coffey-labs/cairnobs
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Phase 6: license-compliance audit and enterprise/ relicensing to AGPLv3

Browse Source 
Full dependency inventory across Rust/Go/npm plus Docker base images
and vendored assets (776 rows, 502 unique deps), classified against
AGPLv3 compatibility with real citations rather than assumptions.
enterprise/ relicensed from its commercial-license stub to AGPLv3,
matching core -- the one real flag (Redpanda's BSL 1.1) was evaluated
against primary sources and accepted as-is rather than triggering a
broker swap. CI enforcement wired up (.github/workflows/license-
compliance.yml, this repo's first CI workflow), a root LICENSE file
added, and every doc/comment referencing the old commercial-license
boundary updated to describe it as architectural only.

See /docs/compliance/ for the full report, inventory, and policy.
This commit is contained in:
jcoffey-dev
2026-08-16 18:03:32 -07:00
parent 595d1fe0fd
commit 661568085e
24 changed files with 11409 additions and 73 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/architecture.md
+29 -15
View File
@@ -79,8 +79,8 @@ This split is not to be changed without discussion — see CLAUDE.md.
| `search` (Rust, Phase 1) | Consumes the same Redpanda topic `ingest` does (own offset tracking), builds a Tantivy full-text index over `message`, serves matches over gRPC. Writes always go to one shared (default) index (`ingest` isn't tenant-aware); reads can be scoped per-tenant via `SearchRequest.tenant_id` and `src/registry.rs`'s `IndexRegistry` (Phase 4) — see "Tenant isolation" below. |
| `api` (Go) | gRPC + REST gateway. `POST /query` compiles pipe-syntax or raw SQL to one IR, executed across ClickHouse/Tantivy (`/docs/query-language-design.md`). `internal/dashboards` is CRUD only — panel query execution happens client-side, reusing `/query`. `internal/authz` (Phase 4) enforces RBAC via a network call to `enterprise-auth`, never an import. |
| `alerting` (Go, Phase 3) | Evaluates alert rules on an interval, calls `api`'s `POST /query` (via a `RoleService` credential once Phase 4 auth is configured — see `/docs/phase-4-isolation-design.md`'s alerting↔api gap), delivers firing/resolved notifications (webhook/Slack/PagerDuty). |
| `enterprise` (Go, commercial license, Phase 4) | OIDC login (`internal/loginhandler`'s `/auth/oidc/login`+`/auth/oidc/callback`) and SAML login (`/auth/saml/login`+`/auth/saml/acs`, via `internal/saml`'s `crewjam/saml` wiring) — both a real IdP round trip, each verified with a real fake IdP (`coreos/go-oidc`'s `oidctest`, `crewjam/saml`'s `samlidp`) but not a real external one, RBAC storage (`internal/rbacstore`), session/service-token issuance (`internal/session`), the append-only audit log (`internal/audit`), `enterprise-auth`'s HTTP surface (`/internal/authorize`, `/auth/features`), per-tenant ClickHouse provisioning (`internal/tenantprovision`) and query routing (`internal/chrunner`), and `cmd/enterprise-api` — a second binary combining core's `api/queryapi`/`api/dashboards` handlers with these tenant-aware implementations. Never imported by core — see "Licensing boundary" below. Also `internal/searchclient` (per-tenant Tantivy routing, wired the same way into `search`). |
| `web` (SvelteKit, static build) | Query bar, dashboards, alerts, and (Phase 4) a settings page that renders SSO status via a runtime capability check (`GET /auth/features`) rather than bundling enterprise-licensed components. |
| `enterprise` (Go, AGPLv3 — see "Licensing boundary" below, Phase 4) | OIDC login (`internal/loginhandler`'s `/auth/oidc/login`+`/auth/oidc/callback`) and SAML login (`/auth/saml/login`+`/auth/saml/acs`, via `internal/saml`'s `crewjam/saml` wiring) — both a real IdP round trip, each verified with a real fake IdP (`coreos/go-oidc`'s `oidctest`, `crewjam/saml`'s `samlidp`) but not a real external one, RBAC storage (`internal/rbacstore`), session/service-token issuance (`internal/session`), the append-only audit log (`internal/audit`), `enterprise-auth`'s HTTP surface (`/internal/authorize`, `/auth/features`), per-tenant ClickHouse provisioning (`internal/tenantprovision`) and query routing (`internal/chrunner`), and `cmd/enterprise-api` — a second binary combining core's `api/queryapi`/`api/dashboards` handlers with these tenant-aware implementations. Never imported by core — see "Licensing boundary" below. Also `internal/searchclient` (per-tenant Tantivy routing, wired the same way into `search`). |
| `web` (SvelteKit, static build) | Query bar, dashboards, alerts, and (Phase 4) a settings page that renders SSO status via a runtime capability check (`GET /auth/features`) rather than bundling `enterprise/`'s components directly — an architectural choice (core builds and runs standalone) that predates and doesn't depend on Phase 6's relicensing. |
| `cli` (`sentryctl`) | `ping`, `query`, `dashboards` (list/get/apply), `alerts` (list/get/apply). `$SENTRYCTL_TOKEN`, if set, is forwarded as a Bearer credential (Phase 4). |
| `deploy` | A Helm chart covering every `docker-compose.yml` service, plus (Phase 4) a small Go Operator managing one CRD (`Tenant`) that provisions a per-tenant ClickHouse credential Secret. Never applied to a live cluster in the environment this was built in — see `/deploy/README.md`'s verification section before trusting it. |
@@ -169,9 +169,12 @@ escape hatch is opaque to any compiler-injected filter.
(`search/src/registry.rs` + `enterprise/internal/searchclient`)
already used, and writes there instead of always into the default
index. No "second binary" needed here, unlike ClickHouse — Tantivy has
no grant system to gate a commercially-licensed credential behind, so
`IndexRegistry` already lived directly in this AGPL-core binary, and
read/write just share it. The active-tenant gap this design left open
no grant system to gate a separately-credentialed binary behind
(originally written when that credential was commercially licensed;
the split was never actually about which license `enterprise/`
carried, only about ClickHouse's grant system being the thing worth
isolating), so `IndexRegistry` already lived directly in this AGPL-core
binary, and read/write just share it. The active-tenant gap this design left open
is now closed too: `search/src/tenants.rs`'s `ActiveTenantTracker`
polls a new `GET /internal/active-tenants` endpoint on
`enterprise-auth` — `search` has no Postgres access, so unlike
@@ -219,16 +222,27 @@ IdP or a real running multi-container deployment.
## Licensing boundary
AGPLv3 for core + agents. Enterprise features (SSO, RBAC storage, audit
logging) live under `enterprise/` (commercial license stub, added
Phase 4). AGPL code must never import from `enterprise/` — enforced in
CI by `hack/check-tenant-boundary.sh`, which greps every build for the
import edge. Where core needs a decision only `enterprise/` can make
(is this request authorized, what SSO is configured), it calls
`enterprise-auth` over plain HTTP instead
(`api/authz.HTTPAuthorizer`, `web`'s `GET /auth/features`) —
the same "network boundary, not import boundary" shape `/alerting`↔`api`
already used before `enterprise/` existed.
**AGPLv3 for the entire project**, including `enterprise/` — as of
Phase 6, there is no separate commercial-license carve-out anywhere in
this repo. `enterprise/` (added Phase 4 under a commercial-license stub,
covering SSO, RBAC storage, audit logging) was relicensed to AGPLv3 in
Phase 6; see `/docs/compliance/license-audit-report.md` for the full
record of that decision, including the deliberate business-model
consequence: anyone, including competitors, can now legally self-host or
fork those features under AGPLv3's terms.
Core still never imports from `enterprise/` — enforced in CI by
`hack/check-tenant-boundary.sh`, which greps every build for the import
edge — but this is now purely an **architectural** boundary, not a
licensing one. It exists so core stays buildable and deployable with
zero multi-tenant mechanism present regardless of what license either
side carries, and so tenant identity resolution stays server-side rather
than trusting a request parameter — see `/docs/phase-4-isolation-design.md`.
Where core needs a decision only `enterprise/` can make (is this request
authorized, what SSO is configured), it calls `enterprise-auth` over
plain HTTP instead (`api/authz.HTTPAuthorizer`, `web`'s
`GET /auth/features`) — the same "network boundary, not import boundary"
shape `/alerting`↔`api` already used before `enterprise/` existed.
## Non-negotiables carried from CLAUDE.md
docs/compliance/license-audit-report.md
+412
View File
@@ -0,0 +1,412 @@
# License compliance audit report — Phase 6
**This report is a strong first pass, not a legal opinion.** It should
be reviewed by actual legal counsel before the project is publicly
released, pitched to customers, or used as the basis for any compliance
claim. Nothing in this document should be represented to a third party
as legal advice or a certified compliance determination.
## Scope and goal
Every component in the monorepo — `/agent`, `/transport`, `/ingest`,
`/storage`, `/api`, `/web`, `/cli`, `/deploy`, and `enterprise/` — is
licensed AGPLv3, with no separate commercial-license carve-out anywhere
in the project. This audit inventories every third-party dependency
across every language ecosystem, classifies each for AGPLv3
compatibility, resolves or explicitly flags anything that doesn't
resolve cleanly, and stands up CI enforcement so this doesn't need to be
manually re-audited from scratch every time a dependency changes.
This is a compatibility audit, not a "replace every permissively
licensed library" exercise. MIT, Apache-2.0, BSD, and ISC dependencies
are all fine to depend on from AGPLv3 code. The concern is dependencies
with licenses that are genuinely incompatible, impose unaccounted-for
obligations, or aren't open source at all (source-available licenses
like BSL/SSPL, anything with a field-of-use or non-compete restriction).
## Methodology
1. **Inventory** every dependency, direct and transitive, in every
language ecosystem present in the repo:
- **Rust** (`agent` workspace: `sentry-agent`, `sentry-parser`;
`search`): `cargo-deny` (`cargo deny list --format tsv`), installed
fresh for this audit (`cargo install cargo-deny --locked`).
- **Go** (`api`, `ingest`, `alerting`, `enterprise`,
`deploy/operator`, `terraform`, `proto`,
`hack/benchmark-fixture`, `hack/windows-fixture` — every module with
real third-party dependencies; `cli`, `hack/webhook-sink`, and
`hack/alert-load-test` are stdlib-only, confirmed by inspecting
their `go.mod` files, not scanned): `go-licenses`
(`google/go-licenses`, installed via `go install ...@latest`),
`go-licenses csv ./...` per module.
- **npm** (`web`): `license-checker` (`npx license-checker --json`).
- **Vendored/non-manifest content**: a repo-wide grep for
copy/attribution markers ("adapted from", "copied from",
"stackoverflow", stray copyright headers, "vendored") — zero hits.
A separate pass for binary/asset files (fonts, icons, images)
outside `node_modules`/build output — two font files and one SVG
found, see below. Docker base images referenced in
`docker-compose.yml` were pulled out and reviewed manually, since
they're not a language-ecosystem dependency any of the three
scanners above would see.
2. **Classify** every distinct license found into: (a) clearly
compatible as a dependency, (b) requires a closer look, (c) actually
incompatible or non-open-source. Every (b)/(c) result is cited with
real reasoning below, not asserted.
3. **Named risk areas** (Redpanda's licensing history, ClickHouse client
libraries, Phase 5 font/asset files, Kubernetes Operator tooling)
checked explicitly, against primary sources (actual license files at
the actual pinned versions/tags), not general recollection.
4. **Remediation** options recorded for every (c)/unresolved-(b) item —
fix, isolate, or flag for a business decision. Nothing was silently
swapped.
5. **Own license declarations audited**: root `LICENSE` file, per-ecosystem
manifest `license` fields, and a repo-wide check for any file still
claiming a license other than AGPLv3.
6. **`enterprise/` relicensed** to AGPLv3, closing the former
commercial-license carve-out project-wide.
7. **CI enforcement** stood up so this audit's findings don't silently
go stale.
## Inventory summary
Full machine-readable inventory: `/docs/compliance/license-inventory.csv`
and `.json` (columns: `component`, `dependency`, `version`, `license`,
`direct_or_transitive`, `ecosystem`, `flagged`, `flag_reason`,
`classification`).
| Ecosystem | Component-scoped rows | Unique dependencies | Flagged (unique) |
|---|---|---|---|
| Rust (cargo) | 440 | — | 4 |
| Go | 255 | — | 9 (`segmentio/asm` + 8 HashiCorp MPL-2.0 packages) |
| npm | 75 | — | 3 |
| Docker base images | 3 | 3 | 1 (Redpanda) |
| Font/vendored assets | 3 | 3 | 1 (favicon) |
| **Total** | **776** | **502** | **23** (~4.6%) |
Rows double-count dependencies shared across multiple components by
design (e.g. `pgx` appears once per Go module that imports it) — that's
what makes the `component` column meaningful. All 502 unique
dependencies resolved to classification (a) except one: Redpanda,
classification (c), recorded below with remediation options rather than
resolved unilaterally.
## Classification results
**774 of 776 rows (all but Redpanda and the favicon asset) classify as
(a): clearly compatible.** No dependency in this project's tree required
a genuine (b)-category deep-dive that didn't resolve cleanly — every
item that looked ambiguous at first pass (dual-licensed with a copyleft
option, a non-standard license file, an unfamiliar SPDX identifier)
turned out, on actual inspection, to resolve to (a) once read carefully.
That's a real result of doing the reading, not an assumption going in —
recorded below per item so the reasoning is checkable.
### Dual/multi-licensed crates electing a permissive branch (Rust)
Four Rust crates carry an SPDX OR expression that includes a
copyleft/less-common option alongside a permissive one. Standard
practice for a disjunctive license grant is that the downstream user
elects whichever listed option they prefer — we elect the permissive
branch in every case, incurring zero copyleft obligation:
| Crate | License expression | Elected | Note |
|---|---|---|---|
| `r-efi` | `MIT OR Apache-2.0 OR LGPL-2.1-or-later` | MIT/Apache-2.0 | Build-dependency only (via `tonic-build`→`prost-build`→`tempfile`→`getrandom`), for a UEFI target this project doesn't build for — doesn't even ship in a release artifact. |
| `fastdivide` | `MIT OR zlib-acknowledgement` | MIT | |
| `htmlescape` | `Apache-2.0 / MIT / MPL-2.0` | Apache-2.0/MIT | MPL-2.0 would also have been fine on its own merits (see below). |
| `ryu` | `Apache-2.0 OR BSL-1.0` | Apache-2.0 | `BSL-1.0` here is the Boost Software License — permissive, unrelated to Redpanda's Business Source License below despite the shared abbreviation. |
### MPL-2.0 (Go, npm, and one Rust option above)
MPL-2.0 is file-level (weak) copyleft: modifications to MPL-covered
*files* must stay available under MPL if distributed, but combining
MPL-covered code into a larger differently-licensed work — including an
AGPLv3 work — does not require the larger work to relicense (MPL 2.0
§3.3, "Distribution of a Larger Work"). Pre-cleared as category (a) per
this audit's own scope definition. Found in:
- **Go** (`/terraform` only, HashiCorp's Terraform provider SDK and its
own dependencies): `go-plugin`, `go-uuid`, `terraform-plugin-framework`,
`terraform-plugin-go`, `terraform-plugin-log`, `terraform-registry-address`,
`terraform-svchost`, `yamux`. Lower risk still than the general case:
`/terraform` is its own standalone Go module producing a Terraform
provider plugin binary, not linked into any core service.
- **npm**: `axe-core` (dev-only, used for the Phase 5 accessibility
sweep, never shipped), `lightningcss` + its platform-specific native
binary (a transitive dependency of Vite's CSS pipeline — build-time
only, never bundled into `web`'s shipped static output).
### `segmentio/asm` — tool detection gap, not a real license question (Go)
`go-licenses` reported `Unknown` for every sub-package of
`github.com/segmentio/asm` (a transitive dependency via the ClickHouse
Go driver). Its actual `LICENSE` file (read directly from the module
cache) is headed "MIT No Attribution" — SPDX `MIT-0`, a permissive MIT
variant that drops the attribution requirement. The auto-detector's
regex didn't recognize that non-standard heading text. Confirmed by
reading the file, not assumed; carried as an explicit CI ignore with
this citation (see the policy doc) rather than silently added to the
general allow-list.
### Named risk areas (task 3)
- **ClickHouse client libraries** (`github.com/ClickHouse/clickhouse-go/v2`,
`github.com/ClickHouse/ch-go`): Apache-2.0, matching the server itself.
No divergence.
- **Kubernetes Operator tooling** (`sigs.k8s.io/controller-runtime`,
`k8s.io/client-go`, `k8s.io/apimachinery`): Apache-2.0 (one forked
sub-package, `apimachinery/third_party/forked/golang`, is BSD-3-Clause
— also fine). The concern about "generated boilerplate's license
headers" turned out not to apply: `deploy/operator/api/v1alpha1/
zz_generated.deepcopy.go` is, despite its name, **hand-written**, not
actually produced by `controller-gen` (no kubebuilder/controller-gen
binary was available when it was built — disclosed in the file's own
doc comment and in `/deploy/README.md`). There's no real
upstream-generated boilerplate to check for header drift against.
- **Phase 5 font/asset files**: see below.
## Redpanda — classification (c), recorded for a business decision
**The pinned Redpanda image (`docker.redpanda.com/redpandadata/redpanda:v24.2.7`,
`docker-compose.yml` and `transport/`) ships under BSL 1.1 (Business
Source License), confirmed against the actual `licenses/bsl.md` file at
that tag** (`github.com/redpanda-data/redpanda`, tag `v24.2.7`) — not
assumed from general familiarity with Redpanda's licensing history,
which the audit brief specifically warned has shifted over time.
Key facts, verified against primary sources:
- **Not OSI-approved open source.** BSL is explicitly source-available,
matching this audit's own category-(c) definition.
- **Change Date**: 4 years from each version's release date, after which
that version's `Licensed Work` converts to Apache-2.0. v24.2.7 was
released 2024-10-11 (confirmed via the GitHub Releases API) — its
Change Date is ~2028-10-11. As of this audit, it has **not** yet
converted.
- **The restriction is narrow**: BSL's Additional Use Grant permits any
use except offering the Licensed Work as a "Streaming or Queuing
Service" to third parties (defined as a commercial offering letting
third parties create topics in the Licensed Work, e.g. a hosted Kafka
broker product). This project's `docker-compose.yml` uses only
plaintext core Kafka-protocol functionality — no RCL-gated enterprise
features, no tiered storage, no SASL/RBAC — squarely within the
permitted grant as an internal transport layer.
- **No AGPL linking/compatibility issue.** Sentry never links against
Redpanda's code; it's consumed purely over the Kafka wire protocol, the
same relationship as ClickHouse and Postgres. AGPLv3's copyleft
doesn't reach across a network-protocol boundary to unrelated,
separately-licensed software you merely talk to.
- **The genuinely open question**: Phase 6 relicenses `enterprise/` to
AGPLv3 specifically so that anyone, including competitors, can legally
self-host or fork Sentry — including offering it as a network service,
per AGPLv3's own terms. If a third party does that using the bundled
`docker-compose.yml` (which pulls this BSL-licensed Redpanda image),
does *their* deployment trip BSL's Streaming-or-Queuing-Service
restriction? Sentry's ingest pipeline creates fixed internal topics,
not per-end-user topics exposed for direct third-party production or
consumption — so this is very likely **not** a Streaming-or-Queuing-Service
under BSL's own definition. But this is a business/redistribution
judgment call about a hypothetical third party's use, not a pure
technical compatibility question this audit can close unilaterally.
### Remediation options (recorded per task 4's requirement)
1. **Accept as-is.** Document the reasoning above; Sentry's own use is
clearly within BSL's permitted grant, and the third-party-SaaS
scenario is a reasonable-but-unverified reading, not a known
violation. Lowest effort, zero functional change.
2. **Swap to Apache Kafka** (Apache-2.0, genuinely OSI open source).
`apache/kafka` (KRaft mode, no ZooKeeper needed as of Kafka 3.x) is
wire-protocol-compatible with everything `transport`/`ingest`/`search`
already speak. Real tradeoff: Redpanda was originally chosen partly
for its lightweight single-binary footprint (`docker-compose.yml`
runs it with `--smp=1 --memory=1G --overprovisioned`, tuned for a
resource-constrained local/homelab deployment per `CLAUDE.md`'s
stated deployment targets); Kafka's JVM-based broker has a materially
larger minimum memory/startup footprint. This is a real regression
for the project's stated "docker-compose for local/homelab" use case,
not a drop-in swap with no cost.
3. **Stop bundling a pinned broker image at all.** `transport/` already
has no application code of its own — it's a thin `docker-compose`
wrapper and topic-provisioning script. Document Kafka-API
compatibility as the requirement and let the operator supply their
own broker (self-installed Apache Kafka, their own separately-licensed
Redpanda, or anything else wire-compatible). This moves the
redistribution question out of this project's own `docker-compose.yml`
entirely, at the cost of a rougher out-of-the-box local dev experience
(an extra manual setup step instead of `docker compose up`).
**Decision recorded 2026-08-16: option 1, accept as-is.** No code or
deployment change was made as a result — Redpanda stays pinned at
v24.2.7 in `docker-compose.yml`/`transport/`, under BSL 1.1, as a
disclosed and accepted risk rather than an unresolved one. This
decision should be revisited if the project's redistribution posture
changes materially (e.g. an official hosted/managed offering of Sentry
itself, which would make the third-party-SaaS reading in this section
Sentry's *own* situation rather than a hypothetical third party's).
