JonKazama-Hellion
6e24885241
Removing BetterTTV took out the plugin's only outbound network call, and five documents were still describing it as present. PRIVACY.md led with "one outbound network call exists by design" -- the opposite of what shipped an hour ago, and the one claim in that file people actually check. PRIVACY.md now opens with none at all. The section that described the call is kept and marked as removed rather than deleted, so the claim can be read against what it replaced: the startup fetch meant BetterTTV saw an IP as soon as the plugin loaded, whether an emote ever appeared or not. Worth leaving visible. BetterTTV also comes out of the third-party table, which now lists only the two parties nobody using this plugin through Dalamud can avoid. SECURITY.md listed the EmoteCache HTTP client as in scope for reports. There is nothing there to report on. THIRD_PARTY_NOTICES.md named the call as current; both entries it has ever carried are now historical. README dropped the pointer to the outbound call and the switch for it, a stability bullet about a crash fix in code that no longer exists, and the line in the Chat 2 migration that moved an emote cache directory nothing reads. ROADMAP gained 2.0.1 and 2.0.2, and a section for what the 2.0.0 push left behind: 47 overlong comment blocks, channel names translated in only ten of the 25 languages, an orphaned EmoteCacheV1 directory on anyone who ran an older build, and the deprecated GlobalScaleSafe call that is the last compiler warning in the build.
8.1 KiB
Third-party notices
HellionChat ships and depends on a number of third-party components. This document lists them, their
licences and which of them touch the network. It is the inventory referenced by PRIVACY.md.
Last reviewed: 2026-05-05 (HellionChat v1.1.0).
Direct NuGet dependencies
Pinned in HellionChat/HellionChat.csproj. Versions reflect the v1.1.0 build.
| Package | Version | Licence | Network | Purpose |
|---|---|---|---|---|
| MessagePack | 3.1.4 | MIT | no | Binary serialisation for the SQLite message store. |
| Microsoft.Data.Sqlite | 10.0.7 | MIT | no | Local SQLite access for the message database. |
| morelinq | 4.4.0 | Apache-2.0 | no | LINQ helper extensions. |
| Pidgin | 3.5.1 | MIT | no | Parser combinator library used for chat-input parsing. CIString Unicode fix relevant for non-ASCII channel/tab names. |
| SixLabors.ImageSharp | 3.1.12 | Six Labors Split License 1.0 (OSI-approved; free for open-source / non-commercial use, commercial licence required for closed-source commercial use) | no | Image decoding for cached emotes. |
| SQLitePCLRaw.lib.e_sqlite3 | 3.50.3 | MIT | no | Native SQLite binary, explicitly pinned to override the transitive default for CVE-2025-6965 (memory corruption from aggregate-term overflow) and CVE-2025-7709. |
Six Labors note: HellionChat is an EUPL-1.2-licensed open-source project distributed at no cost. Use of ImageSharp 3.x under the Six Labors Split License 1.0 is permitted on that basis. Anyone forking HellionChat for closed-source or commercial redistribution should review the Six Labors licence terms and obtain a commercial licence if required.
SDK and tooling
| Component | Licence | Notes |
|---|---|---|
| Dalamud.NET.Sdk 15.0.0 | AGPL-3.0 (Dalamud) / SDK terms per goatcorp | Plugin SDK; pulls in DalamudPackager 15.0.0. |
| .NET 10 SDK | MIT | Build toolchain. |
Bundled assets
| Asset | Licence | Source |
|---|---|---|
Exo 2 (HellionFont.ttf) |
SIL Open Font License 1.1 | Google Fonts / Natanael Gama. The OFL licence text travels embedded next to the font (HellionFont-OFL.txt) to satisfy the "licence must be distributed with the font" clause. |
Hellion plugin icon (images/icon.png) |
© Hellion Media, included under the project licence (EUPL-1.2). | Original artwork. |
Upstream code
HellionChat is a fork of Chat 2 by Infiziert90 (Infi) and
Anna Clemens, also licensed under EUPL-1.2. The bulk of the code, including the message store
architecture, the channel logic, the hook system and the ImGui chat window, originates from
upstream. See ../NOTICE.md for the attribution; UPSTREAM_SYNC.md documents the upstream-sync
history, including the close of active cherry-picking in the v1.4.x cycle.
Components that touch the network
Of everything listed above, none of the bundled or NuGet components opens network connections on their own, and as of v2.0.2 neither does HellionChat itself. Both calls this list used to name are gone:
HellionChat/EmoteCache.cs→ BetterTTV API + CDN, removed in v2.0.2 along with the emote feature.- The Square Enix Lodestone font download (
FontManager.cs), removed in v1.0.4 — a leftover from upstream's removed webinterface feature that was no longer consumed.
Verifying this list
To regenerate the dependency inventory after a version bump:
dotnet list HellionChat.sln package --include-transitive
The "direct NuGet dependencies" table above only lists direct references. Transitive dependencies pulled in by Dalamud SDK or by the listed packages are covered by the SDK / package licences and documented by their respective maintainers.
To re-audit the network-call inventory:
grep -rn -E "HttpClient|HttpRequest|new Uri\(|https?://" \
--include="*.cs" HellionChat/
Any new hit that is not a click-through (Util.OpenLink) or a payload-parsing call must be added to
PRIVACY.md before release.