components.json

{
  "comment": "Source of truth for Jinja2C++'s third-party inventory (docs/tasks/0187). Edit this file, then run scripts/sbom.py to regenerate the CycloneDX and SPDX documents next to it; scripts/sbom.py --check (format-check CI) fails when they are stale, when a pin below no longer matches the build files, or when the build gains a dependency this file does not list. Vocabulary and the reasoning per component: docs/dependencies.md.",
  "schema": 1,
  "created": "2026-10-18T00:00:00Z",
  "root": {
    "id": "jinja2cpp",
    "name": "jinja2cpp",
    "license": "MPL-2.0",
    "url": "https://github.com/jinja2cpp/Jinja2Cpp",
    "purl_base": "pkg:github/jinja2cpp/jinja2cpp",
    "version_from": {"file": "CMakeLists.txt", "regex": "project\\(Jinja2Cpp VERSION ([0-9.]+)\\)"}
  },
  "components": [
    {
      "id": "expected-lite",
      "name": "expected-lite",
      "version": "0.10.0",
      "license": "BSL-1.0",
      "supplier": "Martin Moene (nonstd-lite)",
      "url": "https://github.com/nonstd-lite/expected-lite",
      "purl": "pkg:github/nonstd-lite/expected-lite@v0.10.0",
      "delivery": "fetched",
      "source": {"url": "https://github.com/nonstd-lite/expected-lite/archive/refs/tags/v0.10.0.tar.gz", "sha256": "cfe082e4ffedeeedac47763504102646a39c080599c7c1fe99299d6a1f99af92"},
      "role": "mandatory",
      "phases": ["build", "consumer-build"],
      "exposure": "public-api",
      "selected_by": "always",
      "conan": "expected-lite/0.9.0",
      "conan_why": "ConanCenter has expected-lite 0.9.0 at most (checked 2026-10-24); conan-build stays one version behind until 0.10.0 is published there",
      "used_for": "nonstd::expected behind jinja2::Result<T> in every Load/Render signature (include/jinja2cpp/template.h, template_env.h); make_unexpected in parsers and bindings",
      "why": "C++17 has no std::expected; the 2.0 API returns Result<T> (docs/api-2.0.md decision 4), and Clang 18 + libstdc++ at C++23 ships <expected> without std::expected",
      "lighten": "Keep until a C++23 floor. Header-only and small; could be vendored into include/ so consumers need nothing extra, at the cost of an ODR clash with a consumer's own expected-lite of another version",
      "evidence": [
        {"file": "thirdparty/internal_deps.cmake", "contains": ["expected-lite/archive/refs/tags/v0.10.0.tar.gz", "cfe082e4ffedeeedac47763504102646a39c080599c7c1fe99299d6a1f99af92"]},
        {"file": "conanfile.txt", "contains": ["expected-lite/0.9.0"]}
      ]
    },
    {
      "id": "fmt",
      "name": "fmt",
      "version": "12.2.0",
      "license": "MIT",
      "supplier": "Victor Zverovich and fmt contributors",
      "url": "https://github.com/fmtlib/fmt",
      "purl": "pkg:github/fmtlib/fmt@12.2.0",
      "delivery": "fetched",
      "source": {"url": "https://github.com/fmtlib/fmt/archive/refs/tags/12.2.0.tar.gz", "sha256": "8b852bb5aa6e7d8564f9e81394055395dd1d1936d38dfd3a17792a02bebd7af0"},
      "role": "mandatory",
      "phases": ["build", "consumer-link"],
      "exposure": "link",
      "selected_by": "always",
      "conan": "fmt/12.2.0",
      "used_for": "Python str.format / format filter and %-formatting (src/python_format.cpp, serialize_filters.cpp, value_methods.cpp), number-to-string, wide-string formatting (fmt/xchar.h), error messages (error_info.cpp), the string builder's memory_buffer",
      "why": "Python's format-spec mini-language with runtime format strings, precision-as-argument and wchar_t output; std::format is C++20 and the floor is C++17",
      "lighten": "Keep. Could be built header-only (FMT_HEADER_ONLY) to remove the link-time dependency of static consumers, at a compile-time cost; replace with std::format only at a C++20 floor (wide output and runtime specs still need checking)",
      "evidence": [
        {"file": "thirdparty/internal_deps.cmake", "contains": ["fmtlib/fmt/archive/refs/tags/12.2.0.tar.gz", "8b852bb5aa6e7d8564f9e81394055395dd1d1936d38dfd3a17792a02bebd7af0"]},
        {"file": "conanfile.txt", "contains": ["fmt/12.2.0"]}
      ]
    },
    {
      "id": "fast-float",
      "name": "fast_float",
      "version": "8.2.10",
      "license": "MIT OR Apache-2.0 OR BSL-1.0",
      "supplier": "Daniel Lemire and fast_float contributors",
      "url": "https://github.com/fastfloat/fast_float",
      "purl": "pkg:github/fastfloat/fast_float@v8.2.10",
      "delivery": "fetched",
      "source": {"url": "https://github.com/fastfloat/fast_float/archive/refs/tags/v8.2.10.tar.gz", "sha256": "76f958dd97b1cf4d8862d1f0986a47d4bdfa8845252bae15ef0f40de3b95961f"},