## Non-license finding: `favicon.svg`
`web/src/lib/assets/favicon.svg` is SvelteKit's own default project
scaffold logo (`<title>svelte-logo</title>` — the `sv create`/`create-svelte`
starter icon), never replaced with an original mark during Phase 5's
redesign. Not a license-compatibility blocker — Svelte's own project
assets are MIT-licensed — but it's unauthored, third-party-branded
content shipping as this product's own favicon, caught by the same
"grep for anything that looks copied" pass this audit's task 1 asked
for. Recorded as an action item (replace with an original Sentry mark),
not a compliance blocker; not fixed here since it's a design task outside
this phase's scope, not a licensing one.
## Own license declarations (task 5)
**Before this audit**: no root `LICENSE` file existed anywhere in the
repo — not at the root, not in `enterprise/`. The only license
declarations were prose statements in `CLAUDE.md`/`docs/architecture.md`
and correct `license = "AGPL-3.0-only"` fields in the two Rust
workspaces' `Cargo.toml`s. `web/package.json` had no `license` field at
all (npm's tooling reported the package itself as `UNLICENSED` as a
result). `web/static/fonts/LICENSE.txt` was a paraphrase describing the
Overpass font's license, not the actual OFL-1.1 license text.
**Fixed**:
- Added `/LICENSE` — the verbatim, unmodified AGPLv3 text from
`gnu.org/licenses/agpl-3.0.txt`, byte-for-byte, not paraphrased.
- **Chosen convention, applied consistently**: one root `LICENSE` file
governs the whole monorepo, plus a `license` field in every ecosystem
manifest that supports one (`Cargo.toml`'s `license`/`license.workspace`,
now confirmed correct; `package.json`'s `license`, added:
`"AGPL-3.0-only"`). Go has no manifest-level license field — the
standard convention (and what `go-licenses` itself looks for) is the
root `LICENSE` file, which now exists. **Deliberately not** adopting
per-file SPDX header comments across the monorepo's several thousand
source files: headers are an FSF best-practice recommendation, not a
legal requirement once a correct root `LICENSE` plus copyright
ownership is established, and retrofitting them here would be a huge
mechanical change for very little incremental legal value over what's
now in place. Recorded as a deliberate choice, not left half-done.
- Corrected `web/static/fonts/LICENSE.txt` from a paraphrase to the
actual, complete, unmodified OFL-1.1 text (fetched from
`github.com/googlefonts/overpass`, the actual repository these font
files were fetched from per the file's own prior note) plus the
correct copyright statement, with the original context note (self-hosted
vs. CDN) preserved as a clearly separated project note, not mixed into
the license text itself.
- No accidental license mismatch from copied code was found — the
repo-wide attribution-marker grep in the methodology section came back
empty, and no vendored directories exist.
## `enterprise/` relicensing to AGPLv3 (task 6)
**This is a deliberate business-model choice, recorded plainly so it
isn't rediscovered as a surprise later**: the project is no longer
pursuing commercial-license revenue from the former `enterprise/`
features (SSO, multi-tenancy/RBAC, audit logging). As of Phase 6,
**anyone, including competitors, can legally self-host or fork those
features under AGPLv3's terms.** AGPLv3's source-sharing obligation
applies to network use (anyone interacting with a modified version over
a network is entitled to its source) — it does not impose any payment
obligation, and nothing in this project gates functionality behind a
license key or entitlement check.
**Confirmed no license-gating logic exists**: a repo-wide grep for
license-key/entitlement-check patterns (`license.?key`, `entitlement`,
`commercial.?key`, `paywall`, `IsLicensed`, and similar) across
`enterprise/`'s Go source returned zero hits. There was never a
functional paywall to remove — Phase 4's `enterprise/` split was always
an architectural/import-boundary separation, not a runtime license
check, so this task's "if any such gating exists, flag it explicitly, it
needs to come out" condition doesn't apply here — confirmed, not
assumed.
**Changes applied**:
- Every prose reference to `enterprise/` as "commercial license" or
"commercial-licensed" across the repo was updated. Present-tense
claims (code comments, `README.md` files describing current state,
`CLAUDE.md`'s non-negotiable constraints) were corrected outright.
Historical, phase-specific documents (`docs/phase-4-isolation-design.md`,
`docs/phase-4-rbac-design.md`, `docs/phase-4-runbook.md`, and the
relevant parts of `CLAUDE.md`'s and `docs/architecture.md`'s Phase 4
sections) were given forward-pointing corrections — "commercial
license at the time this was written; AGPLv3 as of Phase 6" — rather
than rewritten as if the commercial-license period never happened,
matching this project's existing convention for superseded claims
(e.g. Phase 3's `tenant_id` gap, corrected inline by Phase 4's section
rather than edited out of Phase 3's).
- `enterprise/README.md`, `enterprise/Dockerfile`,
`enterprise/cmd/enterprise-auth/main.go`: relicensing statement
corrected.
- `hack/check-tenant-boundary.sh` and every doc describing it
(`docs/architecture.md`, `docs/security/threat-model.md`, the two
`phase-4-*-design.md` docs): the import-boundary check **itself is
kept** — it still enforces a real, valuable architectural property
(core builds and deploys standalone with zero multi-tenant mechanism
present, tenant identity resolution stays server-side) — but every
description of *why* it exists was reframed from a licensing reason to
an architectural one, since both sides now carry the same license.
- Final repo-wide grep for `commercial` confirms every remaining
occurrence is one of the above corrections (explicitly framed as
historical/superseded), not a live claim. **No file in the repo claims
a license other than AGPLv3** for Sentry's own code, as of this audit.
## Ongoing enforcement (task 7)
`.github/workflows/license-compliance.yml` — this repo's **first** CI
workflow file (several docs already said "enforced in CI" about
`hack/check-tenant-boundary.sh`, but no CI system had actually been wired
up yet; fixed as part of this task rather than left as a second gap next
to the one this task asked about). Four jobs, one per ecosystem plus the
architectural boundary check, all real commands verified locally against
this repo before being written into the workflow (not guessed):
- **Rust**: `cargo-deny-action` running `cargo deny check licenses`
against `agent/deny.toml` and `search/deny.toml` — both verified
passing locally with the policy's real allow-list.
- **Go**: `go-licenses check ./... --allowed_licenses=...` per module
with real dependencies — verified passing locally for every listed
module, including the `segmentio/asm` and HashiCorp-MPL-2.0 cases.
- **npm**: `license-checker --onlyAllow "..."` — verified passing
locally.
- **Architectural boundary**: `hack/check-tenant-boundary.sh`, now
actually wired into CI instead of only documented as if it were.
Full policy, including exactly what's auto-allowed, what needs manual
review, and what's rejected outright: `/docs/compliance/license-policy.md`.
**Not verified**: the workflow YAML itself has not been run through a
real GitHub Actions execution in this environment (no way to trigger
that here) — every individual command it invokes was verified locally
with real exit codes, but the workflow file's syntax and job wiring
should be confirmed on the first real PR that triggers it, the same
"written but not run against the live thing" caveat this project applies
to its other CI-adjacent and Docker-gated claims.
## What's resolved vs. what's still open
Per the audit brief's explicit gate: this phase is not "done" while a
(c) or unresolved-(b) item has no recorded resolution. As of the
Redpanda decision below, every item has one.
| Item | Status |
|---|---|
| All 774 permissive/MPL-2.0/OR-resolved dependencies | **Resolved** — classification (a), no action needed. |
| `segmentio/asm` (Go) | **Resolved** — confirmed MIT-0, carried as a cited CI ignore. |
| `favicon.svg` | **Flagged, not a compliance blocker** — action item recorded (replace with an original mark), not license-gating. |
| Redpanda (BSL 1.1) | **Resolved** — decision recorded 2026-08-16: accept as-is (option 1). No code change; the BSL exposure is a disclosed, accepted risk, not an unresolved one. |
| `enterprise/` relicensing | **Resolved** — applied throughout the repo, confirmed via repo-wide grep. |
| Root `LICENSE` / manifest declarations | **Resolved** — added and corrected. |
| CI enforcement | **Resolved** — workflow written and every command verified locally; the workflow file itself untested end-to-end (disclosed above). |
**Every task-2 (c)/unresolved-(b) item now has an explicit resolution**
— fixed, isolated, or, for Redpanda, flagged and decided. Phase 6's exit
criteria in `CLAUDE.md` are updated accordingly.
## Legal disclaimer (repeated, deliberately)
This audit and the policy derived from it are a strong first pass — real
primary sources were checked for every named risk area and every
flagged item, not guessed from memory. They are not a substitute for
review by actual legal counsel, which is recommended before the project
is publicly released, pitched to customers, or used as the basis for any
compliance claim — particularly the open Redpanda question above, which
is exactly the kind of judgment call outside counsel exists to make.
docs/compliance/license-inventory.csv
+777
View File
@@ -0,0 +1,777 @@
component,dependency,version,license,direct_or_transitive,ecosystem,flagged,flag_reason,classification
api,github.com/ClickHouse/ch-go,(see go.sum),Apache-2.0,transitive,go,False,,a
api,github.com/ClickHouse/clickhouse-go/v2,(see go.sum),Apache-2.0,direct,go,False,,a
api,github.com/andybalholm/brotli,(see go.sum),MIT,transitive,go,False,,a
api,github.com/andybalholm/brotli/flate,(see go.sum),BSD-3-Clause,transitive,go,False,,a
api,github.com/cespare/xxhash/v2,(see go.sum),MIT,transitive,go,False,,a
api,github.com/go-faster/city,(see go.sum),MIT,transitive,go,False,,a
api,github.com/go-faster/errors,(see go.sum),BSD-3-Clause,transitive,go,False,,a
api,github.com/google/uuid,(see go.sum),BSD-3-Clause,direct,go,False,,a
api,github.com/jackc/pgpassfile,(see go.sum),MIT,transitive,go,False,,a
api,github.com/jackc/pgservicefile,(see go.sum),MIT,transitive,go,False,,a
api,github.com/jackc/pgx/v5,(see go.sum),MIT,transitive,go,False,,a
api,github.com/jackc/puddle/v2,(see go.sum),MIT,transitive,go,False,,a
api,github.com/klauspost/compress,(see go.sum),Apache-2.0,transitive,go,False,,a
api,github.com/klauspost/compress/internal/snapref,(see go.sum),BSD-3-Clause,transitive,go,False,,a
api,github.com/klauspost/compress/zstd/internal/xxhash,(see go.sum),MIT,transitive,go,False,,a
api,github.com/paulmach/orb,(see go.sum),MIT,transitive,go,False,,a
api,github.com/pierrec/lz4/v4,(see go.sum),BSD-3-Clause,transitive,go,False,,a
api,github.com/segmentio/asm/bswap,(see go.sum),"MIT-0 (declared as ""MIT No Attribution"" in LICENSE; SPDX MIT-0, permissive)",transitive,go,True,go-licenses reported Unknown; manually confirmed from module's LICENSE file,a
api,github.com/segmentio/asm/cpu,(see go.sum),"MIT-0 (declared as ""MIT No Attribution"" in LICENSE; SPDX MIT-0, permissive)",transitive,go,True,go-licenses reported Unknown; manually confirmed from module's LICENSE file,a
api,github.com/segmentio/asm/cpu/arm,(see go.sum),"MIT-0 (declared as ""MIT No Attribution"" in LICENSE; SPDX MIT-0, permissive)",transitive,go,True,go-licenses reported Unknown; manually confirmed from module's LICENSE file,a
api,github.com/segmentio/asm/cpu/arm64,(see go.sum),"MIT-0 (declared as ""MIT No Attribution"" in LICENSE; SPDX MIT-0, permissive)",transitive,go,True,go-licenses reported Unknown; manually confirmed from module's LICENSE file,a
api,github.com/segmentio/asm/cpu/cpuid,(see go.sum),"MIT-0 (declared as ""MIT No Attribution"" in LICENSE; SPDX MIT-0, permissive)",transitive,go,True,go-licenses reported Unknown; manually confirmed from module's LICENSE file,a
api,github.com/segmentio/asm/cpu/x86,(see go.sum),"MIT-0 (declared as ""MIT No Attribution"" in LICENSE; SPDX MIT-0, permissive)",transitive,go,True,go-licenses reported Unknown; manually confirmed from module's LICENSE file,a
api,github.com/shopspring/decimal,(see go.sum),MIT,transitive,go,False,,a
api,go.opentelemetry.io/otel,(see go.sum),Apache-2.0,transitive,go,False,,a
api,go.opentelemetry.io/otel/trace,(see go.sum),Apache-2.0,transitive,go,False,,a
api,golang.org/x/net,(see go.sum),BSD-3-Clause,transitive,go,False,,a
api,golang.org/x/sync/semaphore,(see go.sum),BSD-3-Clause,transitive,go,False,,a
api,golang.org/x/sys,(see go.sum),BSD-3-Clause,transitive,go,False,,a
api,golang.org/x/text,(see go.sum),BSD-3-Clause,transitive,go,False,,a
api,google.golang.org/genproto/googleapis/rpc/status,(see go.sum),Apache-2.0,transitive,go,False,,a
api,google.golang.org/grpc,(see go.sum),Apache-2.0,direct,go,False,,a
api,google.golang.org/protobuf,(see go.sum),BSD-3-Clause,transitive,go,False,,a
ingest,github.com/ClickHouse/ch-go,(see go.sum),Apache-2.0,transitive,go,False,,a
ingest,github.com/ClickHouse/clickhouse-go/v2,(see go.sum),Apache-2.0,direct,go,False,,a
ingest,github.com/andybalholm/brotli,(see go.sum),MIT,transitive,go,False,,a
ingest,github.com/andybalholm/brotli/flate,(see go.sum),BSD-3-Clause,transitive,go,False,,a
ingest,github.com/cespare/xxhash/v2,(see go.sum),MIT,transitive,go,False,,a
ingest,github.com/go-faster/city,(see go.sum),MIT,transitive,go,False,,a
ingest,github.com/go-faster/errors,(see go.sum),BSD-3-Clause,transitive,go,False,,a
ingest,github.com/google/uuid,(see go.sum),BSD-3-Clause,direct,go,False,,a
ingest,github.com/klauspost/compress,(see go.sum),Apache-2.0,transitive,go,False,,a
ingest,github.com/klauspost/compress/internal/snapref,(see go.sum),BSD-3-Clause,transitive,go,False,,a
ingest,github.com/klauspost/compress/s2,(see go.sum),BSD-3-Clause,transitive,go,False,,a
ingest,github.com/klauspost/compress/snappy,(see go.sum),BSD-3-Clause,transitive,go,False,,a
ingest,github.com/klauspost/compress/zstd/internal/xxhash,(see go.sum),MIT,transitive,go,False,,a
ingest,github.com/paulmach/orb,(see go.sum),MIT,transitive,go,False,,a
ingest,github.com/pierrec/lz4/v4,(see go.sum),BSD-3-Clause,transitive,go,False,,a
ingest,github.com/segmentio/asm/bswap,(see go.sum),"MIT-0 (declared as ""MIT No Attribution"" in LICENSE; SPDX MIT-0, permissive)",transitive,go,True,go-licenses reported Unknown; manually confirmed from module's LICENSE file,a
ingest,github.com/segmentio/asm/cpu,(see go.sum),"MIT-0 (declared as ""MIT No Attribution"" in LICENSE; SPDX MIT-0, permissive)",transitive,go,True,go-licenses reported Unknown; manually confirmed from module's LICENSE file,a
ingest,github.com/segmentio/asm/cpu/arm,(see go.sum),"MIT-0 (declared as ""MIT No Attribution"" in LICENSE; SPDX MIT-0, permissive)",transitive,go,True,go-licenses reported Unknown; manually confirmed from module's LICENSE file,a
ingest,github.com/segmentio/asm/cpu/arm64,(see go.sum),"MIT-0 (declared as ""MIT No Attribution"" in LICENSE; SPDX MIT-0, permissive)",transitive,go,True,go-licenses reported Unknown; manually confirmed from module's LICENSE file,a
ingest,github.com/segmentio/asm/cpu/cpuid,(see go.sum),"MIT-0 (declared as ""MIT No Attribution"" in LICENSE; SPDX MIT-0, permissive)",transitive,go,True,go-licenses reported Unknown; manually confirmed from module's LICENSE file,a
ingest,github.com/segmentio/asm/cpu/x86,(see go.sum),"MIT-0 (declared as ""MIT No Attribution"" in LICENSE; SPDX MIT-0, permissive)",transitive,go,True,go-licenses reported Unknown; manually confirmed from module's LICENSE file,a
ingest,github.com/segmentio/kafka-go,(see go.sum),MIT,direct,go,False,,a
ingest,github.com/shopspring/decimal,(see go.sum),MIT,transitive,go,False,,a
ingest,go.opentelemetry.io/otel,(see go.sum),Apache-2.0,transitive,go,False,,a
ingest,go.opentelemetry.io/otel/trace,(see go.sum),Apache-2.0,transitive,go,False,,a
ingest,golang.org/x/net,(see go.sum),BSD-3-Clause,transitive,go,False,,a
ingest,golang.org/x/sync/errgroup,(see go.sum),BSD-3-Clause,direct,go,False,,a
ingest,golang.org/x/sys,(see go.sum),BSD-3-Clause,transitive,go,False,,a
ingest,golang.org/x/text,(see go.sum),BSD-3-Clause,transitive,go,False,,a
ingest,google.golang.org/genproto/googleapis/rpc/status,(see go.sum),Apache-2.0,transitive,go,False,,a
ingest,google.golang.org/grpc,(see go.sum),Apache-2.0,direct,go,False,,a
ingest,google.golang.org/protobuf,(see go.sum),BSD-3-Clause,direct,go,False,,a
enterprise,github.com/ClickHouse/ch-go,(see go.sum),Apache-2.0,transitive,go,False,,a
enterprise,github.com/ClickHouse/clickhouse-go/v2,(see go.sum),Apache-2.0,transitive,go,False,,a
enterprise,github.com/andybalholm/brotli,(see go.sum),MIT,transitive,go,False,,a
enterprise,github.com/andybalholm/brotli/flate,(see go.sum),BSD-3-Clause,transitive,go,False,,a
enterprise,github.com/beevik/etree,(see go.sum),BSD-2-Clause,transitive,go,False,,a
enterprise,github.com/cespare/xxhash/v2,(see go.sum),MIT,transitive,go,False,,a
enterprise,github.com/coreos/go-oidc/v3/oidc,(see go.sum),Apache-2.0,transitive,go,False,,a
