Software Components, Libraries, and Licenses¶
Versions below are the declared constraints in go.mod and frontend/package.json. For resolved versions, consult go.sum and frontend/package-lock.json.
Backend (Go)¶
| Library | Version | Purpose | License |
|---|---|---|---|
| Go | 1.24.2 | Language runtime | BSD-3-Clause |
| gorilla/mux | 1.8.1 | HTTP router | BSD-3-Clause |
| go-sqlite3 | 1.14.24 | SQLite driver for MBTiles and GeoPackage | MIT |
| webview_go | untagged commit | Native desktop window | MIT |
| polyclip-go | 1.1.0 | Polygon union, intersection, difference | MIT |
| sevenzip | 1.6.1 | .7z data pack extraction | BSD-3-Clause |
| zenity | 0.10.14 | Native file dialogs | MIT |
| google/uuid | 1.6.0 | Site identifiers | BSD-3-Clause |
Dependency observations
webview_go is pinned to an untagged commit rather than a release. polyclip-go is a single-maintainer library on which all geometry correctness depends, and which the codebase treats as panic-prone (two recover() sites). go-sqlite3 is cgo-based and vendors the SQLite C amalgamation, so its CVE exposure is not visible to govulncheck at the Go level.
Frontend (TypeScript/React)¶
frontend/src/components at build time. | Library | Version | Purpose | License |
|---|---|---|---|
| React | 18.3 | UI framework | MIT |
| TypeScript | 5.7 | Type-safe JavaScript | Apache-2.0 |
| Chakra UI | 2.8 | Component library | MIT |
| Emotion | 11.13 | CSS-in-JS, required by Chakra | MIT |
| MapLibre GL JS | 4.7 | Map rendering engine | BSD-3-Clause |
| Framer Motion | 11.15 | Animation library | MIT |
| React Icons | 5.4 | Icon library | MIT |
| react-plotly.js | 2.6 | Chart rendering | MIT |
| turf | 7.3 | Client-side geometry operations | MIT |
| shpjs | 6.2 | Shapefile parsing for site upload | MIT |
| Vite | 6 | Build tool | MIT |
| Vitest | 2.1 | Test framework | MIT |
Dependencies expected to be removed
Several declared dependencies have no imports anywhere in frontend/src: deck.gl and @deck.gl/core, @deck.gl/layers, @deck.gl/mapbox, and fast-xml-parser. matter-js and @types/matter-js are required only by a physics hook that is never called.
@turf/turf is expected to go too, once the geometry operations it performs move to the Go backend where equivalent implementations already exist.
plotly.js is not a direct dependency — it is present only as react-plotly.js's peer, so its version is unpinned by package.json.
Tickets: Delete dead frontend code and unused dependencies, Move drawn-polygon catchment membership from turf to the existing Go implementation, Bundle and repository weight.
Desktop Runtime¶
| Platform | WebView Engine | License |
|---|---|---|
| Linux | WebKit2GTK 4.1 | LGPL-2.1 |
| macOS | WKWebView (system) | Apple EULA |
| Windows | Edge WebView2 | Microsoft EULA |
One WebKit version, one compatibility shim
Everything that builds the application targets WebKitGTK 4.1: the flake, CI, the Debian packaging and both container files. WebKit 4.0 is gone from current distributions, so building against it was borrowed time.
webview_go asks pkg-config for webkit2gtk-4.0 in a #cgo line with no build tag for 4.1, so a 4.1-only machine cannot compile it as-is. scripts/webkit-compat.sh derives a webkit2gtk-4.0.pc from the installed 4.1 one and exports the environment that points at it. The flake, CI and both Dockerfiles all go through that one script, so they resolve the dependency identically — and the binary links libwebkit2gtk-4.1.so regardless of the name pkg-config was asked for.
Build System¶
| Tool | Purpose | License |
|---|---|---|
| Nix | Reproducible builds | LGPL-2.1 |
| GitHub Actions | CI/CD | Proprietary |
| tippecanoe | Vector tile creation | BSD-2-Clause |
| GDAL | Geospatial data conversion | MIT |
| nfpm | .deb / .rpm packaging | MIT |
| Trivy | Vulnerability scanning in CI | Apache-2.0 |
| Gitleaks / TruffleHog | Secret scanning in CI | MIT / AGPL-3.0 |
Data Formats¶
| Format | Purpose | Specification |
|---|---|---|
| MBTiles | Vector tile storage | MBTiles Spec |
| GeoPackage | Scenario attribute data | GeoPackage Spec |
| MapLibre GL Style | Map styling | Style Spec |
| GeoJSON | Site boundaries, choropleth transport | RFC 7946 |
Project License¶
Decision Theatre is distributed under GPL-3.0.
No LICENSE file in the repository
GPL-3.0 is asserted in flake.nix, packaging/nfpm.yaml and the License page, but no LICENSE file exists at the repository root, and no source file carries an SPDX header. Ticket: No LICENSE file and no SPDX headers, though GPL-3.0 is asserted in three manifests.