).
These notice files were retrieved from those official npm registry packages.
The upstream prebuilt UMD artifact is used unchanged; its exact bundled dependency revisions are not independently reconstructed from the build.

The upstream package yarn.lock is retained unmodified. It pins the above direct runtime dependencies and pako 1.0.10 transitively. This is provenance evidence, not a reproduced build. The separate zlib source banner from pako lib/zlib/deflate.js is retained in pako-ZLIB-NOTICE.txt.