enterprise,github.com/crewjam/saml,(see go.sum),BSD-2-Clause,transitive,go,False,,a
enterprise,github.com/davecgh/go-spew/spew,(see go.sum),ISC,transitive,go,False,,a
enterprise,github.com/emicklei/go-restful/v3,(see go.sum),MIT,transitive,go,False,,a
enterprise,github.com/fxamacker/cbor/v2,(see go.sum),MIT,transitive,go,False,,a
enterprise,github.com/go-faster/city,(see go.sum),MIT,transitive,go,False,,a
enterprise,github.com/go-faster/errors,(see go.sum),BSD-3-Clause,transitive,go,False,,a
enterprise,github.com/go-jose/go-jose/v4,(see go.sum),Apache-2.0,transitive,go,False,,a
enterprise,github.com/go-jose/go-jose/v4/json,(see go.sum),BSD-3-Clause,transitive,go,False,,a
enterprise,github.com/go-logr/logr,(see go.sum),Apache-2.0,transitive,go,False,,a
enterprise,github.com/go-openapi/jsonpointer,(see go.sum),Apache-2.0,transitive,go,False,,a
enterprise,github.com/go-openapi/jsonreference,(see go.sum),Apache-2.0,transitive,go,False,,a
enterprise,github.com/go-openapi/swag,(see go.sum),Apache-2.0,transitive,go,False,,a
enterprise,github.com/gogo/protobuf,(see go.sum),BSD-3-Clause,transitive,go,False,,a
enterprise,github.com/golang-jwt/jwt/v4,(see go.sum),MIT,transitive,go,False,,a
enterprise,github.com/golang/protobuf,(see go.sum),BSD-3-Clause,transitive,go,False,,a
enterprise,github.com/google/gnostic-models,(see go.sum),Apache-2.0,transitive,go,False,,a
enterprise,github.com/google/go-cmp/cmp,(see go.sum),BSD-3-Clause,transitive,go,False,,a
enterprise,github.com/google/gofuzz,(see go.sum),Apache-2.0,transitive,go,False,,a
enterprise,github.com/google/uuid,(see go.sum),BSD-3-Clause,transitive,go,False,,a
enterprise,github.com/imdario/mergo,(see go.sum),BSD-3-Clause,transitive,go,False,,a
enterprise,github.com/jackc/pgpassfile,(see go.sum),MIT,transitive,go,False,,a
enterprise,github.com/jackc/pgservicefile,(see go.sum),MIT,transitive,go,False,,a
enterprise,github.com/jackc/pgx/v5,(see go.sum),MIT,transitive,go,False,,a
enterprise,github.com/jackc/puddle/v2,(see go.sum),MIT,transitive,go,False,,a
enterprise,github.com/jonboulle/clockwork,(see go.sum),Apache-2.0,transitive,go,False,,a
enterprise,github.com/josharian/intern,(see go.sum),MIT,transitive,go,False,,a
enterprise,github.com/json-iterator/go,(see go.sum),MIT,transitive,go,False,,a
enterprise,github.com/klauspost/compress,(see go.sum),Apache-2.0,transitive,go,False,,a
enterprise,github.com/klauspost/compress/internal/snapref,(see go.sum),BSD-3-Clause,transitive,go,False,,a
enterprise,github.com/klauspost/compress/s2,(see go.sum),BSD-3-Clause,transitive,go,False,,a
enterprise,github.com/klauspost/compress/snappy,(see go.sum),BSD-3-Clause,transitive,go,False,,a
enterprise,github.com/klauspost/compress/zstd/internal/xxhash,(see go.sum),MIT,transitive,go,False,,a
enterprise,github.com/mailru/easyjson,(see go.sum),MIT,transitive,go,False,,a
enterprise,github.com/mattermost/xml-roundtrip-validator,(see go.sum),Apache-2.0,transitive,go,False,,a
enterprise,github.com/modern-go/concurrent,(see go.sum),Apache-2.0,transitive,go,False,,a
enterprise,github.com/modern-go/reflect2,(see go.sum),Apache-2.0,transitive,go,False,,a
enterprise,github.com/munnerz/goautoneg,(see go.sum),BSD-3-Clause,transitive,go,False,,a
enterprise,github.com/paulmach/orb,(see go.sum),MIT,transitive,go,False,,a
enterprise,github.com/pierrec/lz4/v4,(see go.sum),BSD-3-Clause,transitive,go,False,,a
enterprise,github.com/russellhaering/goxmldsig,(see go.sum),Apache-2.0,transitive,go,False,,a
enterprise,github.com/segmentio/asm/bswap,(see go.sum),"MIT-0 (declared as ""MIT No Attribution"" in LICENSE; SPDX MIT-0, permissive)",transitive,go,True,go-licenses reported Unknown; manually confirmed from module's LICENSE file,a
enterprise,github.com/segmentio/asm/cpu,(see go.sum),"MIT-0 (declared as ""MIT No Attribution"" in LICENSE; SPDX MIT-0, permissive)",transitive,go,True,go-licenses reported Unknown; manually confirmed from module's LICENSE file,a
enterprise,github.com/segmentio/asm/cpu/arm,(see go.sum),"MIT-0 (declared as ""MIT No Attribution"" in LICENSE; SPDX MIT-0, permissive)",transitive,go,True,go-licenses reported Unknown; manually confirmed from module's LICENSE file,a
enterprise,github.com/segmentio/asm/cpu/arm64,(see go.sum),"MIT-0 (declared as ""MIT No Attribution"" in LICENSE; SPDX MIT-0, permissive)",transitive,go,True,go-licenses reported Unknown; manually confirmed from module's LICENSE file,a
enterprise,github.com/segmentio/asm/cpu/cpuid,(see go.sum),"MIT-0 (declared as ""MIT No Attribution"" in LICENSE; SPDX MIT-0, permissive)",transitive,go,True,go-licenses reported Unknown; manually confirmed from module's LICENSE file,a
enterprise,github.com/segmentio/asm/cpu/x86,(see go.sum),"MIT-0 (declared as ""MIT No Attribution"" in LICENSE; SPDX MIT-0, permissive)",transitive,go,True,go-licenses reported Unknown; manually confirmed from module's LICENSE file,a
enterprise,github.com/segmentio/kafka-go,(see go.sum),MIT,transitive,go,False,,a
enterprise,github.com/shopspring/decimal,(see go.sum),MIT,transitive,go,False,,a
enterprise,github.com/spf13/pflag,(see go.sum),BSD-3-Clause,transitive,go,False,,a
enterprise,github.com/x448/float16,(see go.sum),MIT,transitive,go,False,,a
enterprise,go.opentelemetry.io/otel,(see go.sum),Apache-2.0,transitive,go,False,,a
enterprise,go.opentelemetry.io/otel/trace,(see go.sum),Apache-2.0,transitive,go,False,,a
enterprise,golang.org/x/crypto/ripemd160,(see go.sum),BSD-3-Clause,transitive,go,False,,a
enterprise,golang.org/x/net,(see go.sum),BSD-3-Clause,transitive,go,False,,a
enterprise,golang.org/x/oauth2,(see go.sum),BSD-3-Clause,transitive,go,False,,a
enterprise,golang.org/x/sync,(see go.sum),BSD-3-Clause,transitive,go,False,,a
enterprise,golang.org/x/sys,(see go.sum),BSD-3-Clause,transitive,go,False,,a
enterprise,golang.org/x/term,(see go.sum),BSD-3-Clause,transitive,go,False,,a
enterprise,golang.org/x/text,(see go.sum),BSD-3-Clause,transitive,go,False,,a
enterprise,golang.org/x/time/rate,(see go.sum),BSD-3-Clause,transitive,go,False,,a
enterprise,google.golang.org/genproto/googleapis/rpc/status,(see go.sum),Apache-2.0,transitive,go,False,,a
enterprise,google.golang.org/grpc,(see go.sum),Apache-2.0,transitive,go,False,,a
enterprise,google.golang.org/protobuf,(see go.sum),BSD-3-Clause,transitive,go,False,,a
enterprise,gopkg.in/inf.v0,(see go.sum),BSD-3-Clause,transitive,go,False,,a
enterprise,gopkg.in/yaml.v2,(see go.sum),Apache-2.0,transitive,go,False,,a
enterprise,gopkg.in/yaml.v3,(see go.sum),MIT,transitive,go,False,,a
enterprise,k8s.io/api,(see go.sum),Apache-2.0,transitive,go,False,,a
enterprise,k8s.io/apimachinery/pkg,(see go.sum),Apache-2.0,transitive,go,False,,a
enterprise,k8s.io/apimachinery/third_party/forked/golang/reflect,(see go.sum),BSD-3-Clause,transitive,go,False,,a
enterprise,k8s.io/client-go,(see go.sum),Apache-2.0,transitive,go,False,,a
enterprise,k8s.io/klog/v2,(see go.sum),Apache-2.0,transitive,go,False,,a
enterprise,k8s.io/kube-openapi/pkg,(see go.sum),Apache-2.0,transitive,go,False,,a
enterprise,k8s.io/kube-openapi/pkg/internal/third_party/go-json-experiment/json,(see go.sum),BSD-3-Clause,transitive,go,False,,a
enterprise,k8s.io/kube-openapi/pkg/validation/spec,(see go.sum),Apache-2.0,transitive,go,False,,a
enterprise,k8s.io/utils,(see go.sum),Apache-2.0,transitive,go,False,,a
enterprise,k8s.io/utils/internal/third_party/forked/golang/net,(see go.sum),BSD-3-Clause,transitive,go,False,,a
enterprise,sigs.k8s.io/json,(see go.sum),Apache-2.0,transitive,go,False,,a
enterprise,sigs.k8s.io/structured-merge-diff/v4,(see go.sum),Apache-2.0,transitive,go,False,,a
enterprise,sigs.k8s.io/yaml,(see go.sum),Apache-2.0,transitive,go,False,,a
enterprise,sigs.k8s.io/yaml/goyaml.v2,(see go.sum),Apache-2.0,transitive,go,False,,a
deploy/operator,github.com/beorn7/perks/quantile,(see go.sum),MIT,transitive,go,False,,a
deploy/operator,github.com/cespare/xxhash/v2,(see go.sum),MIT,transitive,go,False,,a
deploy/operator,github.com/davecgh/go-spew/spew,(see go.sum),ISC,transitive,go,False,,a
deploy/operator,github.com/emicklei/go-restful/v3,(see go.sum),MIT,transitive,go,False,,a
deploy/operator,github.com/evanphx/json-patch/v5,(see go.sum),BSD-3-Clause,transitive,go,False,,a
deploy/operator,github.com/fxamacker/cbor/v2,(see go.sum),MIT,transitive,go,False,,a
deploy/operator,github.com/go-logr/logr,(see go.sum),Apache-2.0,transitive,go,False,,a
deploy/operator,github.com/go-logr/zapr,(see go.sum),Apache-2.0,transitive,go,False,,a
deploy/operator,github.com/go-openapi/jsonpointer,(see go.sum),Apache-2.0,transitive,go,False,,a
deploy/operator,github.com/go-openapi/jsonreference,(see go.sum),Apache-2.0,transitive,go,False,,a
deploy/operator,github.com/go-openapi/swag,(see go.sum),Apache-2.0,transitive,go,False,,a
deploy/operator,github.com/gogo/protobuf,(see go.sum),BSD-3-Clause,transitive,go,False,,a
deploy/operator,github.com/golang/groupcache/lru,(see go.sum),Apache-2.0,transitive,go,False,,a
deploy/operator,github.com/golang/protobuf,(see go.sum),BSD-3-Clause,transitive,go,False,,a
deploy/operator,github.com/google/gnostic-models,(see go.sum),Apache-2.0,transitive,go,False,,a
deploy/operator,github.com/google/go-cmp/cmp,(see go.sum),BSD-3-Clause,transitive,go,False,,a
deploy/operator,github.com/google/gofuzz,(see go.sum),Apache-2.0,transitive,go,False,,a
deploy/operator,github.com/google/uuid,(see go.sum),BSD-3-Clause,transitive,go,False,,a
deploy/operator,github.com/imdario/mergo,(see go.sum),BSD-3-Clause,transitive,go,False,,a
deploy/operator,github.com/josharian/intern,(see go.sum),MIT,transitive,go,False,,a
deploy/operator,github.com/json-iterator/go,(see go.sum),MIT,transitive,go,False,,a
deploy/operator,github.com/mailru/easyjson,(see go.sum),MIT,transitive,go,False,,a
deploy/operator,github.com/modern-go/concurrent,(see go.sum),Apache-2.0,transitive,go,False,,a
deploy/operator,github.com/modern-go/reflect2,(see go.sum),Apache-2.0,transitive,go,False,,a
deploy/operator,github.com/munnerz/goautoneg,(see go.sum),BSD-3-Clause,transitive,go,False,,a
deploy/operator,github.com/pkg/errors,(see go.sum),BSD-2-Clause,transitive,go,False,,a
deploy/operator,github.com/prometheus/client_golang/prometheus,(see go.sum),Apache-2.0,transitive,go,False,,a
deploy/operator,github.com/prometheus/client_model/go,(see go.sum),Apache-2.0,transitive,go,False,,a
deploy/operator,github.com/prometheus/common,(see go.sum),Apache-2.0,transitive,go,False,,a
deploy/operator,github.com/prometheus/procfs,(see go.sum),Apache-2.0,transitive,go,False,,a
deploy/operator,github.com/spf13/pflag,(see go.sum),BSD-3-Clause,transitive,go,False,,a
deploy/operator,github.com/x448/float16,(see go.sum),MIT,transitive,go,False,,a
deploy/operator,go.uber.org/multierr,(see go.sum),MIT,transitive,go,False,,a
deploy/operator,go.uber.org/zap,(see go.sum),MIT,transitive,go,False,,a
deploy/operator,golang.org/x/exp/maps,(see go.sum),BSD-3-Clause,transitive,go,False,,a
deploy/operator,golang.org/x/net,(see go.sum),BSD-3-Clause,transitive,go,False,,a
deploy/operator,golang.org/x/oauth2,(see go.sum),BSD-3-Clause,transitive,go,False,,a
deploy/operator,golang.org/x/sys/unix,(see go.sum),BSD-3-Clause,transitive,go,False,,a
deploy/operator,golang.org/x/term,(see go.sum),BSD-3-Clause,transitive,go,False,,a
deploy/operator,golang.org/x/text,(see go.sum),BSD-3-Clause,transitive,go,False,,a
deploy/operator,golang.org/x/time/rate,(see go.sum),BSD-3-Clause,transitive,go,False,,a
deploy/operator,gomodules.xyz/jsonpatch/v2,(see go.sum),Apache-2.0,transitive,go,False,,a
deploy/operator,google.golang.org/protobuf,(see go.sum),BSD-3-Clause,transitive,go,False,,a
deploy/operator,gopkg.in/inf.v0,(see go.sum),BSD-3-Clause,transitive,go,False,,a
deploy/operator,gopkg.in/yaml.v2,(see go.sum),Apache-2.0,transitive,go,False,,a
deploy/operator,gopkg.in/yaml.v3,(see go.sum),MIT,transitive,go,False,,a
deploy/operator,k8s.io/api,(see go.sum),Apache-2.0,direct,go,False,,a
deploy/operator,k8s.io/apiextensions-apiserver/pkg/apis/apiextensions,(see go.sum),Apache-2.0,transitive,go,False,,a
deploy/operator,k8s.io/apimachinery/pkg,(see go.sum),Apache-2.0,direct,go,False,,a
deploy/operator,k8s.io/apimachinery/third_party/forked/golang,(see go.sum),BSD-3-Clause,direct,go,False,,a
deploy/operator,k8s.io/client-go,(see go.sum),Apache-2.0,direct,go,False,,a
deploy/operator,k8s.io/klog/v2,(see go.sum),Apache-2.0,transitive,go,False,,a
deploy/operator,k8s.io/kube-openapi/pkg,(see go.sum),Apache-2.0,transitive,go,False,,a
deploy/operator,k8s.io/kube-openapi/pkg/internal/third_party/go-json-experiment/json,(see go.sum),BSD-3-Clause,transitive,go,False,,a
deploy/operator,k8s.io/kube-openapi/pkg/validation/spec,(see go.sum),Apache-2.0,transitive,go,False,,a
deploy/operator,k8s.io/utils,(see go.sum),Apache-2.0,transitive,go,False,,a
deploy/operator,k8s.io/utils/internal/third_party/forked/golang/net,(see go.sum),BSD-3-Clause,transitive,go,False,,a
deploy/operator,sigs.k8s.io/controller-runtime,(see go.sum),Apache-2.0,direct,go,False,,a
deploy/operator,sigs.k8s.io/json,(see go.sum),Apache-2.0,transitive,go,False,,a
deploy/operator,sigs.k8s.io/structured-merge-diff/v4,(see go.sum),Apache-2.0,transitive,go,False,,a
deploy/operator,sigs.k8s.io/yaml,(see go.sum),Apache-2.0,transitive,go,False,,a
deploy/operator,sigs.k8s.io/yaml/goyaml.v2,(see go.sum),Apache-2.0,transitive,go,False,,a
terraform,github.com/fatih/color,(see go.sum),MIT,transitive,go,False,,a
terraform,github.com/golang/protobuf/ptypes/empty,(see go.sum),BSD-3-Clause,transitive,go,False,,a
terraform,github.com/hashicorp/go-hclog,(see go.sum),MIT,transitive,go,False,,a
terraform,github.com/hashicorp/go-plugin,(see go.sum),MPL-2.0,transitive,go,True,"MPL-2.0: flagged for explicit per-item citation per policy, not because it's expected to block",a
terraform,github.com/hashicorp/go-uuid,(see go.sum),MPL-2.0,transitive,go,True,"MPL-2.0: flagged for explicit per-item citation per policy, not because it's expected to block",a
terraform,github.com/hashicorp/terraform-plugin-framework,(see go.sum),MPL-2.0,direct,go,True,"MPL-2.0: flagged for explicit per-item citation per policy, not because it's expected to block",a
terraform,github.com/hashicorp/terraform-plugin-go,(see go.sum),MPL-2.0,direct,go,True,"MPL-2.0: flagged for explicit per-item citation per policy, not because it's expected to block",a
terraform,github.com/hashicorp/terraform-plugin-log,(see go.sum),MPL-2.0,transitive,go,True,"MPL-2.0: flagged for explicit per-item citation per policy, not because it's expected to block",a
terraform,github.com/hashicorp/terraform-registry-address,(see go.sum),MPL-2.0,transitive,go,True,"MPL-2.0: flagged for explicit per-item citation per policy, not because it's expected to block",a
terraform,github.com/hashicorp/terraform-svchost,(see go.sum),MPL-2.0,transitive,go,True,"MPL-2.0: flagged for explicit per-item citation per policy, not because it's expected to block",a
terraform,github.com/hashicorp/yamux,(see go.sum),MPL-2.0,transitive,go,True,"MPL-2.0: flagged for explicit per-item citation per policy, not because it's expected to block",a
terraform,github.com/mattn/go-colorable,(see go.sum),MIT,transitive,go,False,,a
terraform,github.com/mattn/go-isatty,(see go.sum),MIT,transitive,go,False,,a
terraform,github.com/mitchellh/go-testing-interface,(see go.sum),MIT,transitive,go,False,,a
terraform,github.com/oklog/run,(see go.sum),Apache-2.0,transitive,go,False,,a
terraform,github.com/vmihailenco/msgpack/v5,(see go.sum),BSD-2-Clause,transitive,go,False,,a
terraform,github.com/vmihailenco/tagparser/v2,(see go.sum),BSD-2-Clause,transitive,go,False,,a
terraform,golang.org/x/net,(see go.sum),BSD-3-Clause,transitive,go,False,,a
terraform,golang.org/x/sys/unix,(see go.sum),BSD-3-Clause,transitive,go,False,,a
terraform,golang.org/x/text,(see go.sum),BSD-3-Clause,transitive,go,False,,a
terraform,google.golang.org/genproto/googleapis/rpc/status,(see go.sum),Apache-2.0,transitive,go,False,,a
terraform,google.golang.org/grpc,(see go.sum),Apache-2.0,transitive,go,False,,a
terraform,google.golang.org/protobuf,(see go.sum),BSD-3-Clause,transitive,go,False,,a
proto,golang.org/x/net,(see go.sum),BSD-3-Clause,transitive,go,False,,a
proto,golang.org/x/sys/unix,(see go.sum),BSD-3-Clause,transitive,go,False,,a
proto,golang.org/x/text,(see go.sum),BSD-3-Clause,transitive,go,False,,a
proto,google.golang.org/genproto/googleapis/rpc/status,(see go.sum),Apache-2.0,transitive,go,False,,a
proto,google.golang.org/grpc,(see go.sum),Apache-2.0,direct,go,False,,a
proto,google.golang.org/protobuf,(see go.sum),BSD-3-Clause,direct,go,False,,a
hack/benchmark-fixture,golang.org/x/net,(see go.sum),BSD-3-Clause,transitive,go,False,,a
hack/benchmark-fixture,golang.org/x/sys/unix,(see go.sum),BSD-3-Clause,transitive,go,False,,a
hack/benchmark-fixture,golang.org/x/text,(see go.sum),BSD-3-Clause,transitive,go,False,,a
hack/benchmark-fixture,google.golang.org/genproto/googleapis/rpc/status,(see go.sum),Apache-2.0,transitive,go,False,,a
hack/benchmark-fixture,google.golang.org/grpc,(see go.sum),Apache-2.0,direct,go,False,,a
hack/benchmark-fixture,google.golang.org/protobuf,(see go.sum),BSD-3-Clause,transitive,go,False,,a
hack/windows-fixture,golang.org/x/net,(see go.sum),BSD-3-Clause,transitive,go,False,,a
hack/windows-fixture,golang.org/x/sys/unix,(see go.sum),BSD-3-Clause,transitive,go,False,,a
