# Dependency rebuild notes

All paths below refer to the separately supplied archives and their included upstream source files. No package has been substituted with another engine.

## DjVu.js Library 0.5.4

The frontend package includes `upstream/djvu/library/src`, package.json, package-lock.json, rollup.config.js and the exact built IIFE. Upstream commit: eca3e69c966f3b7fcf0453f39029bc1e409fea8a.

    cd upstream/djvu/library
    npm ci --ignore-scripts
    npm run build

The parent rebuild then appends `export default DjVu;` only to the ESM wrapper and copies the unchanged IIFE to the classic worker. No codec algorithm changes were made. pngjs 5.0.0 source and MIT license are included separately inside upstream/djvu/pngjs; its browser.js is the upstream browser distribution used by the lockfile. Rollup is a build tool, not served. The old upstream development tree can have audit advisories; it is not exposed as a production service.

## PyMuPDF 1.28.2 and MuPDF 1.28.2

Exact official wheel: `pymupdf-1.28.2-cp313-abi3-pyemscripten_2025_0_wasm32.whl`, SHA256 2e1b574c0fd2cb238021033fd3c0f9c4388816638df064e4bfb56d9d81736dc8. Runtime reports both PyMuPDF and MuPDF 1.28.2. Original binding source is `pymupdf-1.28.2.tar.gz`; original engine source and all bundled thirdparty source/notices are in `mupdf-1.28.2-source.tar.gz`. Neither is a GitHub archive missing submodules.

On Linux, extract both archives adjacent to each other, enter the PyMuPDF directory, and use its own supported build script with the local pinned MuPDF source:

    inputs_sdist=0 inputs_wheels_default=0 inputs_wheels_linux_pyodide=1 inputs_PYMUPDF_SETUP_MUPDF_BUILD=../mupdf-1.28.2-source python3 scripts/gh_release.py build

The exact release script delegates to `scripts/test.py -P 1 -m <local MuPDF> pyodide_wheel`. That script documents toolchain configuration and prepares the Pyodide build environment. Inspect its pinned toolchain before rebuilding; the served official wheel targets CPython 3.13 / PyEmscripten ABI 2025_0. Pyodide runtime 0.28.3 uses Python 3.13.2 and Emscripten 4.0.9. No source patches were applied to PyMuPDF/MuPDF. The application works around an XPS page-selection bug by converting all source pages before selecting pages in the output.

For reference: https://pymupdf.readthedocs.io/en/latest/pyodide.html . The official wheel has been tested with real XPS input; a full independent WebAssembly toolchain rebuild has NOT been claimed or performed.

## Pyodide 0.28.3

`pyodide-0.28.3-source.tar.gz` contains the matching source, MPL-2.0 license, C/Python/JavaScript code, CPython patches and its Makefiles. `pyodide-0.28.3.tgz` contains the exact npm runtime originally used. Follow the included README/development documentation and Makefile for a runtime rebuild. CPython/toolchain and package sources are specified by those build recipes; their licenses remain in their original distributions. No Pyodide source modifications were made.

## JavaScript PDF and ZIP dependencies

The source archive `javascript-dependency-sources.zip` contains exact npm source distributions and a manifest with registry integrity values/SHA-256, including pdf-lib 1.17.1, @pdf-lib/fontkit 1.1.1, @pdf-lib/standard-fonts 1.0.0, @pdf-lib/upng 1.0.1, pako 1.0.11, tslib 1.14.1 and fflate 0.8.3. Their original sources, notices and package recipes are retained. The frontend bundle is built from them with esbuild 0.28.2. Liberation Sans and its SIL OFL license are copied without modification. Retain the original dependency notices, including Apache-2.0 notices already embedded in fontkit's distribution.