      "role": "mandatory",
      "phases": ["build"],
      "exposure": "internal",
      "selected_by": "always",
      "conan": "fast_float/8.2.10",
      "used_for": "Decimal-to-double conversion that ignores the C locale (src/decimal_number.cpp): float literals, the float and round filters, big integer to float, {% meta %} numbers (docs/tasks/0333)",
      "why": "strtod reads the decimal point of LC_NUMERIC, so a host under a decimal-comma locale read 1.5 as 1; std::from_chars for double is missing from older AppleClang libc++ (0083). Correctly rounded and header-only; libstdc++ 12 uses it for from_chars",
      "lighten": "Replace with std::from_chars once every supported standard library has it for double. Header-only and linked as a build interface, so neither the package nor static consumers see it",
      "evidence": [
        {"file": "thirdparty/internal_deps.cmake", "contains": ["fastfloat/fast_float/archive/refs/tags/v8.2.10.tar.gz", "76f958dd97b1cf4d8862d1f0986a47d4bdfa8845252bae15ef0f40de3b95961f"]},
        {"file": "conanfile.txt", "contains": ["fast_float/8.2.10"]}
      ]
    },
    {
      "id": "boost",
      "name": "boost",
      "version": "1.92.0",
      "license": "BSL-1.0",
      "supplier": "Boost.org",
      "url": "https://www.boost.org",
      "purl": "pkg:github/boostorg/boost@boost-1.92.0",
      "delivery": "fetched",
      "source": {"url": "https://github.com/boostorg/boost/releases/download/boost-1.92.0/boost-1.92.0-cmake.tar.xz", "sha256": "9bed76128d4e46755dbe818487788c6fceb6f72b378f4daa49b7e1e600d9088d"},
      "role": "alternative",
      "phases": ["test"],
      "exposure": "public-optional",
      "selected_by": "boost_json in JINJA2CPP_TEST_BINDINGS (default nlohmann_json) with JINJA2CPP_BUILD_TESTS: internal mode fetches the release for the Boost.JSON binding test and never installs it; external, external-boost and conan-build find a system Boost >= 1.75 (Conan: header-only) only when a Boost piece is selected. Consumers: the components jinja2cpp::boost_json and jinja2cpp::boost_multiprecision find it when requested (docs/tasks/0311)",
      "conan": "boost/1.91.0",
      "conan_why": "ConanCenter has Boost 1.91.0 at most (checked 2026-10-24); conanfile.txt takes it header_only, and Boost is only an optional adapter dependency and test-only (0230)",
      "transitive_libraries": ["assert", "compat", "config", "container", "container_hash", "core", "describe", "endian", "headers", "intrusive", "json", "move", "mp11", "predef", "system", "throw_exception", "variant2", "winapi"],
      "used_for": "The opt-in components only: Boost.JSON for the boost_json binding and its test, and Multiprecision with Config (boost-multiprecision, boost-config, fetched on their own) for the bigint=boost backend and the boost_multiprecision adapter. The library links no Boost and the core package never names it (0230 D7a); only a Boost component's own files find Boost (0311)",
      "why": "The components jinja2cpp::boost_json and jinja2cpp::boost_multiprecision (bindings/boost_*) are public opt-in API, so CI keeps testing them (bindings.yml)",
      "lighten": "Done (docs/tasks/0230): span, small_vector, intrusive_ptr, unique_any, iterator_facade, the string algorithms, endian, filesystem and Boost.JSON metadata parsing have own replacements; scripts/sbom.py --check keeps <boost/ out of every other file",
      "evidence": [
        {"file": "thirdparty/thirdparty-internal.cmake", "contains": ["boost-1.92.0/boost-1.92.0-cmake.tar.xz", "9bed76128d4e46755dbe818487788c6fceb6f72b378f4daa49b7e1e600d9088d", "set(BOOST_SKIP_INSTALL_RULES ON)"]},
        {"file": "conanfile.txt", "contains": ["boost/1.91.0", "boost/*:header_only=True"]}
      ],
      "also_roles": ["test"]
    },
    {
      "id": "boost-json",
      "parent": "boost",
      "name": "boost-json",
      "includes": ["boost/json.hpp", "boost/json/visit.hpp"],
      "role": "alternative",
      "phases": ["test"],
      "exposure": "public-optional",
      "selected_by": "component jinja2cpp::boost_json; fetched when JINJA2CPP_TEST_BINDINGS lists boost_json (bindings.yml does, the default jobs do not)",
      "used_for": "The opt-in component jinja2cpp::boost_json (bindings/boost_json/include/jinja2cpp/binding/boost_json.h) gives boost::json::value JsonTraits; only its consumers and its test (test/binding/boost_json_binding_test.cpp) link Boost.JSON. {% meta %} is read by src/json_reader.cpp since 0230 step D6",
