grok-build-upstream-mirror/third_party/README.md

Third-party vendored crates

This directory holds upstream source vendored into the repository. It is not first-party application code.

Why vendor

These crates sit on the path that renders untrusted model output (diagram source → SVG). Vendoring gives a full audit surface, pins exact source, and avoids crates.io yanks. Local patches and upgrade checklists live in each crate’s Cargo.toml header comments — treat those as the source of truth when re-vendoring.

Mermaid layout stack

Crate	Version	License	Upstream	Full license text
mermaid-to-svg	(path)	MIT	warpdotdev/mermaid-to-svg	LICENSE
dagre_rust	0.0.5	Apache-2.0	r3alst/dagre-rust / Warp re-vendor	LICENCE
graphlib_rust	0.0.2	Apache-2.0	r3alst/graphlib-rust	LICENCE
ordered_hashmap	0.0.3	Apache-2.0	r3alst/ordered-hashmap	LICENCE

Dependency shape:

xai-grok-mermaid
  └── mermaid-to-svg          (MIT)
        ├── dagre_rust        (Apache-2.0)
        │     ├── graphlib_rust
        │     └── ordered_hashmap
        └── graphlib_rust     (Apache-2.0)
              └── ordered_hashmap

Notices and ancestry

• NOTICE — short index of the crates above (names, licenses, upstream links, paths to full text). Prefer that file for a one-page overview.
• mermaid-to-svg/THIRD_PARTY_NOTICES — additional ancestry for the SVG engine (e.g. mermaid.js, dagre.js MIT notices).

British spelling LICENCE is intentional on the Apache crates (as upstream vendored); grepping only for LICENSE will miss them.

crates.io dependencies

Normal Cargo dependencies (tokio, serde, …) are not under third_party/. They resolve via Cargo.lock / crates.io. Full attribution and license texts for the Grok CLI dependency closure are maintained in THIRD-PARTY-NOTICES.

This directory is only for in-tree vendored sources.

Upgrading

1. Read the VENDORING NOTES block at the top of the crate’s Cargo.toml.
2. Re-apply listed local patches (fmt, hermetic env, unsafe fixes, dropped bins/tests).
3. Confirm the license file still matches the declared license = field.
4. Refresh NOTICE if versions or upstream URLs change.