Third-Party Software Notices
Full verbatim text as shipped alongside the Vardex installer
Vardex — Third-Party Software Notices
Vardex | melbius.com
Vardex is a proprietary application, but it is built using several open-source
components. This file lists them, their licenses, and required notices. It
should be bundled alongside the installer/executable.
================================================================================
pystray — LGPL-3.0
https://github.com/moses-palmer/pystray
================================================================================
Used for the Windows system tray icon. Shipped as an unmodified, independently
replaceable copy of its source (not compiled into the application's private
archive) at Vardex\_internal\pystray\ in the installed application folder, per
LGPLv3 Section 4(d)(1)'s "suitable shared library mechanism" allowance. The
full LGPL-3.0 license text is included below and also accompanies the source
at the path above.
GNU LESSER GENERAL PUBLIC LICENSE
Version 3, 29 June 2007
This version of the GNU Lesser General Public License incorporates the
terms and conditions of version 3 of the GNU General Public License,
supplemented by the additional permissions in this file. Full text:
https://www.gnu.org/licenses/lgpl-3.0.txt
================================================================================
scapy — GPL-2.0 (isolated subprocess only — not linked into Vardex)
https://github.com/secdev/scapy
================================================================================
Used only inside vardex_capture.py, which runs as a separate operating-system
process communicating with the main application over a line-delimited JSON
pipe (stdout). No Scapy code, object files, or data structures are linked
into, imported by, or shared in-process with the proprietary application.
vardex_capture.py is itself licensed to you under GPL version 2, separately
from Vardex. You may use, copy, modify, and redistribute both it and Scapy on
those terms, and nothing in the Vardex EULA restricts those rights.
WHERE TO FIND THE SOURCE AND THE LICENSE
Both programs are shipped to you as complete, unmodified source. In an
installed copy of Vardex, relative to the application folder:
COPYING-GPL-2.0.txt
The full text of GNU General Public License version 2.
_internal\vardex_capture.py
Complete source of the capture program. Also published at
https://github.com/melbiushub/vardex-capture
_internal\python-embed\Lib\site-packages\scapy\
Complete Scapy source (Python, unmodified, not byte-code only).
_internal\python-embed\Lib\site-packages\scapy-*.dist-info\licenses\
Scapy's own copy of the GPL-2.0 text as shipped by its authors.
Because the complete corresponding source accompanies the distribution, this
satisfies GPL-2.0 section 3(a). In addition, and for at least three years from
your receipt of the Software, we will on request give any third party a
complete machine-readable copy of the corresponding source for these GPL-2.0
components, for no more than our cost of physically performing the
distribution. Requests: via melbius.com.
================================================================================
CPython (bundled runtime) — PSF License
https://github.com/astral-sh/python-build-standalone
================================================================================
The backend, capture subprocess, and frontend static-file host run under a
self-contained CPython 3.13 build bundled at Vardex\_internal\python-embed\
in the installed application folder (scripts/prepare_python_embed.py
provisions it at build time) — so installing Vardex never requires a
separately installed Python. Built via python-build-standalone, a
redistributable repackaging of the official CPython interpreter under
CPython's own PSF License (the same license terms as installing Python
directly from python.org): https://docs.python.org/3/license.html
================================================================================
Permissive-licensed dependencies (attribution only)
================================================================================
pywebview — BSD-3-Clause
https://github.com/r0x0r/pywebview
pywin32 — PSF License (mixed with some BSD/MIT-licensed sub-components)
https://github.com/mhammond/pywin32
Used by vardex_secrets.py for DPAPI-based secrets-at-rest encryption.
psutil — BSD-3-Clause
https://github.com/giampaolo/psutil
six — MIT (pystray's own Windows-backend dependency)
https://github.com/benjaminp/six
Pillow — HPND (MIT-like)
https://github.com/python-pillow/Pillow
dpkt — BSD-3-Clause
https://github.com/kbandla/dpkt
Copyright (c) 2004 Dug Song <dugsong@monkey.org>
websockets — BSD-3-Clause
https://github.com/python-websockets/websockets
numpy — BSD-3-Clause
https://github.com/numpy/numpy
scikit-learn — BSD-3-Clause
https://github.com/scikit-learn/scikit-learn
anthropic (Python SDK) — MIT
https://github.com/anthropics/anthropic-sdk-python
React, React DOM, Vite — MIT
https://github.com/facebook/react
https://github.com/vitejs/vite
oui_vendors.json (MAC-address vendor lookup, used by the Devices feature)
— derived from ttafsir/mac-oui-lookup, MIT License, Copyright (c) 2023 ttafsir
https://github.com/ttafsir/mac-oui-lookup
The underlying MAC-vendor assignment data originates from the IEEE
Registration Authority's public MA-L registry (standards-oui.ieee.org),
republished here in a compact format under the above MIT license.
Copyright notices for the above:
pywebview Copyright (c) 2014-2017, Roman Sirokov
psutil Copyright (c) 2009, Jay Loden, Dave Daeschler, Giampaolo Rodola
six Copyright (c) 2010-2024 Benjamin Peterson
dpkt Copyright (c) 2004 Dug Song <dugsong@monkey.org>
websockets Copyright (c) Aymeric Augustin and contributors
numpy Copyright (c) 2005-2025, NumPy Developers
scikit-learn Copyright (c) 2007-2026 The scikit-learn developers
anthropic Copyright 2023 Anthropic, PBC
Pillow Copyright (c) 1997-2011 by Secret Labs AB,
Copyright (c) 1995-2011 by Fredrik Lundh and contributors
React,
React DOM Copyright (c) Meta Platforms, Inc. and affiliates
Vite Copyright (c) 2019-present, VoidZero Inc. and Vite contributors
The BSD-3-Clause components above are redistributed under these terms:
Redistribution and use in source and binary forms, with or without
modification, are permitted provided that the following conditions are met:
1. Redistributions of source code must retain the above copyright notice,
this list of conditions and the following disclaimer.