      "why": "One of the shipped JSON bindings (docs/tasks/0311); users of other libraries write their own JsonTraits",
      "lighten": "Done: only its test fetches and links it (0230 D6, D7a)",
      "also_roles": ["test"]
    },
    {
      "id": "boost-multiprecision",
      "parent": "boost",
      "name": "boost-multiprecision",
      "includes": ["boost/multiprecision/cpp_int.hpp"],
      "role": "optional",
      "also_roles": ["test"],
      "phases": ["build", "test"],
      "exposure": "public-optional",
      "selected_by": "JINJA2CPP_WITH_BIGINT=boost (default none) compiles it into src/big_int_builtin.cpp; builds with tests ON build the adapter. Standalone mode (BOOST_MP_STANDALONE): boostorg/multiprecision and boostorg/config fetched on their own, or the headers of a Boost release the build already has (internal mode with boost_json in JINJA2CPP_TEST_BINDINGS, a found Boost::headers)",
      "used_for": "cpp_int behind the built-in big-integer backend (exact integer arithmetic beyond int64, docs/tasks/0272); the opt-in header-only component jinja2cpp::boost_multiprecision (bindings/boost_multiprecision/include/jinja2cpp/big_int/boost_cpp_int.h) is also the sample backend",
      "why": "A mature header-only arbitrary-precision integer; the library calls a backend only through the BigIntBackend table (include/jinja2cpp/big_int_backend.h), so any library can replace it at run time",
      "lighten": "Header-only, no link cost, off by default, and fetched on its own since 0230 D7a (docs/design/0178-big-integer-plan.md section 8)",
      "source": {"url": "https://github.com/boostorg/multiprecision/archive/refs/tags/boost-1.92.0.tar.gz", "sha256": "9da997843edd802f9d5e25d53872a7676330f31a52a5e47a418d1c94ba3b01d0"},
      "evidence": [{"file": "thirdparty/CMakeLists.txt", "contains": ["9da997843edd802f9d5e25d53872a7676330f31a52a5e47a418d1c94ba3b01d0"]}]
    },
    {
      "id": "boost-config",
      "parent": "boost",
      "name": "boost-config",
      "source": {"url": "https://github.com/boostorg/config/archive/refs/tags/boost-1.92.0.tar.gz", "sha256": "b4171037f13373203ba79cbc141d612982052283e696a315185ab5bea46102a0"},
      "role": "optional",
      "also_roles": ["test"],
      "phases": ["build", "test"],
      "exposure": "public-optional",
      "selected_by": "JINJA2CPP_WITH_BIGINT=boost (default none) compiles it into src/big_int_builtin.cpp; builds with tests ON build the adapter. Standalone mode (BOOST_MP_STANDALONE): boostorg/multiprecision and boostorg/config fetched on their own, or the headers of a Boost release the build already has (internal mode with boost_json in JINJA2CPP_TEST_BINDINGS, a found Boost::headers)",
      "used_for": "The configuration headers standalone Boost.Multiprecision needs besides its own",
      "why": "Multiprecision's only dependency in standalone mode",
      "lighten": "Goes with boost-multiprecision",
      "evidence": [{"file": "thirdparty/CMakeLists.txt", "contains": ["b4171037f13373203ba79cbc141d612982052283e696a315185ab5bea46102a0"]}]
    },
    {
      "id": "nlohmann-json",
      "name": "nlohmann_json",
      "version": "3.12.0",
      "license": "MIT",
      "supplier": "Niels Lohmann",
      "url": "https://github.com/nlohmann/json",
      "purl": "pkg:github/nlohmann/json@v3.12.0",
      "delivery": "fetched",
      "source": {"url": "https://github.com/nlohmann/json/archive/refs/tags/v3.12.0.tar.gz", "sha256": "4b92eb0c06d10683f7447ce9406cb97cd4b453be18d7279320f7b2f025c10187"},
      "role": "alternative",
      "also_roles": ["test"],
      "phases": ["build", "test"],
      "exposure": "public-optional",
      "selected_by": "component jinja2cpp::nlohmann_json, found when a consumer requests it; fetched whenever JINJA2CPP_BUILD_TESTS is ON (the default JINJA2CPP_TEST_BINDINGS, tests, parity corpus and bench read JSON with it)",
      "conan": "nlohmann_json/3.12.0",
      "used_for": "Opt-in component jinja2cpp::nlohmann_json (bindings/nlohmann_json/include/jinja2cpp/binding/nlohmann_json.h); test data (tojson, metadata, parity corpus) and bench case files",
      "why": "Header-only JSON binding, the one the default CI jobs test; the test suite's JSON reader",
      "lighten": "Header-only, no link cost; tests and adapter only"
    },
    {
      "id": "robin-hood-hashing",
      "name": "robin-hood-hashing",
      "version": "3.11.5",
      "license": "MIT",
      "supplier": "Martin Ankerl",
      "url": "https://github.com/martinus/robin-hood-hashing",
      "purl": "pkg:github/martinus/robin-hood-hashing@3.11.5",