hack/windows-fixture,golang.org/x/text,(see go.sum),BSD-3-Clause,transitive,go,False,,a
hack/windows-fixture,google.golang.org/genproto/googleapis/rpc/status,(see go.sum),Apache-2.0,transitive,go,False,,a
hack/windows-fixture,google.golang.org/grpc,(see go.sum),Apache-2.0,direct,go,False,,a
hack/windows-fixture,google.golang.org/protobuf,(see go.sum),BSD-3-Clause,transitive,go,False,,a
web,@codemirror/autocomplete,6.20.3,MIT,direct,npm,False,,a
web,@codemirror/commands,6.10.4,MIT,direct,npm,False,,a
web,@codemirror/language,6.12.4,MIT,direct,npm,False,,a
web,@codemirror/state,6.7.1,MIT,direct,npm,False,,a
web,@codemirror/view,6.43.8,MIT,direct,npm,False,,a
web,@jridgewell/gen-mapping,0.3.13,MIT,transitive,npm,False,,a
web,@jridgewell/remapping,2.3.5,MIT,transitive,npm,False,,a
web,@jridgewell/resolve-uri,3.1.2,MIT,transitive,npm,False,,a
web,@jridgewell/sourcemap-codec,1.5.5,MIT,transitive,npm,False,,a
web,@jridgewell/trace-mapping,0.3.31,MIT,transitive,npm,False,,a
web,@lezer/common,1.5.2,MIT,transitive,npm,False,,a
web,@lezer/highlight,1.2.3,MIT,transitive,npm,False,,a
web,@lezer/lr,1.4.10,MIT,transitive,npm,False,,a
web,@marijn/find-cluster-break,1.0.3,MIT,transitive,npm,False,,a
web,@oxc-project/types,0.144.0,MIT,transitive,npm,False,,a
web,@polka/url,1.0.0-next.29,MIT,transitive,npm,False,,a
web,@rolldown/binding-linux-x64-gnu,1.2.4,MIT,transitive,npm,False,,a
web,@rolldown/pluginutils,1.0.1,MIT,transitive,npm,False,,a
web,@standard-schema/spec,1.1.0,MIT,transitive,npm,False,,a
web,@sveltejs/acorn-typescript,1.0.13,MIT,transitive,npm,False,,a
web,@sveltejs/adapter-static,3.0.10,MIT,direct,npm,False,,a
web,@sveltejs/kit,2.70.2,MIT,direct,npm,False,,a
web,@sveltejs/load-config,0.2.3,MIT,transitive,npm,False,,a
web,@sveltejs/vite-plugin-svelte,7.3.0,MIT,direct,npm,False,,a
web,@types/cookie,0.6.0,MIT,transitive,npm,False,,a
web,@types/estree,1.0.9,MIT,transitive,npm,False,,a
web,@types/trusted-types,2.0.7,MIT,transitive,npm,False,,a
web,acorn,8.18.0,MIT,transitive,npm,False,,a
web,aria-query,5.3.1,Apache-2.0,transitive,npm,False,,a
web,axe-core,4.13.0,MPL-2.0,direct,npm,True,"MPL-2.0: file-level copyleft, generally fine as a dependency per policy -- flagged for explicit citation, not because it's expected to block",a
web,axobject-query,4.1.0,Apache-2.0,transitive,npm,False,,a
web,chokidar,4.0.3,MIT,transitive,npm,False,,a
web,clsx,2.1.1,MIT,transitive,npm,False,,a
web,cookie,0.6.0,MIT,transitive,npm,False,,a
web,crelt,1.0.7,MIT,transitive,npm,False,,a
web,deepmerge,4.3.1,MIT,transitive,npm,False,,a
web,detect-libc,2.1.2,Apache-2.0,transitive,npm,False,,a
web,devalue,5.9.0,MIT,transitive,npm,False,,a
web,echarts,6.1.0,Apache-2.0,direct,npm,False,,a
web,esm-env,1.2.2,MIT,transitive,npm,False,,a
web,esrap,2.3.2,MIT,transitive,npm,False,,a
web,fdir,6.5.0,MIT,transitive,npm,False,,a
web,gridstack,11.5.1,MIT,direct,npm,False,,a
web,is-reference,3.0.3,MIT,transitive,npm,False,,a
web,kleur,4.1.5,MIT,transitive,npm,False,,a
web,lightningcss-linux-x64-gnu,1.33.0,MPL-2.0,transitive,npm,True,"MPL-2.0: file-level copyleft, generally fine as a dependency per policy -- flagged for explicit citation, not because it's expected to block",a
web,lightningcss,1.33.0,MPL-2.0,transitive,npm,True,"MPL-2.0: file-level copyleft, generally fine as a dependency per policy -- flagged for explicit citation, not because it's expected to block",a
web,locate-character,3.0.0,MIT,transitive,npm,False,,a
web,magic-string,0.30.21,MIT,transitive,npm,False,,a
web,magic-string,1.2.0,MIT,transitive,npm,False,,a
web,mri,1.2.0,MIT,transitive,npm,False,,a
web,mrmime,2.0.1,MIT,transitive,npm,False,,a
web,nanoid,3.3.18,MIT,transitive,npm,False,,a
web,obug,2.1.4,MIT,transitive,npm,False,,a
web,picocolors,1.1.1,ISC,transitive,npm,False,,a
web,picomatch,4.0.5,MIT,transitive,npm,False,,a
web,postcss,8.5.26,MIT,transitive,npm,False,,a
web,readdirp,4.1.2,MIT,transitive,npm,False,,a
web,rolldown,1.2.4,MIT,transitive,npm,False,,a
web,sade,1.8.1,MIT,transitive,npm,False,,a
web,set-cookie-parser,3.1.2,MIT,transitive,npm,False,,a
web,sirv,3.0.2,MIT,transitive,npm,False,,a
web,source-map-js,1.2.1,BSD-3-Clause,transitive,npm,False,,a
web,style-mod,4.1.3,MIT,transitive,npm,False,,a
web,svelte-check,4.7.6,MIT,direct,npm,False,,a
web,svelte,5.56.9,MIT,direct,npm,False,,a
web,tinyglobby,0.2.17,MIT,transitive,npm,False,,a
web,totalist,3.0.1,MIT,transitive,npm,False,,a
web,tslib,2.3.0,0BSD,transitive,npm,False,,a
web,typescript,6.0.3,Apache-2.0,direct,npm,False,,a
web,vite,8.2.1,MIT,direct,npm,False,,a
web,vitefu,1.1.3,MIT,transitive,npm,False,,a
web,w3c-keyname,2.2.8,MIT,transitive,npm,False,,a
web,zimmerframe,1.1.4,MIT,transitive,npm,False,,a
web,zrender,6.1.0,BSD-3-Clause,transitive,npm,False,,a
agent,anstream,1.0.0,Apache-2.0 OR MIT,transitive,rust,False,,a
agent,anstyle,1.0.14,Apache-2.0 OR MIT,transitive,rust,False,,a
agent,anstyle-parse,1.0.0,Apache-2.0 OR MIT,transitive,rust,False,,a
agent,anstyle-query,1.1.5,Apache-2.0 OR MIT,transitive,rust,False,,a
agent,anstyle-wincon,3.0.11,Apache-2.0 OR MIT,transitive,rust,False,,a
agent,anyhow,1.0.104,Apache-2.0 OR MIT,direct,rust,False,,a
agent,async-stream,0.3.6,MIT,transitive,rust,False,,a
agent,async-stream-impl,0.3.6,MIT,transitive,rust,False,,a
agent,async-trait,0.1.92,Apache-2.0 OR MIT,transitive,rust,False,,a
agent,atomic-waker,1.1.2,Apache-2.0 OR MIT,transitive,rust,False,,a
agent,autocfg,1.5.1,Apache-2.0 OR MIT,transitive,rust,False,,a
agent,axum,0.7.9,MIT,transitive,rust,False,,a
agent,axum-core,0.4.5,MIT,transitive,rust,False,,a
agent,base64,0.22.1,Apache-2.0 OR MIT,transitive,rust,False,,a
agent,bitflags,2.13.1,Apache-2.0 OR MIT,transitive,rust,False,,a
agent,bytes,1.12.1,MIT,transitive,rust,False,,a
agent,cc,1.4.2,Apache-2.0 OR MIT,transitive,rust,False,,a
agent,cfg-if,1.0.4,Apache-2.0 OR MIT,transitive,rust,False,,a
agent,clap,4.6.6,Apache-2.0 OR MIT,direct,rust,False,,a
agent,clap_builder,4.6.6,Apache-2.0 OR MIT,transitive,rust,False,,a
agent,clap_derive,4.6.4,Apache-2.0 OR MIT,transitive,rust,False,,a
agent,clap_lex,1.1.0,Apache-2.0 OR MIT,transitive,rust,False,,a
agent,colorchoice,1.0.5,Apache-2.0 OR MIT,transitive,rust,False,,a
agent,either,1.17.0,Apache-2.0 OR MIT,transitive,rust,False,,a
agent,equivalent,1.0.2,Apache-2.0 OR MIT,transitive,rust,False,,a
agent,errno,0.3.14,Apache-2.0 OR MIT,transitive,rust,False,,a
agent,fastrand,2.5.0,Apache-2.0 OR MIT,transitive,rust,False,,a
agent,find-msvc-tools,0.1.10,Apache-2.0 OR MIT,transitive,rust,False,,a
agent,fixedbitset,0.5.7,Apache-2.0 OR MIT,transitive,rust,False,,a
agent,fnv,1.0.7,Apache-2.0 OR MIT,transitive,rust,False,,a
agent,futures-channel,0.3.34,Apache-2.0 OR MIT,transitive,rust,False,,a
agent,futures-core,0.3.34,Apache-2.0 OR MIT,transitive,rust,False,,a
agent,futures-sink,0.3.34,Apache-2.0 OR MIT,transitive,rust,False,,a
agent,futures-task,0.3.34,Apache-2.0 OR MIT,transitive,rust,False,,a
agent,futures-util,0.3.34,Apache-2.0 OR MIT,transitive,rust,False,,a
agent,getrandom,0.2.17,Apache-2.0 OR MIT,transitive,rust,False,,a
agent,getrandom,0.4.3,Apache-2.0 OR MIT,transitive,rust,False,,a
agent,h2,0.4.15,MIT,transitive,rust,False,,a
agent,hashbrown,0.12.3,Apache-2.0 OR MIT,transitive,rust,False,,a
agent,hashbrown,0.17.1,Apache-2.0 OR MIT,transitive,rust,False,,a
agent,heck,0.5.0,Apache-2.0 OR MIT,transitive,rust,False,,a
agent,http,1.5.0,Apache-2.0 OR MIT,transitive,rust,False,,a
agent,http-body,1.1.0,MIT,transitive,rust,False,,a
agent,http-body-util,0.1.5,MIT,transitive,rust,False,,a
agent,httparse,1.10.1,Apache-2.0 OR MIT,transitive,rust,False,,a
agent,httpdate,1.0.3,Apache-2.0 OR MIT,transitive,rust,False,,a
agent,hyper,1.11.0,MIT,transitive,rust,False,,a
agent,hyper-timeout,0.5.2,Apache-2.0 OR MIT,transitive,rust,False,,a
agent,hyper-util,0.1.20,MIT,transitive,rust,False,,a
agent,indexmap,1.9.3,Apache-2.0 OR MIT,transitive,rust,False,,a
agent,indexmap,2.14.0,Apache-2.0 OR MIT,transitive,rust,False,,a
agent,is_terminal_polyfill,1.70.2,Apache-2.0 OR MIT,transitive,rust,False,,a
agent,itertools,0.14.0,Apache-2.0 OR MIT,transitive,rust,False,,a
agent,itoa,1.0.18,Apache-2.0 OR MIT,transitive,rust,False,,a
agent,lazy_static,1.5.0,Apache-2.0 OR MIT,transitive,rust,False,,a
agent,libc,0.2.189,Apache-2.0 OR MIT,transitive,rust,False,,a
agent,linux-raw-sys,0.12.1,Apache-2.0 OR Apache-2.0 WITH LLVM-exception OR MIT,transitive,rust,False,,a
agent,log,0.4.33,Apache-2.0 OR MIT,transitive,rust,False,,a
agent,matchers,0.2.0,MIT,transitive,rust,False,,a
agent,matchit,0.7.3,BSD-3-Clause OR MIT,transitive,rust,False,,a
agent,memchr,2.8.3,MIT OR Unlicense,transitive,rust,False,,a
agent,mime,0.3.17,Apache-2.0 OR MIT,transitive,rust,False,,a
agent,mio,1.2.2,MIT,transitive,rust,False,,a
agent,multimap,0.10.1,Apache-2.0 OR MIT,transitive,rust,False,,a
agent,nu-ansi-term,0.50.3,MIT,transitive,rust,False,,a
agent,once_cell,1.21.4,Apache-2.0 OR MIT,transitive,rust,False,,a
agent,once_cell_polyfill,1.70.2,Apache-2.0 OR MIT,transitive,rust,False,,a
agent,percent-encoding,2.3.2,Apache-2.0 OR MIT,transitive,rust,False,,a
agent,petgraph,0.7.1,Apache-2.0 OR MIT,transitive,rust,False,,a
agent,pin-project,1.1.13,Apache-2.0 OR MIT,transitive,rust,False,,a
agent,pin-project-internal,1.1.13,Apache-2.0 OR MIT,transitive,rust,False,,a
agent,pin-project-lite,0.2.17,Apache-2.0 OR MIT,transitive,rust,False,,a
agent,ppv-lite86,0.2.21,Apache-2.0 OR MIT,transitive,rust,False,,a
agent,prettyplease,0.2.37,Apache-2.0 OR MIT,transitive,rust,False,,a
agent,proc-macro2,1.0.107,Apache-2.0 OR MIT,transitive,rust,False,,a
agent,prost,0.13.5,Apache-2.0,direct,rust,False,,a
agent,prost-build,0.13.5,Apache-2.0,transitive,rust,False,,a
agent,prost-derive,0.13.5,Apache-2.0,transitive,rust,False,,a
agent,prost-types,0.13.5,Apache-2.0,transitive,rust,False,,a
agent,quick-xml,0.36.2,MIT,direct,rust,False,,a
agent,quote,1.0.47,Apache-2.0 OR MIT,transitive,rust,False,,a
agent,r-efi,6.0.0,Apache-2.0 OR LGPL-2.1-or-later OR MIT,transitive,rust,True,carries a copyleft/less-common license alongside permissive alternatives (SPDX OR) -- see classification,a
agent,rand,0.8.7,Apache-2.0 OR MIT,transitive,rust,False,,a
agent,rand_chacha,0.3.1,Apache-2.0 OR MIT,transitive,rust,False,,a
agent,rand_core,0.6.4,Apache-2.0 OR MIT,transitive,rust,False,,a
agent,regex,1.13.1,Apache-2.0 OR MIT,transitive,rust,False,,a
agent,regex-automata,0.4.18,Apache-2.0 OR MIT,transitive,rust,False,,a
agent,regex-syntax,0.8.11,Apache-2.0 OR MIT,transitive,rust,False,,a
agent,ring,0.17.14,Apache-2.0 OR ISC,transitive,rust,False,,a
agent,rustix,1.1.4,Apache-2.0 OR Apache-2.0 WITH LLVM-exception OR MIT,transitive,rust,False,,a
agent,rustls,0.23.43,Apache-2.0 OR ISC OR MIT,transitive,rust,False,,a
agent,rustls-pemfile,2.2.0,Apache-2.0 OR ISC OR MIT,transitive,rust,False,,a
agent,rustls-pki-types,1.15.1,Apache-2.0 OR MIT,transitive,rust,False,,a
agent,rustls-webpki,0.103.14,ISC,transitive,rust,False,,a
agent,rustversion,1.0.23,Apache-2.0 OR MIT,transitive,rust,False,,a
agent,serde,1.0.229,Apache-2.0 OR MIT,direct,rust,False,,a
agent,serde_core,1.0.229,Apache-2.0 OR MIT,transitive,rust,False,,a
agent,serde_derive,1.0.229,Apache-2.0 OR MIT,transitive,rust,False,,a
agent,serde_json,1.0.151,Apache-2.0 OR MIT,direct,rust,False,,a
agent,serde_spanned,0.6.9,Apache-2.0 OR MIT,transitive,rust,False,,a
agent,sharded-slab,0.1.7,MIT,transitive,rust,False,,a
agent,shlex,2.0.1,Apache-2.0 OR MIT,transitive,rust,False,,a
agent,signal-hook-registry,1.4.8,Apache-2.0 OR MIT,transitive,rust,False,,a
agent,slab,0.4.12,MIT,transitive,rust,False,,a
agent,smallvec,1.15.2,Apache-2.0 OR MIT,transitive,rust,False,,a
agent,socket2,0.5.10,Apache-2.0 OR MIT,transitive,rust,False,,a
agent,socket2,0.6.5,Apache-2.0 OR MIT,transitive,rust,False,,a
agent,strsim,0.11.1,MIT,transitive,rust,False,,a
agent,subtle,2.6.1,BSD-3-Clause,transitive,rust,False,,a
agent,syn,2.0.119,Apache-2.0 OR MIT,transitive,rust,False,,a
agent,syn,3.0.3,Apache-2.0 OR MIT,transitive,rust,False,,a
agent,sync_wrapper,1.0.2,Apache-2.0,transitive,rust,False,,a
agent,tempfile,3.27.0,Apache-2.0 OR MIT,transitive,rust,False,,a
agent,thread_local,1.1.10,Apache-2.0 OR MIT,transitive,rust,False,,a
agent,tokio,1.53.1,MIT,direct,rust,False,,a
agent,tokio-macros,2.7.2,MIT,transitive,rust,False,,a
agent,tokio-rustls,0.26.4,Apache-2.0 OR MIT,transitive,rust,False,,a
agent,tokio-stream,0.1.19,MIT,transitive,rust,False,,a
agent,tokio-util,0.7.19,MIT,transitive,rust,False,,a
agent,toml,0.8.23,Apache-2.0 OR MIT,direct,rust,False,,a
agent,toml_datetime,0.6.11,Apache-2.0 OR MIT,transitive,rust,False,,a
agent,toml_edit,0.22.27,Apache-2.0 OR MIT,transitive,rust,False,,a
agent,toml_write,0.1.2,Apache-2.0 OR MIT,transitive,rust,False,,a
agent,tonic,0.12.3,MIT,direct,rust,False,,a
agent,tonic-build,0.12.3,MIT,direct,rust,False,,a
agent,tower,0.4.13,MIT,transitive,rust,False,,a
agent,tower,0.5.3,MIT,transitive,rust,False,,a
agent,tower-layer,0.3.3,MIT,transitive,rust,False,,a
agent,tower-service,0.3.3,MIT,transitive,rust,False,,a
agent,tracing,0.1.44,MIT,direct,rust,False,,a
agent,tracing-attributes,0.1.31,MIT,transitive,rust,False,,a
agent,tracing-core,0.1.36,MIT,transitive,rust,False,,a
agent,tracing-log,0.2.0,MIT,transitive,rust,False,,a
agent,tracing-subscriber,0.3.23,MIT,direct,rust,False,,a
agent,try-lock,0.2.5,MIT,transitive,rust,False,,a
agent,unicode-ident,1.0.24,Apache-2.0 OR MIT OR Unicode-3.0,transitive,rust,False,,a
agent,untrusted,0.9.0,ISC,transitive,rust,False,,a
agent,utf8parse,0.2.2,Apache-2.0 OR MIT,transitive,rust,False,,a
agent,want,0.3.1,MIT,transitive,rust,False,,a
agent,wasi,0.11.1+wasi-snapshot-preview1,Apache-2.0 OR Apache-2.0 WITH LLVM-exception OR MIT,transitive,rust,False,,a
agent,widestring,1.2.1,Apache-2.0 OR MIT,transitive,rust,False,,a
agent,windows,0.58.0,Apache-2.0 OR MIT,direct,rust,False,,a
agent,windows-core,0.58.0,Apache-2.0 OR MIT,transitive,rust,False,,a
agent,windows-implement,0.58.0,Apache-2.0 OR MIT,transitive,rust,False,,a
agent,windows-interface,0.58.0,Apache-2.0 OR MIT,transitive,rust,False,,a
agent,windows-link,0.2.1,Apache-2.0 OR MIT,transitive,rust,False,,a
agent,windows-result,0.2.0,Apache-2.0 OR MIT,transitive,rust,False,,a
agent,windows-service,0.7.0,Apache-2.0 OR MIT,direct,rust,False,,a
agent,windows-strings,0.1.0,Apache-2.0 OR MIT,transitive,rust,False,,a
agent,windows-sys,0.52.0,Apache-2.0 OR MIT,transitive,rust,False,,a
agent,windows-sys,0.61.2,Apache-2.0 OR MIT,transitive,rust,False,,a
agent,windows-targets,0.52.6,Apache-2.0 OR MIT,transitive,rust,False,,a
agent,windows_aarch64_gnullvm,0.52.6,Apache-2.0 OR MIT,transitive,rust,False,,a
agent,windows_aarch64_msvc,0.52.6,Apache-2.0 OR MIT,transitive,rust,False,,a
agent,windows_i686_gnu,0.52.6,Apache-2.0 OR MIT,transitive,rust,False,,a
agent,windows_i686_gnullvm,0.52.6,Apache-2.0 OR MIT,transitive,rust,False,,a
agent,windows_i686_msvc,0.52.6,Apache-2.0 OR MIT,transitive,rust,False,,a
agent,windows_x86_64_gnu,0.52.6,Apache-2.0 OR MIT,transitive,rust,False,,a
agent,windows_x86_64_gnullvm,0.52.6,Apache-2.0 OR MIT,transitive,rust,False,,a
agent,windows_x86_64_msvc,0.52.6,Apache-2.0 OR MIT,transitive,rust,False,,a
agent,winnow,0.7.15,MIT,transitive,rust,False,,a
agent,zerocopy,0.8.56,Apache-2.0 OR BSD-2-Clause OR MIT,transitive,rust,False,,a
agent,zeroize,1.9.0,Apache-2.0 OR MIT,transitive,rust,False,,a
agent,zmij,1.0.23,MIT,transitive,rust,False,,a
search,adler2,2.0.1,0BSD OR Apache-2.0 OR MIT,transitive,rust,False,,a
search,aho-corasick,1.1.5,MIT OR Unlicense,transitive,rust,False,,a
search,allocator-api2,0.2.21,Apache-2.0 OR MIT,transitive,rust,False,,a
search,anyhow,1.0.104,Apache-2.0 OR MIT,direct,rust,False,,a
search,arc-swap,1.9.2,Apache-2.0 OR MIT,transitive,rust,False,,a
search,async-stream,0.3.6,MIT,transitive,rust,False,,a
search,async-stream-impl,0.3.6,MIT,transitive,rust,False,,a
search,async-trait,0.1.92,Apache-2.0 OR MIT,transitive,rust,False,,a
search,atomic-waker,1.1.2,Apache-2.0 OR MIT,transitive,rust,False,,a
search,autocfg,1.5.1,Apache-2.0 OR MIT,transitive,rust,False,,a
search,axum,0.7.9,MIT,transitive,rust,False,,a
search,axum-core,0.4.5,MIT,transitive,rust,False,,a
search,base64,0.22.1,Apache-2.0 OR MIT,transitive,rust,False,,a
search,bitflags,2.13.1,Apache-2.0 OR MIT,transitive,rust,False,,a
search,bitpacking,0.9.3,MIT,transitive,rust,False,,a
search,block-buffer,0.10.4,Apache-2.0 OR MIT,transitive,rust,False,,a
search,bumpalo,3.20.3,Apache-2.0 OR MIT,transitive,rust,False,,a
search,byteorder,1.5.0,MIT OR Unlicense,transitive,rust,False,,a
search,bytes,1.12.1,MIT,transitive,rust,False,,a
search,cc,1.4.2,Apache-2.0 OR MIT,transitive,rust,False,,a
search,census,0.4.2,MIT,transitive,rust,False,,a
search,cfg-if,1.0.4,Apache-2.0 OR MIT,transitive,rust,False,,a
search,chrono,0.4.45,Apache-2.0 OR MIT,transitive,rust,False,,a
search,cpufeatures,0.2.17,Apache-2.0 OR MIT,transitive,rust,False,,a
search,crc32c,0.6.8,Apache-2.0 OR MIT,transitive,rust,False,,a
search,crc32fast,1.5.0,Apache-2.0 OR MIT,transitive,rust,False,,a
search,crossbeam-channel,0.5.16,Apache-2.0 OR MIT,transitive,rust,False,,a
search,crossbeam-deque,0.8.7,Apache-2.0 OR MIT,transitive,rust,False,,a
search,crossbeam-epoch,0.9.20,Apache-2.0 OR MIT,transitive,rust,False,,a
search,crossbeam-utils,0.8.22,Apache-2.0 OR MIT,transitive,rust,False,,a
search,crunchy,0.2.4,MIT,transitive,rust,False,,a
