# Third-party notices

The Core plugin contains pinned, self-hosted third-party files. Browser assets
are loaded locally rather than from a CDN. The Forms module does not use a
CAPTCHA account or an external verification API.

## ALTCHA Widget 3.2.1

- Source: <https://github.com/altcha-org/altcha/tree/v3.2.1>
- Release commit: `156bb306827fcbf5e3d8677ba4653e7ed9659ec3`
- License: MIT (`licenses/ALTCHA-WIDGET-MIT.txt`)
- Included files: `assets/vendor/altcha/altcha.min.js`, `altcha.css`, the
  German localization and the PBKDF2 worker.

Provenance status: The release tag and commit are identified, but the
repository does not currently retain the acquired upstream archive and its
checksum or a checksum record binding the four local browser files to that
archive.

## ALTCHA PHP Library 2.1.0

- Source: <https://github.com/altcha-org/altcha-lib-php/tree/v2.1.0>
- Release commit: `63038786ae51b572f8f1de5a29079bea5971dd84`
- License: MIT (`licenses/ALTCHA-PHP-MIT.txt`)
- Runtime requirement: PHP 8.1 or newer.

The namespace is mechanically prefixed with `OnePageSecureFormVendor\` to
avoid conflicts with other WordPress plugins. The complete library remains
locally vendored and pinned.

Provenance status: The release tag and commit are identified, but the
repository does not currently retain an acquired upstream archive checksum or
a positive checksum and transformation record for the namespace-prefixed
vendor tree.

## Svelte runtime 5.55.8

The compiled ALTCHA browser distribution contains Svelte runtime code.

- Source: <https://github.com/sveltejs/svelte/tree/svelte%405.55.8>
- Release commit: `f9440dc3ed28a9f1f518b0216d0e10fce00f1618`
- License: MIT (`licenses/SVELTE-MIT.txt`)

Provenance status: The release tag and commit are identified, but no retained
lock or build record independently binds the compiled runtime in the local
ALTCHA bundle to this exact Svelte version.

## CookieConsent 3.1.0

- Package: `vanilla-cookieconsent@3.1.0`
- Source: <https://github.com/orestbida/cookieconsent/releases/tag/v3.1.0>
- Source commit: `e6279509aab5b96be198297b0283b321ad76b0a9`
- License: MIT (`assets/vendor/cookieconsent/3.1.0/LICENSE`)
- Included files: `cookieconsent.css`, `cookieconsent.umd.js`, `package.json`,
  the license, and the provenance and integrity records.
- Provenance: `assets/vendor/cookieconsent/3.1.0/UPSTREAM.md` and
  `assets/vendor/cookieconsent/3.1.0/SHA256SUMS`
- npm tarball SHA-256:
  `1d106b5f433b60d945dfed4c54f5535a8f61a30f2559b3f7548ed79e482aa4b6`