NWBLot vendors third-party source under 3rd_parties/ as flat, offline packages. The repository owns dependency registration, platform gates, warning policy, runtime-library matching, and any local integration patches.

• Each package is one direct child of 3rd_parties/.
• A package does not retain nested copies under external/, imported/, third_party/, or similar directories.
• Shared dependencies are lifted into their own top-level package and reused by every consumer.
• 3rd_parties/CMakeLists.txt registers packages in dependency order.
• Configure and build steps do not download source.

Every package has an nwb_update.txt containing:

• package
• version
• updated_utc
• source
• optional integration notes

Those files are the authoritative package/version inventory. Read the package's current metadata instead of copying a version table into documentation:

Get-Content 3rd_parties/<package>/nwb_update.txt

Update the metadata in the same change as any refreshed source, patch, pruned subtree, or integration adjustment.

The source field names the package’s own official upstream release, repository, or SDK. It must not point at the parent project’s nested third_party, external, or imported snapshot from which the package was first discovered. When lifting a bundled dependency, re-vendor it from its official source and record any retained NWBLot integration patch in notes.

If duplicate vendored copies exist, keep one top-level package. When their versions differ, retain the newer version and update consumers to use it rather than preserving an older nested copy for compatibility. This keeps the visible package inventory, security/update path, and CMake target graph unambiguous.

Vendored CMake is adapted to the repository:

• remove FetchContent, downloads, and nested dependency builds
• link shared top-level dependency targets
• expose package includes through explicit targets
• use nwb_disable_vendor_warnings(<target>)
• use nwb_match_engine_runtime(<target>) for static C/C++ libraries linked into engine binaries
• keep platform- or architecture-specific flags behind explicit CMake conditions
• copy optional runtime libraries only when a supported binary exists

nwb_match_engine_runtime maps the engine's dbg, opt, and fin configurations to the matching Windows runtime and debug macro contract without applying first-party warning, RTTI, or exception policy to vendor code.

Architecture support is evaluated package by package.

• NVIDIA Aftermath ships runtime binaries for Windows x64 and Linux x64. Its CMake target remains header-available, while ARM64 builds omit NWB_WITH_AFTERMATH and do not copy a runtime.
• Windows oneTBB builds on x64 and ARM64. ITT notification, RTM, and WAITPKG compile settings are enabled only for x64; ARM64 uses the portable source path.
• Linux still links the system TBB runtime (tbb and tbbmalloc), but consumers include the vendored header tree so NWB-local allocator patches apply. Read 3rd_parties/oneTBB/nwb_update.txt for the current patch notes.
• Vendor SIMD flags must be gated by NWB_OUTPUT_ARCH and the compiler capability. An x64 flag must never leak into an ARM64 target.
• Optional vendor diagnostics remain optional at runtime and must not make adapter initialization depend on a vendor-specific GPU.

curl is the log-client HTTP transport. oneTBB supplies the scalable allocator used by CoreAlloc. Windows compiles the vendored TBB sources; Linux links the system TBB runtime against the vendored headers. Record NWB-local patches in each package's nwb_update.txt instead of copying versions into this page.

vulkan_headers provides the canonical vendored Vulkan headers and is exposed as nwb::vulkan_headers. volk supplies loader sources and links those headers publicly. A Vulkan SDK is therefore not required for compilation, though it remains useful for slangc, validation layers, and diagnostic tools.

VulkanMemoryAllocator is a separate top-level package. Renderer capability policy is implemented by engine code rather than by package-specific CPU architecture assumptions.

basis_universal is built as an offline static wrapper for the encoder/transcoder sources used by tex_conv. Its lifted dependencies such as QOI, TinyEXR, TinyDDS, miniz, and zstd are consumed from their top-level packages. Optional integrations that are not used by the converter stay disabled.

1. Read the package's nwb_update.txt and current CMake target.
2. Fetch the exact upstream release, tag, or commit recorded for the update.
3. Keep only the source, headers, licenses, and runtime binaries required by NWBLot.
4. Flatten bundled dependencies and reuse existing top-level packages.
5. Update CMake wiring, platform gates, and local compatibility patches.
6. Update nwb_update.txt.
7. Configure and build every supported architecture affected by the package through python -m launcher build <targets...> --arch <architecture> --configure always (python3 on Linux), using all when every target is affected.
8. Run the focused unit, integration, tool, or smoke tests for its consumers.

For Windows ARM64 changes, verify that compiler flags, prebuilt binaries, assembly sources, and runtime-copy steps all have an explicit ARM64-safe route.

• No network fetch occurs during configure or build.
• The package remains a direct top-level directory.
• No duplicate dependency was introduced.
• License and update metadata match the imported source.
• Static targets match the engine runtime configuration.
• x64-only options and binaries are gated.
• Required runtime files are copied only for supported targets.
• Relevant x64 and ARM64 presets still configure and build.

See Build and Verification for platform commands.