search,crypto-common,0.1.7,Apache-2.0 OR MIT,transitive,rust,False,,a
search,deranged,0.5.8,Apache-2.0 OR MIT,transitive,rust,False,,a
search,digest,0.10.7,Apache-2.0 OR MIT,transitive,rust,False,,a
search,displaydoc,0.2.7,Apache-2.0 OR MIT,transitive,rust,False,,a
search,downcast-rs,1.2.1,Apache-2.0 OR MIT,transitive,rust,False,,a
search,either,1.17.0,Apache-2.0 OR MIT,transitive,rust,False,,a
search,equivalent,1.0.2,Apache-2.0 OR MIT,transitive,rust,False,,a
search,errno,0.3.14,Apache-2.0 OR MIT,transitive,rust,False,,a
search,fastdivide,0.4.2,MIT OR zlib-acknowledgement,transitive,rust,True,carries a copyleft/less-common license alongside permissive alternatives (SPDX OR) -- see classification,a
search,fastrand,2.5.0,Apache-2.0 OR MIT,transitive,rust,False,,a
search,find-msvc-tools,0.1.10,Apache-2.0 OR MIT,transitive,rust,False,,a
search,fixedbitset,0.5.7,Apache-2.0 OR MIT,transitive,rust,False,,a
search,flate2,1.1.9,Apache-2.0 OR MIT,transitive,rust,False,,a
search,fnv,1.0.7,Apache-2.0 OR MIT,transitive,rust,False,,a
search,foldhash,0.1.5,Zlib,transitive,rust,False,,a
search,form_urlencoded,1.2.2,Apache-2.0 OR MIT,transitive,rust,False,,a
search,fs4,0.8.4,Apache-2.0 OR MIT,transitive,rust,False,,a
search,futures,0.3.34,Apache-2.0 OR MIT,transitive,rust,False,,a
search,futures-channel,0.3.34,Apache-2.0 OR MIT,transitive,rust,False,,a
search,futures-core,0.3.34,Apache-2.0 OR MIT,transitive,rust,False,,a
search,futures-executor,0.3.34,Apache-2.0 OR MIT,transitive,rust,False,,a
search,futures-io,0.3.34,Apache-2.0 OR MIT,transitive,rust,False,,a
search,futures-macro,0.3.34,Apache-2.0 OR MIT,transitive,rust,False,,a
search,futures-sink,0.3.34,Apache-2.0 OR MIT,transitive,rust,False,,a
search,futures-task,0.3.34,Apache-2.0 OR MIT,transitive,rust,False,,a
search,futures-util,0.3.34,Apache-2.0 OR MIT,transitive,rust,False,,a
search,generic-array,0.14.7,MIT,transitive,rust,False,,a
search,getrandom,0.2.17,Apache-2.0 OR MIT,transitive,rust,False,,a
search,getrandom,0.4.3,Apache-2.0 OR MIT,transitive,rust,False,,a
search,h2,0.4.15,MIT,transitive,rust,False,,a
search,hashbrown,0.12.3,Apache-2.0 OR MIT,transitive,rust,False,,a
search,hashbrown,0.15.5,Apache-2.0 OR MIT,transitive,rust,False,,a
search,hashbrown,0.17.1,Apache-2.0 OR MIT,transitive,rust,False,,a
search,heck,0.5.0,Apache-2.0 OR MIT,transitive,rust,False,,a
search,hermit-abi,0.5.2,Apache-2.0 OR MIT,transitive,rust,False,,a
search,hmac,0.12.1,Apache-2.0 OR MIT,transitive,rust,False,,a
search,htmlescape,0.3.1,Apache-2.0 OR MIT OR MPL-2.0,transitive,rust,True,carries a copyleft/less-common license alongside permissive alternatives (SPDX OR) -- see classification,a
search,http,1.5.0,Apache-2.0 OR MIT,transitive,rust,False,,a
search,http-body,1.1.0,MIT,transitive,rust,False,,a
search,http-body-util,0.1.5,MIT,transitive,rust,False,,a
search,httparse,1.10.1,Apache-2.0 OR MIT,transitive,rust,False,,a
search,httpdate,1.0.3,Apache-2.0 OR MIT,transitive,rust,False,,a
search,hyper,1.11.0,MIT,transitive,rust,False,,a
search,hyper-timeout,0.5.2,Apache-2.0 OR MIT,transitive,rust,False,,a
search,hyper-util,0.1.20,MIT,transitive,rust,False,,a
search,icu_collections,2.3.0,Unicode-3.0,transitive,rust,False,,a
search,icu_locale_core,2.3.0,Unicode-3.0,transitive,rust,False,,a
search,icu_normalizer,2.3.0,Unicode-3.0,transitive,rust,False,,a
search,icu_normalizer_data,2.3.0,Unicode-3.0,transitive,rust,False,,a
search,icu_properties,2.3.0,Unicode-3.0,transitive,rust,False,,a
search,icu_properties_data,2.3.0,Unicode-3.0,transitive,rust,False,,a
search,icu_provider,2.3.0,Unicode-3.0,transitive,rust,False,,a
search,idna,1.1.0,Apache-2.0 OR MIT,transitive,rust,False,,a
search,idna_adapter,1.2.2,Apache-2.0 OR MIT,transitive,rust,False,,a
search,indexmap,1.9.3,Apache-2.0 OR MIT,transitive,rust,False,,a
search,indexmap,2.14.0,Apache-2.0 OR MIT,transitive,rust,False,,a
search,instant,0.1.13,BSD-3-Clause,transitive,rust,False,,a
search,integer-encoding,4.1.0,MIT,transitive,rust,False,,a
search,ipnet,2.12.1,Apache-2.0 OR MIT,transitive,rust,False,,a
search,itertools,0.12.1,Apache-2.0 OR MIT,transitive,rust,False,,a
search,itertools,0.14.0,Apache-2.0 OR MIT,transitive,rust,False,,a
search,itoa,1.0.18,Apache-2.0 OR MIT,transitive,rust,False,,a
search,jobserver,0.1.35,Apache-2.0 OR MIT,transitive,rust,False,,a
search,js-sys,0.3.104,Apache-2.0 OR MIT,transitive,rust,False,,a
search,lazy_static,1.5.0,Apache-2.0 OR MIT,transitive,rust,False,,a
search,levenshtein_automata,0.2.1,MIT,transitive,rust,False,,a
search,libc,0.2.189,Apache-2.0 OR MIT,transitive,rust,False,,a
search,libm,0.2.16,MIT,transitive,rust,False,,a
search,linux-raw-sys,0.12.1,Apache-2.0 OR Apache-2.0 WITH LLVM-exception OR MIT,transitive,rust,False,,a
search,linux-raw-sys,0.4.15,Apache-2.0 OR Apache-2.0 WITH LLVM-exception OR MIT,transitive,rust,False,,a
search,litemap,0.8.3,Unicode-3.0,transitive,rust,False,,a
search,lock_api,0.4.14,Apache-2.0 OR MIT,transitive,rust,False,,a
search,log,0.4.33,Apache-2.0 OR MIT,transitive,rust,False,,a
search,lru,0.12.5,MIT,transitive,rust,False,,a
search,lz4,1.28.1,MIT,transitive,rust,False,,a
search,lz4-sys,1.11.1+lz4-1.10.0,MIT,transitive,rust,False,,a
search,lz4_flex,0.11.6,MIT,transitive,rust,False,,a
search,matchers,0.2.0,MIT,transitive,rust,False,,a
search,matchit,0.7.3,BSD-3-Clause OR MIT,transitive,rust,False,,a
search,measure_time,0.8.3,MIT,transitive,rust,False,,a
search,memchr,2.8.3,MIT OR Unlicense,transitive,rust,False,,a
search,memmap2,0.9.11,Apache-2.0 OR MIT,transitive,rust,False,,a
search,mime,0.3.17,Apache-2.0 OR MIT,transitive,rust,False,,a
search,minimal-lexical,0.2.1,Apache-2.0 OR MIT,transitive,rust,False,,a
search,miniz_oxide,0.8.9,Apache-2.0 OR MIT OR Zlib,transitive,rust,False,,a
search,mio,1.2.2,MIT,transitive,rust,False,,a
search,multimap,0.10.1,Apache-2.0 OR MIT,transitive,rust,False,,a
search,murmurhash32,0.3.1,MIT,transitive,rust,False,,a
search,nom,7.1.3,MIT,transitive,rust,False,,a
search,nu-ansi-term,0.50.3,MIT,transitive,rust,False,,a
search,num-conv,0.2.2,Apache-2.0 OR MIT,transitive,rust,False,,a
search,num-traits,0.2.19,Apache-2.0 OR MIT,transitive,rust,False,,a
search,num_cpus,1.17.0,Apache-2.0 OR MIT,transitive,rust,False,,a
search,once_cell,1.21.4,Apache-2.0 OR MIT,transitive,rust,False,,a
search,oneshot,0.1.13,Apache-2.0 OR MIT,transitive,rust,False,,a
search,ownedbytes,0.7.0,MIT,transitive,rust,False,,a
search,parking_lot,0.12.5,Apache-2.0 OR MIT,transitive,rust,False,,a
search,parking_lot_core,0.9.12,Apache-2.0 OR MIT,transitive,rust,False,,a
search,pbkdf2,0.12.2,Apache-2.0 OR MIT,transitive,rust,False,,a
search,percent-encoding,2.3.2,Apache-2.0 OR MIT,transitive,rust,False,,a
search,petgraph,0.7.1,Apache-2.0 OR MIT,transitive,rust,False,,a
search,pin-project,1.1.13,Apache-2.0 OR MIT,transitive,rust,False,,a
search,pin-project-internal,1.1.13,Apache-2.0 OR MIT,transitive,rust,False,,a
search,pin-project-lite,0.2.17,Apache-2.0 OR MIT,transitive,rust,False,,a
search,pkg-config,0.3.33,Apache-2.0 OR MIT,transitive,rust,False,,a
search,potential_utf,0.1.6,Unicode-3.0,transitive,rust,False,,a
search,powerfmt,0.2.0,Apache-2.0 OR MIT,transitive,rust,False,,a
search,ppv-lite86,0.2.21,Apache-2.0 OR MIT,transitive,rust,False,,a
search,prettyplease,0.2.37,Apache-2.0 OR MIT,transitive,rust,False,,a
search,proc-macro2,1.0.107,Apache-2.0 OR MIT,transitive,rust,False,,a
search,prost,0.13.5,Apache-2.0,direct,rust,False,,a
search,prost-build,0.13.5,Apache-2.0,transitive,rust,False,,a
search,prost-derive,0.13.5,Apache-2.0,transitive,rust,False,,a
search,prost-types,0.13.5,Apache-2.0,transitive,rust,False,,a
search,quote,1.0.47,Apache-2.0 OR MIT,transitive,rust,False,,a
search,r-efi,6.0.0,Apache-2.0 OR LGPL-2.1-or-later OR MIT,transitive,rust,True,carries a copyleft/less-common license alongside permissive alternatives (SPDX OR) -- see classification,a
search,rand,0.8.7,Apache-2.0 OR MIT,transitive,rust,False,,a
search,rand_chacha,0.3.1,Apache-2.0 OR MIT,transitive,rust,False,,a
search,rand_core,0.6.4,Apache-2.0 OR MIT,transitive,rust,False,,a
search,rand_distr,0.4.3,Apache-2.0 OR MIT,transitive,rust,False,,a
search,rayon,1.12.0,Apache-2.0 OR MIT,transitive,rust,False,,a
search,rayon-core,1.13.0,Apache-2.0 OR MIT,transitive,rust,False,,a
search,redox_syscall,0.5.18,MIT,transitive,rust,False,,a
search,regex,1.13.1,Apache-2.0 OR MIT,transitive,rust,False,,a
search,regex-automata,0.4.18,Apache-2.0 OR MIT,transitive,rust,False,,a
search,regex-syntax,0.8.11,Apache-2.0 OR MIT,transitive,rust,False,,a
search,reqwest,0.12.28,Apache-2.0 OR MIT,direct,rust,False,,a
search,rsasl,2.3.1,Apache-2.0 OR MIT,transitive,rust,False,,a
search,rskafka,0.6.0,Apache-2.0 OR MIT,direct,rust,False,,a
search,rust-stemmers,1.2.0,BSD-3-Clause OR MIT,transitive,rust,False,,a
search,rustc-hash,1.1.0,Apache-2.0 OR MIT,transitive,rust,False,,a
search,rustc_version,0.4.1,Apache-2.0 OR MIT,transitive,rust,False,,a
search,rustix,0.38.44,Apache-2.0 OR Apache-2.0 WITH LLVM-exception OR MIT,transitive,rust,False,,a
search,rustix,1.1.4,Apache-2.0 OR Apache-2.0 WITH LLVM-exception OR MIT,transitive,rust,False,,a
search,rustversion,1.0.23,Apache-2.0 OR MIT,transitive,rust,False,,a
search,ryu,1.0.23,Apache-2.0 OR BSL-1.0,transitive,rust,True,carries a copyleft/less-common license alongside permissive alternatives (SPDX OR) -- see classification,a
search,scopeguard,1.2.0,Apache-2.0 OR MIT,transitive,rust,False,,a
search,semver,1.0.28,Apache-2.0 OR MIT,transitive,rust,False,,a
search,serde,1.0.229,Apache-2.0 OR MIT,direct,rust,False,,a
search,serde_core,1.0.229,Apache-2.0 OR MIT,transitive,rust,False,,a
search,serde_derive,1.0.229,Apache-2.0 OR MIT,transitive,rust,False,,a
search,serde_json,1.0.151,Apache-2.0 OR MIT,direct,rust,False,,a
search,serde_urlencoded,0.7.1,Apache-2.0 OR MIT,transitive,rust,False,,a
search,sha2,0.10.9,Apache-2.0 OR MIT,transitive,rust,False,,a
search,sharded-slab,0.1.7,MIT,transitive,rust,False,,a
search,shlex,2.0.1,Apache-2.0 OR MIT,transitive,rust,False,,a
search,signal-hook-registry,1.4.8,Apache-2.0 OR MIT,transitive,rust,False,,a
search,simd-adler32,0.3.10,MIT,transitive,rust,False,,a
search,sketches-ddsketch,0.2.2,Apache-2.0,transitive,rust,False,,a
search,slab,0.4.12,MIT,transitive,rust,False,,a
search,smallvec,1.15.2,Apache-2.0 OR MIT,transitive,rust,False,,a
search,snap,1.1.2,BSD-3-Clause,transitive,rust,False,,a
search,socket2,0.5.10,Apache-2.0 OR MIT,transitive,rust,False,,a
search,socket2,0.6.5,Apache-2.0 OR MIT,transitive,rust,False,,a
search,stable_deref_trait,1.2.1,Apache-2.0 OR MIT,transitive,rust,False,,a
search,stringprep,0.1.5,Apache-2.0 OR MIT,transitive,rust,False,,a
search,subtle,2.6.1,BSD-3-Clause,transitive,rust,False,,a
search,syn,2.0.119,Apache-2.0 OR MIT,transitive,rust,False,,a
search,syn,3.0.3,Apache-2.0 OR MIT,transitive,rust,False,,a
search,sync_wrapper,1.0.2,Apache-2.0,transitive,rust,False,,a
search,synstructure,0.13.2,MIT,transitive,rust,False,,a
search,tantivy,0.22.1,MIT,direct,rust,False,,a
search,tantivy-bitpacker,0.6.0,MIT,transitive,rust,False,,a
search,tantivy-columnar,0.3.0,MIT,transitive,rust,False,,a
search,tantivy-common,0.7.0,MIT,transitive,rust,False,,a
search,tantivy-fst,0.5.0,MIT OR Unlicense,transitive,rust,False,,a
search,tantivy-query-grammar,0.22.0,MIT,transitive,rust,False,,a
search,tantivy-sstable,0.3.0,MIT,transitive,rust,False,,a
search,tantivy-stacker,0.3.0,MIT,transitive,rust,False,,a
search,tantivy-tokenizer-api,0.3.0,MIT,transitive,rust,False,,a
search,tempfile,3.27.0,Apache-2.0 OR MIT,direct,rust,False,,a
search,thiserror,1.0.69,Apache-2.0 OR MIT,transitive,rust,False,,a
search,thiserror,2.0.20,Apache-2.0 OR MIT,transitive,rust,False,,a
search,thiserror-impl,1.0.69,Apache-2.0 OR MIT,transitive,rust,False,,a
search,thiserror-impl,2.0.20,Apache-2.0 OR MIT,transitive,rust,False,,a
search,thread_local,1.1.10,Apache-2.0 OR MIT,transitive,rust,False,,a
search,time,0.3.55,Apache-2.0 OR MIT,transitive,rust,False,,a
search,time-core,0.1.9,Apache-2.0 OR MIT,transitive,rust,False,,a
search,tinystr,0.8.4,Unicode-3.0,transitive,rust,False,,a
search,tinyvec,1.12.0,Apache-2.0 OR MIT OR Zlib,transitive,rust,False,,a
search,tinyvec_macros,0.1.1,Apache-2.0 OR MIT OR Zlib,transitive,rust,False,,a
search,tokio,1.53.1,MIT,direct,rust,False,,a
search,tokio-macros,2.7.2,MIT,transitive,rust,False,,a
search,tokio-stream,0.1.19,MIT,transitive,rust,False,,a
search,tokio-util,0.7.19,MIT,transitive,rust,False,,a
search,tonic,0.12.3,MIT,direct,rust,False,,a
search,tonic-build,0.12.3,MIT,direct,rust,False,,a
search,tower,0.4.13,MIT,transitive,rust,False,,a
search,tower,0.5.3,MIT,transitive,rust,False,,a
search,tower-http,0.6.11,MIT,transitive,rust,False,,a
search,tower-layer,0.3.3,MIT,transitive,rust,False,,a
search,tower-service,0.3.3,MIT,transitive,rust,False,,a
search,tracing,0.1.44,MIT,direct,rust,False,,a
search,tracing-attributes,0.1.31,MIT,transitive,rust,False,,a
search,tracing-core,0.1.36,MIT,transitive,rust,False,,a
search,tracing-log,0.2.0,MIT,transitive,rust,False,,a
search,tracing-subscriber,0.3.23,MIT,direct,rust,False,,a
search,try-lock,0.2.5,MIT,transitive,rust,False,,a
search,typenum,1.20.1,Apache-2.0 OR MIT,transitive,rust,False,,a
search,unicode-bidi,0.3.18,Apache-2.0 OR MIT,transitive,rust,False,,a
search,unicode-ident,1.0.24,Apache-2.0 OR MIT OR Unicode-3.0,transitive,rust,False,,a
search,unicode-normalization,0.1.25,Apache-2.0 OR MIT,transitive,rust,False,,a
search,unicode-properties,0.1.4,Apache-2.0 OR MIT,transitive,rust,False,,a
search,url,2.5.8,Apache-2.0 OR MIT,transitive,rust,False,,a
search,utf8-ranges,1.0.5,MIT OR Unlicense,transitive,rust,False,,a
search,utf8_iter,1.0.4,Apache-2.0 OR MIT,transitive,rust,False,,a
search,uuid,1.24.0,Apache-2.0 OR MIT,transitive,rust,False,,a
search,version_check,0.9.5,Apache-2.0 OR MIT,transitive,rust,False,,a
search,want,0.3.1,MIT,transitive,rust,False,,a
search,wasi,0.11.1+wasi-snapshot-preview1,Apache-2.0 OR Apache-2.0 WITH LLVM-exception OR MIT,transitive,rust,False,,a
search,wasm-bindgen,0.2.127,Apache-2.0 OR MIT,transitive,rust,False,,a
search,wasm-bindgen-futures,0.4.77,Apache-2.0 OR MIT,transitive,rust,False,,a
search,wasm-bindgen-macro,0.2.127,Apache-2.0 OR MIT,transitive,rust,False,,a
search,wasm-bindgen-macro-support,0.2.127,Apache-2.0 OR MIT,transitive,rust,False,,a
search,wasm-bindgen-shared,0.2.127,Apache-2.0 OR MIT,transitive,rust,False,,a
search,web-sys,0.3.104,Apache-2.0 OR MIT,transitive,rust,False,,a
search,winapi,0.3.9,Apache-2.0 OR MIT,transitive,rust,False,,a
search,winapi-i686-pc-windows-gnu,0.4.0,Apache-2.0 OR MIT,transitive,rust,False,,a
search,winapi-x86_64-pc-windows-gnu,0.4.0,Apache-2.0 OR MIT,transitive,rust,False,,a
search,windows-link,0.2.1,Apache-2.0 OR MIT,transitive,rust,False,,a
search,windows-sys,0.52.0,Apache-2.0 OR MIT,transitive,rust,False,,a
search,windows-sys,0.59.0,Apache-2.0 OR MIT,transitive,rust,False,,a
search,windows-sys,0.61.2,Apache-2.0 OR MIT,transitive,rust,False,,a
search,windows-targets,0.52.6,Apache-2.0 OR MIT,transitive,rust,False,,a
search,windows_aarch64_gnullvm,0.52.6,Apache-2.0 OR MIT,transitive,rust,False,,a
search,windows_aarch64_msvc,0.52.6,Apache-2.0 OR MIT,transitive,rust,False,,a
search,windows_i686_gnu,0.52.6,Apache-2.0 OR MIT,transitive,rust,False,,a
search,windows_i686_gnullvm,0.52.6,Apache-2.0 OR MIT,transitive,rust,False,,a
search,windows_i686_msvc,0.52.6,Apache-2.0 OR MIT,transitive,rust,False,,a
search,windows_x86_64_gnu,0.52.6,Apache-2.0 OR MIT,transitive,rust,False,,a
search,windows_x86_64_gnullvm,0.52.6,Apache-2.0 OR MIT,transitive,rust,False,,a
search,windows_x86_64_msvc,0.52.6,Apache-2.0 OR MIT,transitive,rust,False,,a
search,writeable,0.6.4,Unicode-3.0,transitive,rust,False,,a
search,yoke,0.8.3,Unicode-3.0,transitive,rust,False,,a
search,yoke-derive,0.8.2,Unicode-3.0,transitive,rust,False,,a
search,zerocopy,0.8.56,Apache-2.0 OR BSD-2-Clause OR MIT,transitive,rust,False,,a
search,zerofrom,0.1.8,Unicode-3.0,transitive,rust,False,,a
search,zerofrom-derive,0.1.7,Unicode-3.0,transitive,rust,False,,a
search,zerotrie,0.2.5,Unicode-3.0,transitive,rust,False,,a
search,zerovec,0.11.7,Unicode-3.0,transitive,rust,False,,a
search,zerovec-derive,0.11.4,Unicode-3.0,transitive,rust,False,,a
search,zmij,1.0.23,MIT,transitive,rust,False,,a
search,zstd,0.13.3,MIT,transitive,rust,False,,a
search,zstd-safe,7.2.4,Apache-2.0 OR MIT,transitive,rust,False,,a
search,zstd-sys,2.0.16+zstd.1.5.7,Apache-2.0 OR MIT,transitive,rust,False,,a
web,Overpass (font),variable,OFL-1.1,direct,font-asset,False,,a
web,Overpass Mono (font),variable,OFL-1.1,direct,font-asset,False,,a
web,favicon.svg,n/a,MIT (Svelte project asset),direct,vendored-asset,True,"Copied from SvelteKit's default project scaffold (<title>svelte-logo</title>), never replaced with an original mark -- not a license-compatibility blocker (Svelte's own assets are MIT) but is unauthored, unattributed, third-party branded content shipping as this product's own favicon. Flagged for replacement, not a legal blocker.",n/a-branding