      "delivery": "vendored",
      "files": ["src/robin_hood.h"],
      "modified": "try_emplace_transparent added (0118 P5b-3b); allocation through ::operator new/delete (0154); exception safety of inserts, growth and copies (0253); documented at src/robin_hood.h:41-51",
      "role": "mandatory",
      "phases": ["build"],
      "exposure": "internal",
      "selected_by": "always",
      "used_for": "InternalValueMap and scope tables (internal_value.h:1345, render_context.h), robin_hood::hash_bytes",
      "why": "Flat open-addressing map, measurably faster than std::unordered_map on the render paths",
      "lighten": "Upstream is archived and recommends its successor ankerl::unordered_dense (MIT); boost::unordered_flat_map is the other candidate while Boost stays. Not a size issue, a maintenance one (docs/tasks/0231)"
    },
    {
      "id": "lexertk",
      "name": "lexertk",
      "version": "NOASSERTION",
      "license": "MIT",
      "supplier": "Arash Partow",
      "url": "https://www.partow.net/programming/lexertk/index.html",
      "purl": "pkg:generic/lexertk?download_url=https://www.partow.net/programming/lexertk/index.html",
      "delivery": "vendored",
      "files": ["src/lexertk.h"],
      "modified": "Modified by Flex Ferrum (2018), changes not recorded (src/lexertk.h:6); upstream version not recorded",
      "role": "mandatory",
      "phases": ["build"],
      "exposure": "internal",
      "selected_by": "always",
      "used_for": "Expression tokenizer behind src/lexer.h, renderer.h and template_parser.h",
      "why": "Ready-made C-like tokenizer the expression parser was built on",
      "lighten": "Small and internal; keep. Long term it is effectively forked code and could be absorbed as project code with its notice kept"
    },
    {
      "id": "value-types",
      "name": "value_types",
      "version": "57f2e7a",
      "license": "MIT",
      "supplier": "The Value Types Authors (jbcoe)",
      "url": "https://github.com/jbcoe/value_types",
      "purl": "pkg:github/jbcoe/value_types@57f2e7a",
      "delivery": "vendored",
      "files": ["include/jinja2cpp/polymorphic_value/indirect_cxx14.h", "include/jinja2cpp/polymorphic_value/polymorphic_cxx14.h"],
      "modified": "both at upstream 57f2e7a, moved to namespace jinja2::v2::detail::xyz with JINJA2CPP_XYZ_ macros (0076); indirect: Clang incomplete-type fix (0edc34d), tag tested first (0072); polymorphic: default constructor constrained on the allocator for MSVC std::variant (0071), cb_ initialised (0089), in-place initializer_list constructor creates U, not T",
      "role": "mandatory",
      "phases": ["build", "consumer-build"],
      "exposure": "public-api",
      "selected_by": "always",
      "used_for": "polymorphic and indirect (jinja2::v2::detail::xyz) behind jinja2::types and jinja2::detail (value_ptr.h), used by Value, GenericList and GenericMap",
      "why": "Value-semantic owning pointers for the public value model; standardised as std::indirect/std::polymorphic in C++26",
      "lighten": "Keep (header-only, installed). Switch to std:: at a C++26 floor"
    },
    {
      "id": "unicode-data",
      "name": "Unicode Character Database (via Python unicodedata)",
      "version": "15.0.0",
      "license": "Unicode-3.0",
      "supplier": "Unicode, Inc.",
      "url": "https://www.unicode.org/Public/15.0.0/ucd/",
      "purl": "pkg:generic/unicode-ucd@15.0.0",
      "delivery": "generated",
      "files": ["src/unicode_printable.h", "src/unicode_tables.h", "src/unicode_case.h"],
      "generators": ["scripts/gen_unicode_printable.py", "scripts/gen_unicode_tables.py", "scripts/gen_unicode_case.py"],
      "role": "mandatory",
      "phases": ["build"],
      "exposure": "internal",
      "selected_by": "always",
      "used_for": "Code-point tables for str.isprintable/isalpha/..., upper/lower/title/casefold, int() digit handling",
      "why": "Python-identical string predicates and case mapping without ICU",
      "lighten": "Data only, no dependency at build time (Python is needed only to regenerate). Acquisition decision is still open in docs/tasks/0187 and 0186",
      "evidence": [
        {"file": "src/unicode_printable.h", "contains": ["Unicode 15.0.0"]},
        {"file": "src/unicode_tables.h", "contains": ["Unicode 15.0.0"]},
        {"file": "src/unicode_case.h", "contains": ["Unicode 15.0.0"]}
      ]
    },
    {
      "id": "html-entities",
      "name": "HTML5 named character references (via Python html.entities)",
      "version": "python-3.12",
      "license": "PSF-2.0",