2. Redistributions in binary form must reproduce the above copyright
notice, this list of conditions and the following disclaimer in the
documentation and/or other materials provided with the distribution.
3. Neither the name of the copyright holder nor the names of its
contributors may be used to endorse or promote products derived from
this software without specific prior written permission.
THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE
LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
POSSIBILITY OF SUCH DAMAGE.
(dpkt's own third condition instead reads: "The names of the authors and
copyright holders may not be used to endorse or promote products derived
from this software without specific prior written permission.")
The MIT-licensed components above are redistributed under these terms:
Permission is hereby granted, free of charge, to any person obtaining a
copy of this software and associated documentation files (the "Software"),
to deal in the Software without restriction, including without limitation
the rights to use, copy, modify, merge, publish, distribute, sublicense,
and/or sell copies of the Software, and to permit persons to whom the
Software is furnished to do so, subject to the following conditions:
The above copyright notice and this permission notice shall be included in
all copies or substantial portions of the Software.
THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING
FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER
DEALINGS IN THE SOFTWARE.
================================================================================
Apache License 2.0 dependencies
================================================================================
requests — Apache-2.0
https://github.com/psf/requests
geoip2 — Apache-2.0
https://github.com/maxmind/GeoIP2-python
The Apache License 2.0 (full text: https://www.apache.org/licenses/LICENSE-2.0)
requires that redistributions include a copy of the license, state any changes
made to the licensed files, and retain existing copyright/attribution/patent
notices. Vardex does not modify either library's source. The full Apache-2.0
license text applies to both:
Licensed under the Apache License, Version 2.0 (the "License");
you may not use this file except in compliance with the License.
You may obtain a copy of the License at
http://www.apache.org/licenses/LICENSE-2.0
Unless required by applicable law or agreed to in writing, software
distributed under the License is distributed on an "AS IS" BASIS,
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
See the License for the specific language governing permissions and
limitations under the License.
================================================================================
Bundled Python runtime components (39 packages)
================================================================================
Vardex ships a self-contained CPython runtime (see above) with the packages
below pre-installed at Vardex\_internal\python-embed\Lib\site-packages\.
Each package's own unmodified license file is retained inside its *.dist-info\
directory at that path and is distributed with the Software. Some of these are
direct dependencies; the rest are transitive dependencies pulled in by them.
aiohappyeyeballs 2.7.1 PSF-2.0
aiohttp 3.14.3 Apache-2.0 AND MIT
aiosignal 1.4.0 Apache-2.0
annotated-types 0.8.0 MIT
anthropic 1.0.0 MIT
anyio 4.14.2 MIT
attrs 26.1.0 MIT
certifi 2026.7.22 MPL-2.0
charset-normalizer 3.5.1 MIT
docstring_parser 0.18.0 MIT
dpkt 1.9.8 BSD-3-Clause
frozenlist 1.8.0 Apache-2.0
geoip2 5.3.0 Apache-2.0
h11 0.16.0 MIT
httpcore2 2.12.0 BSD-3-Clause
httpx2 2.12.0 BSD-3-Clause
idna 3.19 BSD-3-Clause
jiter 0.16.0 MIT
joblib 1.5.3 BSD-3-Clause
maxminddb 3.1.1 Apache-2.0
multidict 6.7.1 Apache-2.0
narwhals 2.25.0 MIT
numpy 2.5.2 BSD-3-Clause AND 0BSD AND MIT AND Zlib AND CC0-1.0
propcache 0.5.2 Apache-2.0
pydantic 2.13.4 MIT
pydantic_core 2.46.4 MIT
pywin32 312 PSF-2.0
requests 2.34.2 Apache-2.0
scapy 2.7.0 GPL-2.0-only
scikit-learn 1.9.0 BSD-3-Clause
scipy 1.18.1 BSD-3-Clause
sniffio 1.3.1 MIT OR Apache-2.0
threadpoolctl 3.6.0 BSD-3-Clause
truststore 0.10.4 MIT
typing_extensions 4.16.0 PSF-2.0
typing-inspection 0.4.4 MIT
urllib3 2.7.0 MIT
websockets 17.0.1 BSD-3-Clause
yarl 1.24.5 Apache-2.0
The complete, verbatim license text and copyright notice for every package
listed above ships with the Software inside that package's *.dist-info\
directory. This notice and those files together form the required attribution.
Where a package is dual- or multi-licensed (for example "MIT OR Apache-2.0", or
numpy's combination of BSD-3-Clause with vendored 0BSD, MIT, Zlib and CC0-1.0
components), the terms in that package's own license file govern.
Two of the above carry obligations beyond attribution and are called out here:
certifi -- MPL-2.0. The Mozilla Public License 2.0 is a file-level copyleft
license. certifi is shipped unmodified; its source is the same file set
distributed with the Software, and is also available from
https://github.com/certifi/python-certifi. Recipients may obtain, modify and
redistribute the MPL-covered files under the MPL-2.0's own terms.
Full text: https://www.mozilla.org/en-US/MPL/2.0/
scapy -- GPL-2.0-only. Present in the bundled runtime because the packet
capture subprocess needs it. See the scapy section above for why this is a
separate program rather than a linked library.
================================================================================
Third-party data
================================================================================
GeoLite2 (MaxMind) — not bundled. Each installation supplies its own database
downloaded directly from MaxMind under MaxMind's own EULA:
https://www.maxmind.com/en/geolite2/eula