transport,redpanda (docker image),v24.2.7,"BSL 1.1 (Business Source License) for Redpanda Core, as pinned (v24.2.7, released 2024-10-11) -- NOT yet converted to Apache-2.0 (4-year Change Date is ~2028-10-11). Source-available, not OSI-approved open source. Additional Use Grant permits any use except offering it as a hosted 'Streaming or Queuing Service' to third parties.",direct,docker-image,True,"Category (c): BSL is explicitly source-available, not OSI-approved open source, per the audit's own classification framework. Verified against the actual licenses/bsl.md at the v24.2.7 tag, not assumed. No AGPL linking-compatibility issue (Redpanda is consumed only over the Kafka wire protocol, never linked into Sentry's own code -- same relationship as ClickHouse/Postgres). Real open question: whether a third party self-hosting Sentry (now fully AGPLv3 per task 6) 'as a service' would trip BSL's Streaming-or-Queuing-Service restriction on the bundled Redpanda image -- Sentry's ingest pipeline creates fixed internal topics, not per-end-user topics, so this is very likely NOT a Streaming-or-Queuing-Service under BSL's own definition, but this is a business/redistribution judgment call, not a pure technical one -- flagged for your decision, not resolved unilaterally. See license-audit-report.md's Redpanda section for the three remediation options (accept as-is / swap to Apache Kafka / flag only). RESOLVED 2026-08-16 (business decision): accept as-is. Sentry's own use (internal Kafka-protocol transport, no resale of broker access) is within BSL's Additional Use Grant; the third-party self-hosting-as-a-service question was judged unlikely to trip BSL's Streaming-or-Queuing-Service restriction, and was accepted as a known, disclosed risk rather than swapping to a heavier broker or dropping the bundled image. See license-audit-report.md's Redpanda section.",c
storage,clickhouse-server (docker image),24.8,"Apache-2.0, confirmed directly against ClickHouse's LICENSE file. No evidence of any historical license change (unlike Redpanda/Elastic/MongoDB) -- confirmed via web search plus direct file fetch, not assumed from general reputation.",direct,docker-image,False,,a
metadata,postgres (docker image),16-alpine,"PostgreSQL License (OSI-approved, MIT/BSD-equivalent permissive terms), confirmed directly against the official postgres/postgres COPYRIGHT file.",direct,docker-image,False,,a
1 component dependency version license direct_or_transitive ecosystem flagged flag_reason classification
2 api github.com/ClickHouse/ch-go (see go.sum) Apache-2.0 transitive go False a
3 api github.com/ClickHouse/clickhouse-go/v2 (see go.sum) Apache-2.0 direct go False a
4 api github.com/andybalholm/brotli (see go.sum) MIT transitive go False a
5 api github.com/andybalholm/brotli/flate (see go.sum) BSD-3-Clause transitive go False a
6 api github.com/cespare/xxhash/v2 (see go.sum) MIT transitive go False a
7 api github.com/go-faster/city (see go.sum) MIT transitive go False a
8 api github.com/go-faster/errors (see go.sum) BSD-3-Clause transitive go False a
9 api github.com/google/uuid (see go.sum) BSD-3-Clause direct go False a
10 api github.com/jackc/pgpassfile (see go.sum) MIT transitive go False a
11 api github.com/jackc/pgservicefile (see go.sum) MIT transitive go False a
12 api github.com/jackc/pgx/v5 (see go.sum) MIT transitive go False a
13 api github.com/jackc/puddle/v2 (see go.sum) MIT transitive go False a
14 api github.com/klauspost/compress (see go.sum) Apache-2.0 transitive go False a
15 api github.com/klauspost/compress/internal/snapref (see go.sum) BSD-3-Clause transitive go False a
16 api github.com/klauspost/compress/zstd/internal/xxhash (see go.sum) MIT transitive go False a
17 api github.com/paulmach/orb (see go.sum) MIT transitive go False a
18 api github.com/pierrec/lz4/v4 (see go.sum) BSD-3-Clause transitive go False a
19 api github.com/segmentio/asm/bswap (see go.sum) MIT-0 (declared as "MIT No Attribution" in LICENSE; SPDX MIT-0, permissive) transitive go True go-licenses reported Unknown; manually confirmed from module's LICENSE file a
20 api github.com/segmentio/asm/cpu (see go.sum) MIT-0 (declared as "MIT No Attribution" in LICENSE; SPDX MIT-0, permissive) transitive go True go-licenses reported Unknown; manually confirmed from module's LICENSE file a
21 api github.com/segmentio/asm/cpu/arm (see go.sum) MIT-0 (declared as "MIT No Attribution" in LICENSE; SPDX MIT-0, permissive) transitive go True go-licenses reported Unknown; manually confirmed from module's LICENSE file a
22 api github.com/segmentio/asm/cpu/arm64 (see go.sum) MIT-0 (declared as "MIT No Attribution" in LICENSE; SPDX MIT-0, permissive) transitive go True go-licenses reported Unknown; manually confirmed from module's LICENSE file a
23 api github.com/segmentio/asm/cpu/cpuid (see go.sum) MIT-0 (declared as "MIT No Attribution" in LICENSE; SPDX MIT-0, permissive) transitive go True go-licenses reported Unknown; manually confirmed from module's LICENSE file a
24 api github.com/segmentio/asm/cpu/x86 (see go.sum) MIT-0 (declared as "MIT No Attribution" in LICENSE; SPDX MIT-0, permissive) transitive go True go-licenses reported Unknown; manually confirmed from module's LICENSE file a
25 api github.com/shopspring/decimal (see go.sum) MIT transitive go False a
26 api go.opentelemetry.io/otel (see go.sum) Apache-2.0 transitive go False a
27 api go.opentelemetry.io/otel/trace (see go.sum) Apache-2.0 transitive go False a
28 api golang.org/x/net (see go.sum) BSD-3-Clause transitive go False a
29 api golang.org/x/sync/semaphore (see go.sum) BSD-3-Clause transitive go False a
30 api golang.org/x/sys (see go.sum) BSD-3-Clause transitive go False a
31 api golang.org/x/text (see go.sum) BSD-3-Clause transitive go False a
32 api google.golang.org/genproto/googleapis/rpc/status (see go.sum) Apache-2.0 transitive go False a
33 api google.golang.org/grpc (see go.sum) Apache-2.0 direct go False a
34 api google.golang.org/protobuf (see go.sum) BSD-3-Clause transitive go False a
35 ingest github.com/ClickHouse/ch-go (see go.sum) Apache-2.0 transitive go False a
36 ingest github.com/ClickHouse/clickhouse-go/v2 (see go.sum) Apache-2.0 direct go False a
37 ingest github.com/andybalholm/brotli (see go.sum) MIT transitive go False a
38 ingest github.com/andybalholm/brotli/flate (see go.sum) BSD-3-Clause transitive go False a
39 ingest github.com/cespare/xxhash/v2 (see go.sum) MIT transitive go False a
40 ingest github.com/go-faster/city (see go.sum) MIT transitive go False a
41 ingest github.com/go-faster/errors (see go.sum) BSD-3-Clause transitive go False a
42 ingest github.com/google/uuid (see go.sum) BSD-3-Clause direct go False a
43 ingest github.com/klauspost/compress (see go.sum) Apache-2.0 transitive go False a
44 ingest github.com/klauspost/compress/internal/snapref (see go.sum) BSD-3-Clause transitive go False a
45 ingest github.com/klauspost/compress/s2 (see go.sum) BSD-3-Clause transitive go False a
46 ingest github.com/klauspost/compress/snappy (see go.sum) BSD-3-Clause transitive go False a
47 ingest github.com/klauspost/compress/zstd/internal/xxhash (see go.sum) MIT transitive go False a
48 ingest github.com/paulmach/orb (see go.sum) MIT transitive go False a
49 ingest github.com/pierrec/lz4/v4 (see go.sum) BSD-3-Clause transitive go False a
50 ingest github.com/segmentio/asm/bswap (see go.sum) MIT-0 (declared as "MIT No Attribution" in LICENSE; SPDX MIT-0, permissive) transitive go True go-licenses reported Unknown; manually confirmed from module's LICENSE file a
51 ingest github.com/segmentio/asm/cpu (see go.sum) MIT-0 (declared as "MIT No Attribution" in LICENSE; SPDX MIT-0, permissive) transitive go True go-licenses reported Unknown; manually confirmed from module's LICENSE file a
52 ingest github.com/segmentio/asm/cpu/arm (see go.sum) MIT-0 (declared as "MIT No Attribution" in LICENSE; SPDX MIT-0, permissive) transitive go True go-licenses reported Unknown; manually confirmed from module's LICENSE file a
53 ingest github.com/segmentio/asm/cpu/arm64 (see go.sum) MIT-0 (declared as "MIT No Attribution" in LICENSE; SPDX MIT-0, permissive) transitive go True go-licenses reported Unknown; manually confirmed from module's LICENSE file a
54 ingest github.com/segmentio/asm/cpu/cpuid (see go.sum) MIT-0 (declared as "MIT No Attribution" in LICENSE; SPDX MIT-0, permissive) transitive go True go-licenses reported Unknown; manually confirmed from module's LICENSE file a
55 ingest github.com/segmentio/asm/cpu/x86 (see go.sum) MIT-0 (declared as "MIT No Attribution" in LICENSE; SPDX MIT-0, permissive) transitive go True go-licenses reported Unknown; manually confirmed from module's LICENSE file a
56 ingest github.com/segmentio/kafka-go (see go.sum) MIT direct go False a
57 ingest github.com/shopspring/decimal (see go.sum) MIT transitive go False a
58 ingest go.opentelemetry.io/otel (see go.sum) Apache-2.0 transitive go False a
59 ingest go.opentelemetry.io/otel/trace (see go.sum) Apache-2.0 transitive go False a
60 ingest golang.org/x/net (see go.sum) BSD-3-Clause transitive go False a
61 ingest golang.org/x/sync/errgroup (see go.sum) BSD-3-Clause direct go False a
62 ingest golang.org/x/sys (see go.sum) BSD-3-Clause transitive go False a
63 ingest golang.org/x/text (see go.sum) BSD-3-Clause transitive go False a
64 ingest google.golang.org/genproto/googleapis/rpc/status (see go.sum) Apache-2.0 transitive go False a
65 ingest google.golang.org/grpc (see go.sum) Apache-2.0 direct go False a
66 ingest google.golang.org/protobuf (see go.sum) BSD-3-Clause direct go False a
67 enterprise github.com/ClickHouse/ch-go (see go.sum) Apache-2.0 transitive go False a
68 enterprise github.com/ClickHouse/clickhouse-go/v2 (see go.sum) Apache-2.0 transitive go False a
69 enterprise github.com/andybalholm/brotli (see go.sum) MIT transitive go False a
70 enterprise github.com/andybalholm/brotli/flate (see go.sum) BSD-3-Clause transitive go False a
71 enterprise github.com/beevik/etree (see go.sum) BSD-2-Clause transitive go False a
72 enterprise github.com/cespare/xxhash/v2 (see go.sum) MIT transitive go False a
73 enterprise github.com/coreos/go-oidc/v3/oidc (see go.sum) Apache-2.0 transitive go False a
74 enterprise github.com/crewjam/saml (see go.sum) BSD-2-Clause transitive go False a
75 enterprise github.com/davecgh/go-spew/spew (see go.sum) ISC transitive go False a
76 enterprise github.com/emicklei/go-restful/v3 (see go.sum) MIT transitive go False a
77 enterprise github.com/fxamacker/cbor/v2 (see go.sum) MIT transitive go False a
78 enterprise github.com/go-faster/city (see go.sum) MIT transitive go False a
79 enterprise github.com/go-faster/errors (see go.sum) BSD-3-Clause transitive go False a
80 enterprise github.com/go-jose/go-jose/v4 (see go.sum) Apache-2.0 transitive go False a
81 enterprise github.com/go-jose/go-jose/v4/json (see go.sum) BSD-3-Clause transitive go False a
82 enterprise github.com/go-logr/logr (see go.sum) Apache-2.0 transitive go False a
83 enterprise github.com/go-openapi/jsonpointer (see go.sum) Apache-2.0 transitive go False a
84 enterprise github.com/go-openapi/jsonreference (see go.sum) Apache-2.0 transitive go False a
85 enterprise github.com/go-openapi/swag (see go.sum) Apache-2.0 transitive go False a
86 enterprise github.com/gogo/protobuf (see go.sum) BSD-3-Clause transitive go False a
87 enterprise github.com/golang-jwt/jwt/v4 (see go.sum) MIT transitive go False a
88 enterprise github.com/golang/protobuf (see go.sum) BSD-3-Clause transitive go False a
89 enterprise github.com/google/gnostic-models (see go.sum) Apache-2.0 transitive go False a
90 enterprise github.com/google/go-cmp/cmp (see go.sum) BSD-3-Clause transitive go False a
91 enterprise github.com/google/gofuzz (see go.sum) Apache-2.0 transitive go False a
92 enterprise github.com/google/uuid (see go.sum) BSD-3-Clause transitive go False a
93 enterprise github.com/imdario/mergo (see go.sum) BSD-3-Clause transitive go False a
94 enterprise github.com/jackc/pgpassfile (see go.sum) MIT transitive go False a
95 enterprise github.com/jackc/pgservicefile (see go.sum) MIT transitive go False a
96 enterprise github.com/jackc/pgx/v5 (see go.sum) MIT transitive go False a
97 enterprise github.com/jackc/puddle/v2 (see go.sum) MIT transitive go False a
98 enterprise github.com/jonboulle/clockwork (see go.sum) Apache-2.0 transitive go False a
99 enterprise github.com/josharian/intern (see go.sum) MIT transitive go False a
100 enterprise github.com/json-iterator/go (see go.sum) MIT transitive go False a
101 enterprise github.com/klauspost/compress (see go.sum) Apache-2.0 transitive go False a
102 enterprise github.com/klauspost/compress/internal/snapref (see go.sum) BSD-3-Clause transitive go False a
103 enterprise github.com/klauspost/compress/s2 (see go.sum) BSD-3-Clause transitive go False a
104 enterprise github.com/klauspost/compress/snappy (see go.sum) BSD-3-Clause transitive go False a
105 enterprise github.com/klauspost/compress/zstd/internal/xxhash (see go.sum) MIT transitive go False a
106 enterprise github.com/mailru/easyjson (see go.sum) MIT transitive go False a
107 enterprise github.com/mattermost/xml-roundtrip-validator (see go.sum) Apache-2.0 transitive go False a
108 enterprise github.com/modern-go/concurrent (see go.sum) Apache-2.0 transitive go False a
109 enterprise github.com/modern-go/reflect2 (see go.sum) Apache-2.0 transitive go False a
110 enterprise github.com/munnerz/goautoneg (see go.sum) BSD-3-Clause transitive go False a
111 enterprise github.com/paulmach/orb (see go.sum) MIT transitive go False a
112 enterprise github.com/pierrec/lz4/v4 (see go.sum) BSD-3-Clause transitive go False a
113 enterprise github.com/russellhaering/goxmldsig (see go.sum) Apache-2.0 transitive go False a
114 enterprise github.com/segmentio/asm/bswap (see go.sum) MIT-0 (declared as "MIT No Attribution" in LICENSE; SPDX MIT-0, permissive) transitive go True go-licenses reported Unknown; manually confirmed from module's LICENSE file a
115 enterprise github.com/segmentio/asm/cpu (see go.sum) MIT-0 (declared as "MIT No Attribution" in LICENSE; SPDX MIT-0, permissive) transitive go True go-licenses reported Unknown; manually confirmed from module's LICENSE file a
116 enterprise github.com/segmentio/asm/cpu/arm (see go.sum) MIT-0 (declared as "MIT No Attribution" in LICENSE; SPDX MIT-0, permissive) transitive go True go-licenses reported Unknown; manually confirmed from module's LICENSE file a
117 enterprise github.com/segmentio/asm/cpu/arm64 (see go.sum) MIT-0 (declared as "MIT No Attribution" in LICENSE; SPDX MIT-0, permissive) transitive go True go-licenses reported Unknown; manually confirmed from module's LICENSE file a
118 enterprise github.com/segmentio/asm/cpu/cpuid (see go.sum) MIT-0 (declared as "MIT No Attribution" in LICENSE; SPDX MIT-0, permissive) transitive go True go-licenses reported Unknown; manually confirmed from module's LICENSE file a
119 enterprise github.com/segmentio/asm/cpu/x86 (see go.sum) MIT-0 (declared as "MIT No Attribution" in LICENSE; SPDX MIT-0, permissive) transitive go True go-licenses reported Unknown; manually confirmed from module's LICENSE file a
120 enterprise github.com/segmentio/kafka-go (see go.sum) MIT transitive go False a
121 enterprise github.com/shopspring/decimal (see go.sum) MIT transitive go False a
122 enterprise github.com/spf13/pflag (see go.sum) BSD-3-Clause transitive go False a
123 enterprise github.com/x448/float16 (see go.sum) MIT transitive go False a
124 enterprise go.opentelemetry.io/otel (see go.sum) Apache-2.0 transitive go False a
125 enterprise go.opentelemetry.io/otel/trace (see go.sum) Apache-2.0 transitive go False a
126 enterprise golang.org/x/crypto/ripemd160 (see go.sum) BSD-3-Clause transitive go False a
127 enterprise golang.org/x/net (see go.sum) BSD-3-Clause transitive go False a
128 enterprise golang.org/x/oauth2 (see go.sum) BSD-3-Clause transitive go False a
129 enterprise golang.org/x/sync (see go.sum) BSD-3-Clause transitive go False a
130 enterprise golang.org/x/sys (see go.sum) BSD-3-Clause transitive go False a
131 enterprise golang.org/x/term (see go.sum) BSD-3-Clause transitive go False a
132 enterprise golang.org/x/text (see go.sum) BSD-3-Clause transitive go False a
133 enterprise golang.org/x/time/rate (see go.sum) BSD-3-Clause transitive go False a
134 enterprise google.golang.org/genproto/googleapis/rpc/status (see go.sum) Apache-2.0 transitive go False a
135 enterprise google.golang.org/grpc (see go.sum) Apache-2.0 transitive go False a
136 enterprise google.golang.org/protobuf (see go.sum) BSD-3-Clause transitive go False a
137 enterprise gopkg.in/inf.v0 (see go.sum) BSD-3-Clause transitive go False a
138 enterprise gopkg.in/yaml.v2 (see go.sum) Apache-2.0 transitive go False a
139 enterprise gopkg.in/yaml.v3 (see go.sum) MIT transitive go False a
140 enterprise k8s.io/api (see go.sum) Apache-2.0 transitive go False a
141 enterprise k8s.io/apimachinery/pkg (see go.sum) Apache-2.0 transitive go False a
142 enterprise k8s.io/apimachinery/third_party/forked/golang/reflect (see go.sum) BSD-3-Clause transitive go False a
143 enterprise k8s.io/client-go (see go.sum) Apache-2.0 transitive go False a
144 enterprise k8s.io/klog/v2 (see go.sum) Apache-2.0 transitive go False a
145 enterprise k8s.io/kube-openapi/pkg (see go.sum) Apache-2.0 transitive go False a
146 enterprise k8s.io/kube-openapi/pkg/internal/third_party/go-json-experiment/json (see go.sum) BSD-3-Clause transitive go False a
147 enterprise k8s.io/kube-openapi/pkg/validation/spec (see go.sum) Apache-2.0 transitive go False a