      "supplier": "Python Software Foundation (table from the WHATWG HTML standard)",
      "url": "https://docs.python.org/3.12/library/html.entities.html",
      "purl": "pkg:generic/python-html-entities@3.12",
      "delivery": "generated",
      "files": ["src/html_entities.h"],
      "generators": ["scripts/gen_html_entities.py"],
      "role": "mandatory",
      "phases": ["build"],
      "exposure": "internal",
      "selected_by": "always",
      "used_for": "Entity table for MarkupSafe-compatible unescape/striptags",
      "why": "Same entity set as Python's html.unescape",
      "lighten": "Data only; keep",
      "evidence": [{"file": "src/html_entities.h", "contains": ["Python 3.12"]}]
    },
    {
      "id": "json-test-suite",
      "name": "JSONTestSuite",
      "version": "1ef36fa01286573e846ac449e8683f8833c5b26a",
      "license": "MIT",
      "supplier": "Nicolas Seriot",
      "url": "https://github.com/nst/JSONTestSuite",
      "purl": "pkg:github/nst/JSONTestSuite@1ef36fa01286573e846ac449e8683f8833c5b26a",
      "delivery": "generated",
      "files": ["test/json_test_suite_cases.inc"],
      "generators": ["scripts/json_test_suite.py"],
      "role": "test",
      "phases": ["test"],
      "exposure": "none",
      "selected_by": "JINJA2CPP_BUILD_TESTS",
      "used_for": "RFC 8259 conformance cases for the {% meta %} JSON reader (test/json_reader_test.cpp)",
      "why": "The reader parses template text that may be untrusted (docs/tasks/0230, step D6)",
      "lighten": "Test data only, generated into one table from a pinned revision",
      "evidence": [{"file": "test/json_test_suite_cases.inc", "contains": ["JSONTestSuite 1ef36fa01286573e846ac449e8683f8833c5b26a"]}]
    },
    {
      "id": "googletest",
      "name": "googletest",
      "version": "v1.18.0",
      "license": "BSD-3-Clause",
      "supplier": "Google",
      "url": "https://github.com/google/googletest",
      "purl": "pkg:github/google/googletest@v1.18.0",
      "delivery": "fetched",
      "source": {"url": "https://github.com/google/googletest/archive/refs/tags/v1.18.0.tar.gz", "sha256": "6e3191c1455468b3fc35a417fb565c1c5071aee1b7e7f85e30cf48a98d37d8b5"},
      "role": "test",
      "phases": ["test"],
      "exposure": "none",
      "selected_by": "JINJA2CPP_BUILD_TESTS (ON for the main project); a system GTest is preferred",
      "used_for": "The jinja2cpp_tests binary",
      "why": "Unit and corpus tests",
      "lighten": "Test-only. Fetched as an archive pinned by SHA-256",
      "evidence": [{"file": "thirdparty/CMakeLists.txt", "contains": ["googletest/archive/refs/tags/v1.18.0.tar.gz", "6e3191c1455468b3fc35a417fb565c1c5071aee1b7e7f85e30cf48a98d37d8b5", "INSTALL_GTEST OFF"]}]
    },
    {
      "id": "google-benchmark",
      "name": "benchmark",
      "version": "v1.9.5",
      "license": "Apache-2.0",
      "supplier": "Google",
      "url": "https://github.com/google/benchmark",
      "purl": "pkg:github/google/benchmark@v1.9.5",
      "delivery": "fetched",
      "source": {"url": "https://github.com/google/benchmark/archive/refs/tags/v1.9.5.tar.gz", "sha256": "9631341c82bac4a288bef951f8b26b41f69021794184ece969f8473977eaa340"},
      "role": "optional",
      "phases": ["dev"],
      "exposure": "none",
      "selected_by": "JINJA2CPP_BUILD_BENCHMARKS (OFF)",
      "used_for": "bench/ suite",
      "why": "Performance tracking against Python Jinja2 and the baseline",
      "lighten": "Dev-only. Fetched as an archive pinned by SHA-256",
      "evidence": [{"file": "thirdparty/CMakeLists.txt", "contains": ["benchmark/archive/refs/tags/v1.9.5.tar.gz", "9631341c82bac4a288bef951f8b26b41f69021794184ece969f8473977eaa340"]}]
    },
    {
      "id": "inja",
      "name": "inja",
      "version": "v3.5.0",
      "license": "MIT",
      "supplier": "Lars Berscheid",
      "url": "https://github.com/pantor/inja",
      "purl": "pkg:github/pantor/inja@7d1b4600b68595085a949743331c2e5673f511ea",
      "delivery": "fetched",
      "source": {"git": "https://github.com/pantor/inja.git", "commit": "7d1b4600b68595085a949743331c2e5673f511ea"},
      "role": "optional",
      "phases": ["dev"],
      "exposure": "none",
      "selected_by": "JINJA2CPP_BENCH_WITH_OTHER_ENGINES (OFF)",
      "used_for": "engines_bench comparison",
      "why": "Competitor benchmark",
      "lighten": "Dev-only",
      "evidence": [{"file": "bench/CMakeLists.txt", "contains": ["7d1b4600b68595085a949743331c2e5673f511ea"]}]
    },
    {
      "id": "minja",
      "name": "minja",
