Dependencies

Firefox vendors most of its third-party code. This page is a quick map.

Top-level Rust workspace (Cargo.toml)

The workspace defines ~25 root members spread across browser/, netwerk/, security/, testing/, and toolkit/. Their transitive Rust dependencies are vendored under third_party/rust/. See packages/rust-crates.md.

NPM (package.json)

Dev-only dependencies for linting and formatting. Notable:

• eslint (+ Mozilla's own plugin under tools/lint/eslint/eslint-plugin-mozilla/)
• prettier, stylelint
• eslint-plugin-import, eslint-plugin-html, eslint-plugin-jsdoc, eslint-plugin-jsx-a11y, eslint-plugin-lit, eslint-plugin-no-unsanitized, eslint-plugin-promise, eslint-plugin-react, eslint-plugin-react-hooks, eslint-plugin-spidermonkey-js
• @microsoft/eslint-plugin-sdl — security lint rules
• license-checker-rseidelsohn
• jsdoc

Mozilla does not use npm for runtime dependencies.

Python (pyproject.toml)

Python deps are vendored under third_party/python/. The pyproject.toml configures Ruff (lint) and other tooling. Build-system Python lives in python/mozbuild/, python/mach/, python/mozboot/, and elsewhere.

Major C/C++ vendored libraries

(Non-exhaustive; see packages/third-party.md)

• NSS (TLS/crypto)
• Skia, Cairo (graphics)
• HarfBuzz, ICU (text/i18n)
• ANGLE (WebGL on Windows)
• libwebrtc (WebRTC)
• libdav1d, libavif, libvpx, libopus, libvorbis, libtheora (codecs)
• libcubeb (audio)
• Hunspell (spellcheck)
• Chromium sandbox lib (Windows sandbox)

Audit policy

Rust uses cargo-vet with config in supply-chain/. C/C++ dependencies are gated by manual review (mots-listed module owners).

Related

• Build system
• Packages