148 enterprise k8s.io/utils (see go.sum) Apache-2.0 transitive go False a
149 enterprise k8s.io/utils/internal/third_party/forked/golang/net (see go.sum) BSD-3-Clause transitive go False a
150 enterprise sigs.k8s.io/json (see go.sum) Apache-2.0 transitive go False a
151 enterprise sigs.k8s.io/structured-merge-diff/v4 (see go.sum) Apache-2.0 transitive go False a
152 enterprise sigs.k8s.io/yaml (see go.sum) Apache-2.0 transitive go False a
153 enterprise sigs.k8s.io/yaml/goyaml.v2 (see go.sum) Apache-2.0 transitive go False a
154 deploy/operator github.com/beorn7/perks/quantile (see go.sum) MIT transitive go False a
155 deploy/operator github.com/cespare/xxhash/v2 (see go.sum) MIT transitive go False a
156 deploy/operator github.com/davecgh/go-spew/spew (see go.sum) ISC transitive go False a
157 deploy/operator github.com/emicklei/go-restful/v3 (see go.sum) MIT transitive go False a
158 deploy/operator github.com/evanphx/json-patch/v5 (see go.sum) BSD-3-Clause transitive go False a
159 deploy/operator github.com/fxamacker/cbor/v2 (see go.sum) MIT transitive go False a
160 deploy/operator github.com/go-logr/logr (see go.sum) Apache-2.0 transitive go False a
161 deploy/operator github.com/go-logr/zapr (see go.sum) Apache-2.0 transitive go False a
162 deploy/operator github.com/go-openapi/jsonpointer (see go.sum) Apache-2.0 transitive go False a
163 deploy/operator github.com/go-openapi/jsonreference (see go.sum) Apache-2.0 transitive go False a
164 deploy/operator github.com/go-openapi/swag (see go.sum) Apache-2.0 transitive go False a
165 deploy/operator github.com/gogo/protobuf (see go.sum) BSD-3-Clause transitive go False a
166 deploy/operator github.com/golang/groupcache/lru (see go.sum) Apache-2.0 transitive go False a
167 deploy/operator github.com/golang/protobuf (see go.sum) BSD-3-Clause transitive go False a
168 deploy/operator github.com/google/gnostic-models (see go.sum) Apache-2.0 transitive go False a
169 deploy/operator github.com/google/go-cmp/cmp (see go.sum) BSD-3-Clause transitive go False a
170 deploy/operator github.com/google/gofuzz (see go.sum) Apache-2.0 transitive go False a
171 deploy/operator github.com/google/uuid (see go.sum) BSD-3-Clause transitive go False a
172 deploy/operator github.com/imdario/mergo (see go.sum) BSD-3-Clause transitive go False a
173 deploy/operator github.com/josharian/intern (see go.sum) MIT transitive go False a
174 deploy/operator github.com/json-iterator/go (see go.sum) MIT transitive go False a
175 deploy/operator github.com/mailru/easyjson (see go.sum) MIT transitive go False a
176 deploy/operator github.com/modern-go/concurrent (see go.sum) Apache-2.0 transitive go False a
177 deploy/operator github.com/modern-go/reflect2 (see go.sum) Apache-2.0 transitive go False a
178 deploy/operator github.com/munnerz/goautoneg (see go.sum) BSD-3-Clause transitive go False a
179 deploy/operator github.com/pkg/errors (see go.sum) BSD-2-Clause transitive go False a
180 deploy/operator github.com/prometheus/client_golang/prometheus (see go.sum) Apache-2.0 transitive go False a
181 deploy/operator github.com/prometheus/client_model/go (see go.sum) Apache-2.0 transitive go False a
182 deploy/operator github.com/prometheus/common (see go.sum) Apache-2.0 transitive go False a
183 deploy/operator github.com/prometheus/procfs (see go.sum) Apache-2.0 transitive go False a
184 deploy/operator github.com/spf13/pflag (see go.sum) BSD-3-Clause transitive go False a
185 deploy/operator github.com/x448/float16 (see go.sum) MIT transitive go False a
186 deploy/operator go.uber.org/multierr (see go.sum) MIT transitive go False a
187 deploy/operator go.uber.org/zap (see go.sum) MIT transitive go False a
188 deploy/operator golang.org/x/exp/maps (see go.sum) BSD-3-Clause transitive go False a
189 deploy/operator golang.org/x/net (see go.sum) BSD-3-Clause transitive go False a
190 deploy/operator golang.org/x/oauth2 (see go.sum) BSD-3-Clause transitive go False a
191 deploy/operator golang.org/x/sys/unix (see go.sum) BSD-3-Clause transitive go False a
192 deploy/operator golang.org/x/term (see go.sum) BSD-3-Clause transitive go False a
193 deploy/operator golang.org/x/text (see go.sum) BSD-3-Clause transitive go False a
194 deploy/operator golang.org/x/time/rate (see go.sum) BSD-3-Clause transitive go False a
195 deploy/operator gomodules.xyz/jsonpatch/v2 (see go.sum) Apache-2.0 transitive go False a
196 deploy/operator google.golang.org/protobuf (see go.sum) BSD-3-Clause transitive go False a
197 deploy/operator gopkg.in/inf.v0 (see go.sum) BSD-3-Clause transitive go False a
198 deploy/operator gopkg.in/yaml.v2 (see go.sum) Apache-2.0 transitive go False a
199 deploy/operator gopkg.in/yaml.v3 (see go.sum) MIT transitive go False a
200 deploy/operator k8s.io/api (see go.sum) Apache-2.0 direct go False a
201 deploy/operator k8s.io/apiextensions-apiserver/pkg/apis/apiextensions (see go.sum) Apache-2.0 transitive go False a
202 deploy/operator k8s.io/apimachinery/pkg (see go.sum) Apache-2.0 direct go False a
203 deploy/operator k8s.io/apimachinery/third_party/forked/golang (see go.sum) BSD-3-Clause direct go False a
204 deploy/operator k8s.io/client-go (see go.sum) Apache-2.0 direct go False a
205 deploy/operator k8s.io/klog/v2 (see go.sum) Apache-2.0 transitive go False a
206 deploy/operator k8s.io/kube-openapi/pkg (see go.sum) Apache-2.0 transitive go False a
207 deploy/operator k8s.io/kube-openapi/pkg/internal/third_party/go-json-experiment/json (see go.sum) BSD-3-Clause transitive go False a
208 deploy/operator k8s.io/kube-openapi/pkg/validation/spec (see go.sum) Apache-2.0 transitive go False a
209 deploy/operator k8s.io/utils (see go.sum) Apache-2.0 transitive go False a
210 deploy/operator k8s.io/utils/internal/third_party/forked/golang/net (see go.sum) BSD-3-Clause transitive go False a
211 deploy/operator sigs.k8s.io/controller-runtime (see go.sum) Apache-2.0 direct go False a
212 deploy/operator sigs.k8s.io/json (see go.sum) Apache-2.0 transitive go False a
213 deploy/operator sigs.k8s.io/structured-merge-diff/v4 (see go.sum) Apache-2.0 transitive go False a
214 deploy/operator sigs.k8s.io/yaml (see go.sum) Apache-2.0 transitive go False a
215 deploy/operator sigs.k8s.io/yaml/goyaml.v2 (see go.sum) Apache-2.0 transitive go False a
216 terraform github.com/fatih/color (see go.sum) MIT transitive go False a
217 terraform github.com/golang/protobuf/ptypes/empty (see go.sum) BSD-3-Clause transitive go False a
218 terraform github.com/hashicorp/go-hclog (see go.sum) MIT transitive go False a
219 terraform github.com/hashicorp/go-plugin (see go.sum) MPL-2.0 transitive go True MPL-2.0: flagged for explicit per-item citation per policy, not because it's expected to block a
220 terraform github.com/hashicorp/go-uuid (see go.sum) MPL-2.0 transitive go True MPL-2.0: flagged for explicit per-item citation per policy, not because it's expected to block a
221 terraform github.com/hashicorp/terraform-plugin-framework (see go.sum) MPL-2.0 direct go True MPL-2.0: flagged for explicit per-item citation per policy, not because it's expected to block a
222 terraform github.com/hashicorp/terraform-plugin-go (see go.sum) MPL-2.0 direct go True MPL-2.0: flagged for explicit per-item citation per policy, not because it's expected to block a
223 terraform github.com/hashicorp/terraform-plugin-log (see go.sum) MPL-2.0 transitive go True MPL-2.0: flagged for explicit per-item citation per policy, not because it's expected to block a
224 terraform github.com/hashicorp/terraform-registry-address (see go.sum) MPL-2.0 transitive go True MPL-2.0: flagged for explicit per-item citation per policy, not because it's expected to block a
225 terraform github.com/hashicorp/terraform-svchost (see go.sum) MPL-2.0 transitive go True MPL-2.0: flagged for explicit per-item citation per policy, not because it's expected to block a
226 terraform github.com/hashicorp/yamux (see go.sum) MPL-2.0 transitive go True MPL-2.0: flagged for explicit per-item citation per policy, not because it's expected to block a
227 terraform github.com/mattn/go-colorable (see go.sum) MIT transitive go False a
228 terraform github.com/mattn/go-isatty (see go.sum) MIT transitive go False a
229 terraform github.com/mitchellh/go-testing-interface (see go.sum) MIT transitive go False a
230 terraform github.com/oklog/run (see go.sum) Apache-2.0 transitive go False a
231 terraform github.com/vmihailenco/msgpack/v5 (see go.sum) BSD-2-Clause transitive go False a
232 terraform github.com/vmihailenco/tagparser/v2 (see go.sum) BSD-2-Clause transitive go False a
233 terraform golang.org/x/net (see go.sum) BSD-3-Clause transitive go False a
234 terraform golang.org/x/sys/unix (see go.sum) BSD-3-Clause transitive go False a
235 terraform golang.org/x/text (see go.sum) BSD-3-Clause transitive go False a
236 terraform google.golang.org/genproto/googleapis/rpc/status (see go.sum) Apache-2.0 transitive go False a
237 terraform google.golang.org/grpc (see go.sum) Apache-2.0 transitive go False a
238 terraform google.golang.org/protobuf (see go.sum) BSD-3-Clause transitive go False a
239 proto golang.org/x/net (see go.sum) BSD-3-Clause transitive go False a
240 proto golang.org/x/sys/unix (see go.sum) BSD-3-Clause transitive go False a
241 proto golang.org/x/text (see go.sum) BSD-3-Clause transitive go False a
242 proto google.golang.org/genproto/googleapis/rpc/status (see go.sum) Apache-2.0 transitive go False a
243 proto google.golang.org/grpc (see go.sum) Apache-2.0 direct go False a
244 proto google.golang.org/protobuf (see go.sum) BSD-3-Clause direct go False a
245 hack/benchmark-fixture golang.org/x/net (see go.sum) BSD-3-Clause transitive go False a
246 hack/benchmark-fixture golang.org/x/sys/unix (see go.sum) BSD-3-Clause transitive go False a
247 hack/benchmark-fixture golang.org/x/text (see go.sum) BSD-3-Clause transitive go False a
248 hack/benchmark-fixture google.golang.org/genproto/googleapis/rpc/status (see go.sum) Apache-2.0 transitive go False a
249 hack/benchmark-fixture google.golang.org/grpc (see go.sum) Apache-2.0 direct go False a
250 hack/benchmark-fixture google.golang.org/protobuf (see go.sum) BSD-3-Clause transitive go False a
251 hack/windows-fixture golang.org/x/net (see go.sum) BSD-3-Clause transitive go False a
252 hack/windows-fixture golang.org/x/sys/unix (see go.sum) BSD-3-Clause transitive go False a
253 hack/windows-fixture golang.org/x/text (see go.sum) BSD-3-Clause transitive go False a
254 hack/windows-fixture google.golang.org/genproto/googleapis/rpc/status (see go.sum) Apache-2.0 transitive go False a
255 hack/windows-fixture google.golang.org/grpc (see go.sum) Apache-2.0 direct go False a
256 hack/windows-fixture google.golang.org/protobuf (see go.sum) BSD-3-Clause transitive go False a
257 web @codemirror/autocomplete 6.20.3 MIT direct npm False a
258 web @codemirror/commands 6.10.4 MIT direct npm False a
259 web @codemirror/language 6.12.4 MIT direct npm False a
260 web @codemirror/state 6.7.1 MIT direct npm False a
261 web @codemirror/view 6.43.8 MIT direct npm False a
262 web @jridgewell/gen-mapping 0.3.13 MIT transitive npm False a
263 web @jridgewell/remapping 2.3.5 MIT transitive npm False a
264 web @jridgewell/resolve-uri 3.1.2 MIT transitive npm False a
265 web @jridgewell/sourcemap-codec 1.5.5 MIT transitive npm False a
266 web @jridgewell/trace-mapping 0.3.31 MIT transitive npm False a
267 web @lezer/common 1.5.2 MIT transitive npm False a
268 web @lezer/highlight 1.2.3 MIT transitive npm False a
269 web @lezer/lr 1.4.10 MIT transitive npm False a
270 web @marijn/find-cluster-break 1.0.3 MIT transitive npm False a
271 web @oxc-project/types 0.144.0 MIT transitive npm False a
272 web @polka/url 1.0.0-next.29 MIT transitive npm False a
273 web @rolldown/binding-linux-x64-gnu 1.2.4 MIT transitive npm False a
274 web @rolldown/pluginutils 1.0.1 MIT transitive npm False a
275 web @standard-schema/spec 1.1.0 MIT transitive npm False a
276 web @sveltejs/acorn-typescript 1.0.13 MIT transitive npm False a
277 web @sveltejs/adapter-static 3.0.10 MIT direct npm False a
278 web @sveltejs/kit 2.70.2 MIT direct npm False a
279 web @sveltejs/load-config 0.2.3 MIT transitive npm False a
280 web @sveltejs/vite-plugin-svelte 7.3.0 MIT direct npm False a
281 web @types/cookie 0.6.0 MIT transitive npm False a
282 web @types/estree 1.0.9 MIT transitive npm False a
283 web @types/trusted-types 2.0.7 MIT transitive npm False a
284 web acorn 8.18.0 MIT transitive npm False a
285 web aria-query 5.3.1 Apache-2.0 transitive npm False a
286 web axe-core 4.13.0 MPL-2.0 direct npm True MPL-2.0: file-level copyleft, generally fine as a dependency per policy -- flagged for explicit citation, not because it's expected to block a
287 web axobject-query 4.1.0 Apache-2.0 transitive npm False a
288 web chokidar 4.0.3 MIT transitive npm False a
289 web clsx 2.1.1 MIT transitive npm False a
290 web cookie 0.6.0 MIT transitive npm False a
291 web crelt 1.0.7 MIT transitive npm False a
292 web deepmerge 4.3.1 MIT transitive npm False a
293 web detect-libc 2.1.2 Apache-2.0 transitive npm False a
294 web devalue 5.9.0 MIT transitive npm False a
295 web echarts 6.1.0 Apache-2.0 direct npm False a
296 web esm-env 1.2.2 MIT transitive npm False a
297 web esrap 2.3.2 MIT transitive npm False a
298 web fdir 6.5.0 MIT transitive npm False a
299 web gridstack 11.5.1 MIT direct npm False a
300 web is-reference 3.0.3 MIT transitive npm False a
301 web kleur 4.1.5 MIT transitive npm False a
302 web lightningcss-linux-x64-gnu 1.33.0 MPL-2.0 transitive npm True MPL-2.0: file-level copyleft, generally fine as a dependency per policy -- flagged for explicit citation, not because it's expected to block a
303 web lightningcss 1.33.0 MPL-2.0 transitive npm True MPL-2.0: file-level copyleft, generally fine as a dependency per policy -- flagged for explicit citation, not because it's expected to block a
304 web locate-character 3.0.0 MIT transitive npm False a
305 web magic-string 0.30.21 MIT transitive npm False a
306 web magic-string 1.2.0 MIT transitive npm False a
307 web mri 1.2.0 MIT transitive npm False a
308 web mrmime 2.0.1 MIT transitive npm False a
309 web nanoid 3.3.18 MIT transitive npm False a
310 web obug 2.1.4 MIT transitive npm False a
311 web picocolors 1.1.1 ISC transitive npm False a
312 web picomatch 4.0.5 MIT transitive npm False a
313 web postcss 8.5.26 MIT transitive npm False a
314 web readdirp 4.1.2 MIT transitive npm False a
315 web rolldown 1.2.4 MIT transitive npm False a
316 web sade 1.8.1 MIT transitive npm False a
317 web set-cookie-parser 3.1.2 MIT transitive npm False a
318 web sirv 3.0.2 MIT transitive npm False a
319 web source-map-js 1.2.1 BSD-3-Clause transitive npm False a
320 web style-mod 4.1.3 MIT transitive npm False a
321 web svelte-check 4.7.6 MIT direct npm False a
322 web svelte 5.56.9 MIT direct npm False a
323 web tinyglobby 0.2.17 MIT transitive npm False a
324 web totalist 3.0.1 MIT transitive npm False a
325 web tslib 2.3.0 0BSD transitive npm False a
326 web typescript 6.0.3 Apache-2.0 direct npm False a
327 web vite 8.2.1 MIT direct npm False a
328 web vitefu 1.1.3 MIT transitive npm False a
329 web w3c-keyname 2.2.8 MIT transitive npm False a
330 web zimmerframe 1.1.4 MIT transitive npm False a
331 web zrender 6.1.0 BSD-3-Clause transitive npm False a
332 agent anstream 1.0.0 Apache-2.0 OR MIT transitive rust False a
333 agent anstyle 1.0.14 Apache-2.0 OR MIT transitive rust False a
334 agent anstyle-parse 1.0.0 Apache-2.0 OR MIT transitive rust False a
335 agent anstyle-query 1.1.5 Apache-2.0 OR MIT transitive rust False a
336 agent anstyle-wincon 3.0.11 Apache-2.0 OR MIT transitive rust False a
337 agent anyhow 1.0.104 Apache-2.0 OR MIT direct rust False a
338 agent async-stream 0.3.6 MIT transitive rust False a
339 agent async-stream-impl 0.3.6 MIT transitive rust False a
340 agent async-trait 0.1.92 Apache-2.0 OR MIT transitive rust False a
341 agent atomic-waker 1.1.2 Apache-2.0 OR MIT transitive rust False a
342 agent autocfg 1.5.1 Apache-2.0 OR MIT transitive rust False a
343 agent axum 0.7.9 MIT transitive rust False a
344 agent axum-core 0.4.5 MIT transitive rust False a
345 agent base64 0.22.1 Apache-2.0 OR MIT transitive rust False a
346 agent bitflags 2.13.1 Apache-2.0 OR MIT transitive rust False a
347 agent bytes 1.12.1 MIT transitive rust False a
348 agent cc 1.4.2 Apache-2.0 OR MIT transitive rust False a
349 agent cfg-if 1.0.4 Apache-2.0 OR MIT transitive rust False a
350 agent clap 4.6.6 Apache-2.0 OR MIT direct rust False a
351 agent clap_builder 4.6.6 Apache-2.0 OR MIT transitive rust False a
352 agent clap_derive 4.6.4 Apache-2.0 OR MIT transitive rust False a
353 agent clap_lex 1.1.0 Apache-2.0 OR MIT transitive rust False a
354 agent colorchoice 1.0.5 Apache-2.0 OR MIT transitive rust False a
355 agent either 1.17.0 Apache-2.0 OR MIT transitive rust False a
356 agent equivalent 1.0.2 Apache-2.0 OR MIT transitive rust False a
357 agent errno 0.3.14 Apache-2.0 OR MIT transitive rust False a
358 agent fastrand 2.5.0 Apache-2.0 OR MIT transitive rust False a
359 agent find-msvc-tools 0.1.10 Apache-2.0 OR MIT transitive rust False a
360 agent fixedbitset 0.5.7 Apache-2.0 OR MIT transitive rust False a