      "version": "143465ab2f924f7729a8ca5313a12fb83a106d6d",
      "license": "MIT",
      "supplier": "Olivier Chafik",
      "url": "https://github.com/ochafik/minja",
      "purl": "pkg:github/ochafik/minja@143465ab2f924f7729a8ca5313a12fb83a106d6d",
      "delivery": "fetched",
      "source": {"git": "https://github.com/ochafik/minja.git", "commit": "143465ab2f924f7729a8ca5313a12fb83a106d6d"},
      "role": "optional",
      "phases": ["dev"],
      "exposure": "none",
      "selected_by": "JINJA2CPP_BENCH_WITH_OTHER_ENGINES (OFF)",
      "used_for": "engines_bench comparison",
      "why": "Competitor benchmark",
      "lighten": "Dev-only",
      "evidence": [{"file": "bench/CMakeLists.txt", "contains": ["143465ab2f924f7729a8ca5313a12fb83a106d6d"]}]
    },
    {
      "id": "minijinja",
      "name": "minijinja",
      "version": "2.24",
      "license": "Apache-2.0",
      "supplier": "Armin Ronacher",
      "url": "https://github.com/mitsuhiko/minijinja",
      "purl": "pkg:cargo/minijinja@2.24",
      "delivery": "fetched",
      "source": {"cargo": "bench/rust/Cargo.lock"},
      "role": "optional",
      "phases": ["dev"],
      "exposure": "none",
      "selected_by": "JINJA2CPP_BENCH_WITH_RUST_ENGINES (OFF); with minijinja-contrib, serde, serde_json, regex, libc locked in bench/rust/Cargo.lock",
      "used_for": "rust_engines_bench comparison",
      "why": "Competitor benchmark",
      "lighten": "Dev-only",
      "evidence": [{"file": "bench/rust/Cargo.toml", "contains": ["minijinja = { version = \"2.24\""]}]
    },
    {
      "id": "tera",
      "name": "tera",
      "version": "2.4",
      "license": "MIT",
      "supplier": "Vincent Prouillet",
      "url": "https://github.com/Keats/tera",
      "purl": "pkg:cargo/tera@2.4",
      "delivery": "fetched",
      "source": {"cargo": "bench/rust/Cargo.lock"},
      "role": "optional",
      "phases": ["dev"],
      "exposure": "none",
      "selected_by": "JINJA2CPP_BENCH_WITH_RUST_ENGINES (OFF)",
      "used_for": "rust_engines_bench comparison",
      "why": "Competitor benchmark",
      "lighten": "Dev-only",
      "evidence": [{"file": "bench/rust/Cargo.toml", "contains": ["tera = \"2.4\""]}]
    },
    {
      "id": "gperftools",
      "name": "gperftools",
      "version": "NOASSERTION",
      "license": "BSD-3-Clause",
      "supplier": "gperftools contributors",
      "url": "https://github.com/gperftools/gperftools",
      "purl": "pkg:github/gperftools/gperftools",
      "delivery": "system",
      "role": "optional",
      "phases": ["dev"],
      "exposure": "none",
      "selected_by": "JINJA2CPP_BENCH_WITH_GPERFTOOLS (OFF), found by pkg-config",
      "used_for": "CPU and heap profiles of benchmarks",
      "why": "Profiling",
      "lighten": "Dev-only",
      "evidence": [{"file": "bench/CMakeLists.txt", "contains": ["libprofiler libtcmalloc"]}]
    },
    {
      "id": "python-jinja2",
      "name": "Jinja2",
      "version": "3.1.6",
      "license": "BSD-3-Clause",
      "supplier": "Pallets",
      "url": "https://github.com/pallets/jinja",
      "purl": "pkg:pypi/jinja2@3.1.6",
      "delivery": "system",
      "role": "test",
      "phases": ["dev"],
      "exposure": "none",
      "selected_by": "pip install -r test/parity/requirements.txt (parity, fuzz differential and benchmark CI jobs)",
      "used_for": "The behavioural oracle: regenerates test/parity expectations (generate.py), differential fuzzing, Python side of bench/",
      "why": "Parity with Python Jinja2 is the project goal; the expectations it produces are committed, so ordinary builds do not need it",
      "lighten": "Not part of any build",
      "evidence": [{"file": "test/parity/requirements.txt", "contains": ["jinja2==3.1.6"]}]
    },
    {
      "id": "python-markupsafe",
      "name": "MarkupSafe",
      "version": "3.0.3",
      "license": "BSD-3-Clause",
      "supplier": "Pallets",
      "url": "https://github.com/pallets/markupsafe",
      "purl": "pkg:pypi/markupsafe@3.0.3",
      "delivery": "system",
      "role": "test",
      "phases": ["dev"],
      "exposure": "none",
      "selected_by": "pip install -r test/parity/requirements.txt",
      "used_for": "Jinja2's escaping dependency, pinned with it",
      "why": "Transitive dependency of the oracle",
      "lighten": "Not part of any build",
      "evidence": [{"file": "test/parity/requirements.txt", "contains": ["markupsafe==3.0.3"]}]
    },
    {
      "id": "python",
      "name": "CPython",
      "version": "3.12",
      "license": "PSF-2.0",
      "supplier": "Python Software Foundation",
      "url": "https://www.python.org",
      "purl": "pkg:generic/cpython@3.12",
      "delivery": "system",
      "role": "tooling",
      "phases": ["dev"],
      "exposure": "none",
      "selected_by": "CI (actions/setup-python 3.12) and developers; not needed to build or install",
      "used_for": "Oracle runs, table generators (ORACLE_PYTHON 3.12), task and preflight scripts, bench drivers, this SBOM generator",
      "why": "Project tooling language",
      "lighten": "Not part of any build",
      "evidence": [{"file": ".github/workflows/parity-expectations.yml", "contains": ["3.12"]}]
    },
    {
      "id": "clang-tidy",
      "name": "clang-tidy (PyPI wheel)",
      "version": "22.1.8",
      "license": "Apache-2.0 WITH LLVM-exception",
      "supplier": "LLVM Project",
      "url": "https://pypi.org/project/clang-tidy/",
      "purl": "pkg:pypi/clang-tidy@22.1.8",
      "delivery": "system",
      "role": "tooling",
      "phases": ["dev"],
      "exposure": "none",
      "selected_by": "clang-tidy CI job and scripts/preflight.sh",
      "used_for": "Static analysis gate (docs/tasks/0054)",
      "why": "Code quality",
      "lighten": "Not part of any build",
      "evidence": [{"file": ".github/workflows/clang-tidy.yml", "contains": ["22.1.8"]}]
    },
    {
      "id": "pyyaml",
      "name": "PyYAML",
      "version": "NOASSERTION",
      "license": "MIT",
      "supplier": "PyYAML contributors",
      "url": "https://github.com/yaml/pyyaml",
      "purl": "pkg:pypi/pyyaml",
      "delivery": "system",
      "role": "tooling",
      "phases": ["dev"],
      "exposure": "none",
      "selected_by": "clang-tidy CI job (unpinned) and scripts/clang_tidy_fix.py",
      "used_for": "Reading clang-tidy fix-it YAML",
      "why": "Tooling",
      "lighten": "Not part of any build. Unpinned in CI",
      "evidence": [{"file": ".github/workflows/clang-tidy.yml", "contains": ["pyyaml"]}]
    },
    {
      "id": "clang-format",
      "name": "clang-format",
      "version": "18",
      "license": "Apache-2.0 WITH LLVM-exception",
      "supplier": "LLVM Project",
      "url": "https://clang.llvm.org/docs/ClangFormat.html",
      "purl": "pkg:generic/clang-format@18",
      "delivery": "system",
      "role": "tooling",
      "phases": ["dev"],
      "exposure": "none",
      "selected_by": "format-check CI job (apt clang-format-18)",
      "used_for": "Formatting gate",
      "why": "Code style",
      "lighten": "Not part of any build",
      "evidence": [{"file": ".github/workflows/format-check.yml", "contains": ["clang-format-18"]}]
    },
    {
      "id": "libabigail",
      "name": "libabigail (abigail-tools)",
      "version": "2.4",
      "license": "Apache-2.0 WITH LLVM-exception",
      "supplier": "Red Hat / sourceware.org",
      "url": "https://sourceware.org/libabigail/",
      "purl": "pkg:generic/libabigail@2.4",
      "delivery": "system",
      "role": "tooling",
      "phases": ["ci"],
      "exposure": "none",
      "selected_by": "linux-build CI abi rows (apt abigail-tools, Ubuntu 24.04)",
      "used_for": "ABI dump and comparison of the shared library (abidw, abidiff)",
      "why": "SOVERSION policy gate (docs/tasks/0076)",
      "lighten": "Not part of any build",
      "evidence": [{"file": ".github/workflows/linux-build.yml", "contains": ["abigail-tools"]}]
    },
    {
      "id": "cmake",
      "name": "CMake",
      "version": "3.23",
      "license": "BSD-3-Clause",
      "supplier": "Kitware",
      "url": "https://cmake.org",
      "purl": "pkg:generic/cmake@3.23",
      "delivery": "system",
      "role": "tooling",
      "phases": ["build"],
      "exposure": "none",
      "selected_by": "always (minimum 3.23, policy range up to 4.0)",
      "used_for": "Build system, FetchContent, install/export",
      "why": "Build system",
      "lighten": "Required to build",
      "evidence": [{"file": "CMakeLists.txt", "contains": ["cmake_minimum_required(VERSION 3.23.0..4.0)"]}]
    },
    {
      "id": "conan",
      "name": "Conan",
      "version": ">=2.0,<3",
      "license": "MIT",
      "supplier": "JFrog",
      "url": "https://conan.io",
      "purl": "pkg:pypi/conan",
      "delivery": "system",
      "role": "optional",
      "phases": ["build"],
      "exposure": "none",
      "selected_by": "JINJA2CPP_DEPS_MODE=conan-build",
      "used_for": "Supplies the dependencies listed in conanfile.txt",
      "why": "Package-manager build mode",
      "lighten": "Optional",
      "evidence": [{"file": ".github/workflows/conan-build.yml", "contains": ["conan>=2.0,<3"]}]
    },
    {
      "id": "lars-bilke-codecoverage",
      "name": "CodeCoverage.cmake (Lars Bilke)",
      "version": "NOASSERTION",
      "license": "BSD-3-Clause",
      "supplier": "Lars Bilke",
      "url": "https://github.com/bilke/cmake-modules",
      "purl": "pkg:github/bilke/cmake-modules",
      "delivery": "vendored",
      "files": ["cmake/code_coverage.cmake"],
      "role": "redundant",
      "phases": ["dev"],
      "exposure": "none",
      "selected_by": "never: no CMake file includes it (cmake/coverage.cmake is the module in use)",
      "used_for": "Nothing",
      "why": "Left over from before cmake/coverage.cmake",
      "lighten": "Delete (owned by docs/tasks/0010, which lists the file in its touches)"
    },
    {"id": "gha-checkout", "name": "actions/checkout", "version": "v4.4.0", "license": "MIT", "supplier": "GitHub", "url": "https://github.com/actions/checkout", "purl": "pkg:githubactions/actions/checkout@v4.4.0", "delivery": "ci", "role": "tooling", "phases": ["ci"], "exposure": "none", "action": "actions/checkout", "sha": "11d5960a326750d5838078e36cf38b85af677262", "used_for": "CI", "why": "CI", "lighten": "Pinned by commit SHA with the release tag in a comment"},
    {"id": "gha-setup-python", "name": "actions/setup-python", "version": "v5.6.0", "license": "MIT", "supplier": "GitHub", "url": "https://github.com/actions/setup-python", "purl": "pkg:githubactions/actions/setup-python@v5.6.0", "delivery": "ci", "role": "tooling", "phases": ["ci"], "exposure": "none", "action": "actions/setup-python", "sha": "a26af69be951a213d495a4c3e4e4022e16d87065", "used_for": "CI", "why": "CI", "lighten": "Pinned by commit SHA with the release tag in a comment"},
    {"id": "gha-upload-artifact", "name": "actions/upload-artifact", "version": "v4.6.2", "license": "MIT", "supplier": "GitHub", "url": "https://github.com/actions/upload-artifact", "purl": "pkg:githubactions/actions/upload-artifact@v4.6.2", "delivery": "ci", "role": "tooling", "phases": ["ci"], "exposure": "none", "action": "actions/upload-artifact", "sha": "ea165f8d65b6e75b540449e92b4886f43607fa02", "used_for": "CI", "why": "CI", "lighten": "Pinned by commit SHA with the release tag in a comment"},
    {"id": "gha-cache", "name": "actions/cache", "version": "v4.3.0", "license": "MIT", "supplier": "GitHub", "url": "https://github.com/actions/cache", "purl": "pkg:githubactions/actions/cache@v4.3.0", "delivery": "ci", "role": "tooling", "phases": ["ci"], "exposure": "none", "action": "actions/cache", "sha": "0057852bfaa89a56745cba8c7296529d2fc39830", "action_aliases": ["actions/cache/restore", "actions/cache/save"], "used_for": "CI", "why": "CI", "lighten": "Pinned by commit SHA with the release tag in a comment"},
    {"id": "gha-codeql", "name": "github/codeql-action", "version": "v4.39.1", "license": "MIT", "supplier": "GitHub", "url": "https://github.com/github/codeql-action", "purl": "pkg:githubactions/github/codeql-action@v4.39.1", "delivery": "ci", "role": "tooling", "phases": ["ci"], "exposure": "none", "action": "github/codeql-action/init", "sha": "9b3254085494b55a0f7c4c2b3d2d52cc712ce370", "action_aliases": ["github/codeql-action/analyze"], "used_for": "CodeQL analysis", "why": "CI", "lighten": "Pinned by commit SHA with the release tag in a comment"},
    {"id": "gha-ccache-action", "name": "hendrikmuhs/ccache-action", "version": "v1.2.24", "license": "MIT", "supplier": "Hendrik Muhs", "url": "https://github.com/hendrikmuhs/ccache-action", "purl": "pkg:githubactions/hendrikmuhs/ccache-action@v1.2.24", "delivery": "ci", "role": "tooling", "phases": ["ci"], "exposure": "none", "action": "hendrikmuhs/ccache-action", "sha": "f09c25b45002a07be2955cbe52e8cee55643f89d", "used_for": "Compiler cache in CI (.github/actions/setup-ccache)", "why": "CI", "lighten": "Pinned by commit SHA with the release tag in a comment; third-party, runs with the workflow token"},
    {"id": "gha-msvc-dev-cmd", "name": "ilammy/msvc-dev-cmd", "version": "v1.13.0", "license": "MIT", "supplier": "ilammy", "url": "https://github.com/ilammy/msvc-dev-cmd", "purl": "pkg:githubactions/ilammy/msvc-dev-cmd@v1.13.0", "delivery": "ci", "role": "tooling", "phases": ["ci"], "exposure": "none", "action": "ilammy/msvc-dev-cmd", "sha": "0b201ec74fa43914dc39ae48a89fd1d8cb592756", "used_for": "MSVC environment on Windows runners", "why": "CI", "lighten": "Pinned by commit SHA with the release tag in a comment; third-party, runs with the workflow token"}
  ]
}