361 agent fnv 1.0.7 Apache-2.0 OR MIT transitive rust False a
362 agent futures-channel 0.3.34 Apache-2.0 OR MIT transitive rust False a
363 agent futures-core 0.3.34 Apache-2.0 OR MIT transitive rust False a
364 agent futures-sink 0.3.34 Apache-2.0 OR MIT transitive rust False a
365 agent futures-task 0.3.34 Apache-2.0 OR MIT transitive rust False a
366 agent futures-util 0.3.34 Apache-2.0 OR MIT transitive rust False a
367 agent getrandom 0.2.17 Apache-2.0 OR MIT transitive rust False a
368 agent getrandom 0.4.3 Apache-2.0 OR MIT transitive rust False a
369 agent h2 0.4.15 MIT transitive rust False a
370 agent hashbrown 0.12.3 Apache-2.0 OR MIT transitive rust False a
371 agent hashbrown 0.17.1 Apache-2.0 OR MIT transitive rust False a
372 agent heck 0.5.0 Apache-2.0 OR MIT transitive rust False a
373 agent http 1.5.0 Apache-2.0 OR MIT transitive rust False a
374 agent http-body 1.1.0 MIT transitive rust False a
375 agent http-body-util 0.1.5 MIT transitive rust False a
376 agent httparse 1.10.1 Apache-2.0 OR MIT transitive rust False a
377 agent httpdate 1.0.3 Apache-2.0 OR MIT transitive rust False a
378 agent hyper 1.11.0 MIT transitive rust False a
379 agent hyper-timeout 0.5.2 Apache-2.0 OR MIT transitive rust False a
380 agent hyper-util 0.1.20 MIT transitive rust False a
381 agent indexmap 1.9.3 Apache-2.0 OR MIT transitive rust False a
382 agent indexmap 2.14.0 Apache-2.0 OR MIT transitive rust False a
383 agent is_terminal_polyfill 1.70.2 Apache-2.0 OR MIT transitive rust False a
384 agent itertools 0.14.0 Apache-2.0 OR MIT transitive rust False a
385 agent itoa 1.0.18 Apache-2.0 OR MIT transitive rust False a
386 agent lazy_static 1.5.0 Apache-2.0 OR MIT transitive rust False a
387 agent libc 0.2.189 Apache-2.0 OR MIT transitive rust False a
388 agent linux-raw-sys 0.12.1 Apache-2.0 OR Apache-2.0 WITH LLVM-exception OR MIT transitive rust False a
389 agent log 0.4.33 Apache-2.0 OR MIT transitive rust False a
390 agent matchers 0.2.0 MIT transitive rust False a
391 agent matchit 0.7.3 BSD-3-Clause OR MIT transitive rust False a
392 agent memchr 2.8.3 MIT OR Unlicense transitive rust False a
393 agent mime 0.3.17 Apache-2.0 OR MIT transitive rust False a
394 agent mio 1.2.2 MIT transitive rust False a
395 agent multimap 0.10.1 Apache-2.0 OR MIT transitive rust False a
396 agent nu-ansi-term 0.50.3 MIT transitive rust False a
397 agent once_cell 1.21.4 Apache-2.0 OR MIT transitive rust False a
398 agent once_cell_polyfill 1.70.2 Apache-2.0 OR MIT transitive rust False a
399 agent percent-encoding 2.3.2 Apache-2.0 OR MIT transitive rust False a
400 agent petgraph 0.7.1 Apache-2.0 OR MIT transitive rust False a
401 agent pin-project 1.1.13 Apache-2.0 OR MIT transitive rust False a
402 agent pin-project-internal 1.1.13 Apache-2.0 OR MIT transitive rust False a
403 agent pin-project-lite 0.2.17 Apache-2.0 OR MIT transitive rust False a
404 agent ppv-lite86 0.2.21 Apache-2.0 OR MIT transitive rust False a
405 agent prettyplease 0.2.37 Apache-2.0 OR MIT transitive rust False a
406 agent proc-macro2 1.0.107 Apache-2.0 OR MIT transitive rust False a
407 agent prost 0.13.5 Apache-2.0 direct rust False a
408 agent prost-build 0.13.5 Apache-2.0 transitive rust False a
409 agent prost-derive 0.13.5 Apache-2.0 transitive rust False a
410 agent prost-types 0.13.5 Apache-2.0 transitive rust False a
411 agent quick-xml 0.36.2 MIT direct rust False a
412 agent quote 1.0.47 Apache-2.0 OR MIT transitive rust False a
413 agent r-efi 6.0.0 Apache-2.0 OR LGPL-2.1-or-later OR MIT transitive rust True carries a copyleft/less-common license alongside permissive alternatives (SPDX OR) -- see classification a
414 agent rand 0.8.7 Apache-2.0 OR MIT transitive rust False a
415 agent rand_chacha 0.3.1 Apache-2.0 OR MIT transitive rust False a
416 agent rand_core 0.6.4 Apache-2.0 OR MIT transitive rust False a
417 agent regex 1.13.1 Apache-2.0 OR MIT transitive rust False a
418 agent regex-automata 0.4.18 Apache-2.0 OR MIT transitive rust False a
419 agent regex-syntax 0.8.11 Apache-2.0 OR MIT transitive rust False a
420 agent ring 0.17.14 Apache-2.0 OR ISC transitive rust False a
421 agent rustix 1.1.4 Apache-2.0 OR Apache-2.0 WITH LLVM-exception OR MIT transitive rust False a
422 agent rustls 0.23.43 Apache-2.0 OR ISC OR MIT transitive rust False a
423 agent rustls-pemfile 2.2.0 Apache-2.0 OR ISC OR MIT transitive rust False a
424 agent rustls-pki-types 1.15.1 Apache-2.0 OR MIT transitive rust False a
425 agent rustls-webpki 0.103.14 ISC transitive rust False a
426 agent rustversion 1.0.23 Apache-2.0 OR MIT transitive rust False a
427 agent serde 1.0.229 Apache-2.0 OR MIT direct rust False a
428 agent serde_core 1.0.229 Apache-2.0 OR MIT transitive rust False a
429 agent serde_derive 1.0.229 Apache-2.0 OR MIT transitive rust False a
430 agent serde_json 1.0.151 Apache-2.0 OR MIT direct rust False a
431 agent serde_spanned 0.6.9 Apache-2.0 OR MIT transitive rust False a
432 agent sharded-slab 0.1.7 MIT transitive rust False a
433 agent shlex 2.0.1 Apache-2.0 OR MIT transitive rust False a
434 agent signal-hook-registry 1.4.8 Apache-2.0 OR MIT transitive rust False a
435 agent slab 0.4.12 MIT transitive rust False a
436 agent smallvec 1.15.2 Apache-2.0 OR MIT transitive rust False a
437 agent socket2 0.5.10 Apache-2.0 OR MIT transitive rust False a
438 agent socket2 0.6.5 Apache-2.0 OR MIT transitive rust False a
439 agent strsim 0.11.1 MIT transitive rust False a
440 agent subtle 2.6.1 BSD-3-Clause transitive rust False a
441 agent syn 2.0.119 Apache-2.0 OR MIT transitive rust False a
442 agent syn 3.0.3 Apache-2.0 OR MIT transitive rust False a
443 agent sync_wrapper 1.0.2 Apache-2.0 transitive rust False a
444 agent tempfile 3.27.0 Apache-2.0 OR MIT transitive rust False a
445 agent thread_local 1.1.10 Apache-2.0 OR MIT transitive rust False a
446 agent tokio 1.53.1 MIT direct rust False a
447 agent tokio-macros 2.7.2 MIT transitive rust False a
448 agent tokio-rustls 0.26.4 Apache-2.0 OR MIT transitive rust False a
449 agent tokio-stream 0.1.19 MIT transitive rust False a
450 agent tokio-util 0.7.19 MIT transitive rust False a
451 agent toml 0.8.23 Apache-2.0 OR MIT direct rust False a
452 agent toml_datetime 0.6.11 Apache-2.0 OR MIT transitive rust False a
453 agent toml_edit 0.22.27 Apache-2.0 OR MIT transitive rust False a
454 agent toml_write 0.1.2 Apache-2.0 OR MIT transitive rust False a
455 agent tonic 0.12.3 MIT direct rust False a
456 agent tonic-build 0.12.3 MIT direct rust False a
457 agent tower 0.4.13 MIT transitive rust False a
458 agent tower 0.5.3 MIT transitive rust False a
459 agent tower-layer 0.3.3 MIT transitive rust False a
460 agent tower-service 0.3.3 MIT transitive rust False a
461 agent tracing 0.1.44 MIT direct rust False a
462 agent tracing-attributes 0.1.31 MIT transitive rust False a
463 agent tracing-core 0.1.36 MIT transitive rust False a
464 agent tracing-log 0.2.0 MIT transitive rust False a
465 agent tracing-subscriber 0.3.23 MIT direct rust False a
466 agent try-lock 0.2.5 MIT transitive rust False a
467 agent unicode-ident 1.0.24 Apache-2.0 OR MIT OR Unicode-3.0 transitive rust False a
468 agent untrusted 0.9.0 ISC transitive rust False a
469 agent utf8parse 0.2.2 Apache-2.0 OR MIT transitive rust False a
470 agent want 0.3.1 MIT transitive rust False a
471 agent wasi 0.11.1+wasi-snapshot-preview1 Apache-2.0 OR Apache-2.0 WITH LLVM-exception OR MIT transitive rust False a
472 agent widestring 1.2.1 Apache-2.0 OR MIT transitive rust False a
473 agent windows 0.58.0 Apache-2.0 OR MIT direct rust False a
474 agent windows-core 0.58.0 Apache-2.0 OR MIT transitive rust False a
475 agent windows-implement 0.58.0 Apache-2.0 OR MIT transitive rust False a
476 agent windows-interface 0.58.0 Apache-2.0 OR MIT transitive rust False a
477 agent windows-link 0.2.1 Apache-2.0 OR MIT transitive rust False a
478 agent windows-result 0.2.0 Apache-2.0 OR MIT transitive rust False a
479 agent windows-service 0.7.0 Apache-2.0 OR MIT direct rust False a
480 agent windows-strings 0.1.0 Apache-2.0 OR MIT transitive rust False a
481 agent windows-sys 0.52.0 Apache-2.0 OR MIT transitive rust False a
482 agent windows-sys 0.61.2 Apache-2.0 OR MIT transitive rust False a
483 agent windows-targets 0.52.6 Apache-2.0 OR MIT transitive rust False a
484 agent windows_aarch64_gnullvm 0.52.6 Apache-2.0 OR MIT transitive rust False a
485 agent windows_aarch64_msvc 0.52.6 Apache-2.0 OR MIT transitive rust False a
486 agent windows_i686_gnu 0.52.6 Apache-2.0 OR MIT transitive rust False a
487 agent windows_i686_gnullvm 0.52.6 Apache-2.0 OR MIT transitive rust False a
488 agent windows_i686_msvc 0.52.6 Apache-2.0 OR MIT transitive rust False a
489 agent windows_x86_64_gnu 0.52.6 Apache-2.0 OR MIT transitive rust False a
490 agent windows_x86_64_gnullvm 0.52.6 Apache-2.0 OR MIT transitive rust False a
491 agent windows_x86_64_msvc 0.52.6 Apache-2.0 OR MIT transitive rust False a
492 agent winnow 0.7.15 MIT transitive rust False a
493 agent zerocopy 0.8.56 Apache-2.0 OR BSD-2-Clause OR MIT transitive rust False a
494 agent zeroize 1.9.0 Apache-2.0 OR MIT transitive rust False a
495 agent zmij 1.0.23 MIT transitive rust False a
496 search adler2 2.0.1 0BSD OR Apache-2.0 OR MIT transitive rust False a
497 search aho-corasick 1.1.5 MIT OR Unlicense transitive rust False a
498 search allocator-api2 0.2.21 Apache-2.0 OR MIT transitive rust False a
499 search anyhow 1.0.104 Apache-2.0 OR MIT direct rust False a
500 search arc-swap 1.9.2 Apache-2.0 OR MIT transitive rust False a
501 search async-stream 0.3.6 MIT transitive rust False a
502 search async-stream-impl 0.3.6 MIT transitive rust False a
503 search async-trait 0.1.92 Apache-2.0 OR MIT transitive rust False a
504 search atomic-waker 1.1.2 Apache-2.0 OR MIT transitive rust False a
505 search autocfg 1.5.1 Apache-2.0 OR MIT transitive rust False a
506 search axum 0.7.9 MIT transitive rust False a
507 search axum-core 0.4.5 MIT transitive rust False a
508 search base64 0.22.1 Apache-2.0 OR MIT transitive rust False a
509 search bitflags 2.13.1 Apache-2.0 OR MIT transitive rust False a
510 search bitpacking 0.9.3 MIT transitive rust False a
511 search block-buffer 0.10.4 Apache-2.0 OR MIT transitive rust False a
512 search bumpalo 3.20.3 Apache-2.0 OR MIT transitive rust False a
513 search byteorder 1.5.0 MIT OR Unlicense transitive rust False a
514 search bytes 1.12.1 MIT transitive rust False a
515 search cc 1.4.2 Apache-2.0 OR MIT transitive rust False a
516 search census 0.4.2 MIT transitive rust False a
517 search cfg-if 1.0.4 Apache-2.0 OR MIT transitive rust False a
518 search chrono 0.4.45 Apache-2.0 OR MIT transitive rust False a
519 search cpufeatures 0.2.17 Apache-2.0 OR MIT transitive rust False a
520 search crc32c 0.6.8 Apache-2.0 OR MIT transitive rust False a
521 search crc32fast 1.5.0 Apache-2.0 OR MIT transitive rust False a
522 search crossbeam-channel 0.5.16 Apache-2.0 OR MIT transitive rust False a
523 search crossbeam-deque 0.8.7 Apache-2.0 OR MIT transitive rust False a
524 search crossbeam-epoch 0.9.20 Apache-2.0 OR MIT transitive rust False a
525 search crossbeam-utils 0.8.22 Apache-2.0 OR MIT transitive rust False a
526 search crunchy 0.2.4 MIT transitive rust False a
527 search crypto-common 0.1.7 Apache-2.0 OR MIT transitive rust False a
528 search deranged 0.5.8 Apache-2.0 OR MIT transitive rust False a
529 search digest 0.10.7 Apache-2.0 OR MIT transitive rust False a
530 search displaydoc 0.2.7 Apache-2.0 OR MIT transitive rust False a
531 search downcast-rs 1.2.1 Apache-2.0 OR MIT transitive rust False a
532 search either 1.17.0 Apache-2.0 OR MIT transitive rust False a
533 search equivalent 1.0.2 Apache-2.0 OR MIT transitive rust False a
534 search errno 0.3.14 Apache-2.0 OR MIT transitive rust False a
535 search fastdivide 0.4.2 MIT OR zlib-acknowledgement transitive rust True carries a copyleft/less-common license alongside permissive alternatives (SPDX OR) -- see classification a
536 search fastrand 2.5.0 Apache-2.0 OR MIT transitive rust False a
537 search find-msvc-tools 0.1.10 Apache-2.0 OR MIT transitive rust False a
538 search fixedbitset 0.5.7 Apache-2.0 OR MIT transitive rust False a
539 search flate2 1.1.9 Apache-2.0 OR MIT transitive rust False a
540 search fnv 1.0.7 Apache-2.0 OR MIT transitive rust False a
541 search foldhash 0.1.5 Zlib transitive rust False a
542 search form_urlencoded 1.2.2 Apache-2.0 OR MIT transitive rust False a
543 search fs4 0.8.4 Apache-2.0 OR MIT transitive rust False a
544 search futures 0.3.34 Apache-2.0 OR MIT transitive rust False a
545 search futures-channel 0.3.34 Apache-2.0 OR MIT transitive rust False a
546 search futures-core 0.3.34 Apache-2.0 OR MIT transitive rust False a
547 search futures-executor 0.3.34 Apache-2.0 OR MIT transitive rust False a
548 search futures-io 0.3.34 Apache-2.0 OR MIT transitive rust False a
549 search futures-macro 0.3.34 Apache-2.0 OR MIT transitive rust False a
550 search futures-sink 0.3.34 Apache-2.0 OR MIT transitive rust False a
551 search futures-task 0.3.34 Apache-2.0 OR MIT transitive rust False a
552 search futures-util 0.3.34 Apache-2.0 OR MIT transitive rust False a
553 search generic-array 0.14.7 MIT transitive rust False a
554 search getrandom 0.2.17 Apache-2.0 OR MIT transitive rust False a
555 search getrandom 0.4.3 Apache-2.0 OR MIT transitive rust False a
556 search h2 0.4.15 MIT transitive rust False a
557 search hashbrown 0.12.3 Apache-2.0 OR MIT transitive rust False a
558 search hashbrown 0.15.5 Apache-2.0 OR MIT transitive rust False a
559 search hashbrown 0.17.1 Apache-2.0 OR MIT transitive rust False a
560 search heck 0.5.0 Apache-2.0 OR MIT transitive rust False a
561 search hermit-abi 0.5.2 Apache-2.0 OR MIT transitive rust False a
562 search hmac 0.12.1 Apache-2.0 OR MIT transitive rust False a
563 search htmlescape 0.3.1 Apache-2.0 OR MIT OR MPL-2.0 transitive rust True carries a copyleft/less-common license alongside permissive alternatives (SPDX OR) -- see classification a
564 search http 1.5.0 Apache-2.0 OR MIT transitive rust False a
565 search http-body 1.1.0 MIT transitive rust False a
566 search http-body-util 0.1.5 MIT transitive rust False a
567 search httparse 1.10.1 Apache-2.0 OR MIT transitive rust False a
568 search httpdate 1.0.3 Apache-2.0 OR MIT transitive rust False a
569 search hyper 1.11.0 MIT transitive rust False a
570 search hyper-timeout 0.5.2 Apache-2.0 OR MIT transitive rust False a
571 search hyper-util 0.1.20 MIT transitive rust False a
572 search icu_collections 2.3.0 Unicode-3.0 transitive rust False a
573 search icu_locale_core 2.3.0 Unicode-3.0 transitive rust False a
574 search icu_normalizer 2.3.0 Unicode-3.0 transitive rust False a
575 search icu_normalizer_data 2.3.0 Unicode-3.0 transitive rust False a
576 search icu_properties 2.3.0 Unicode-3.0 transitive rust False a
577 search icu_properties_data 2.3.0 Unicode-3.0 transitive rust False a
578 search icu_provider 2.3.0 Unicode-3.0 transitive rust False a
579 search idna 1.1.0 Apache-2.0 OR MIT transitive rust False a
580 search idna_adapter 1.2.2 Apache-2.0 OR MIT transitive rust False a
581 search indexmap 1.9.3 Apache-2.0 OR MIT transitive rust False a
582 search indexmap 2.14.0 Apache-2.0 OR MIT transitive rust False a
583 search instant 0.1.13 BSD-3-Clause transitive rust False a
584 search integer-encoding 4.1.0 MIT transitive rust False a
585 search ipnet 2.12.1 Apache-2.0 OR MIT transitive rust False a
586 search itertools 0.12.1 Apache-2.0 OR MIT transitive rust False a
587 search itertools 0.14.0 Apache-2.0 OR MIT transitive rust False a
588 search itoa 1.0.18 Apache-2.0 OR MIT transitive rust False a
589 search jobserver 0.1.35 Apache-2.0 OR MIT transitive rust False a
590 search js-sys 0.3.104 Apache-2.0 OR MIT transitive rust False a
591 search lazy_static 1.5.0 Apache-2.0 OR MIT transitive rust False a
592 search levenshtein_automata 0.2.1 MIT transitive rust False a
593 search libc 0.2.189 Apache-2.0 OR MIT transitive rust False a
594 search libm 0.2.16 MIT transitive rust False a
595 search linux-raw-sys 0.12.1 Apache-2.0 OR Apache-2.0 WITH LLVM-exception OR MIT transitive rust False a
596 search linux-raw-sys 0.4.15 Apache-2.0 OR Apache-2.0 WITH LLVM-exception OR MIT transitive rust False a
597 search litemap 0.8.3 Unicode-3.0 transitive rust False a
598 search lock_api 0.4.14 Apache-2.0 OR MIT transitive rust False a
599 search log 0.4.33 Apache-2.0 OR MIT transitive rust False a
600 search lru 0.12.5 MIT transitive rust False a
601 search lz4 1.28.1 MIT transitive rust False a
602 search lz4-sys 1.11.1+lz4-1.10.0 MIT transitive rust False a
603 search lz4_flex 0.11.6 MIT transitive rust False a
604 search matchers 0.2.0 MIT transitive rust False a
605 search matchit 0.7.3 BSD-3-Clause OR MIT transitive rust False a
606 search measure_time 0.8.3 MIT transitive rust False a
607 search memchr 2.8.3 MIT OR Unlicense transitive rust False a
608 search memmap2 0.9.11 Apache-2.0 OR MIT transitive rust False a
609 search mime 0.3.17 Apache-2.0 OR MIT transitive rust False a
610 search minimal-lexical 0.2.1 Apache-2.0 OR MIT transitive rust False a
611 search miniz_oxide 0.8.9 Apache-2.0 OR MIT OR Zlib transitive rust False a
612 search mio 1.2.2 MIT transitive rust False a
613 search multimap 0.10.1 Apache-2.0 OR MIT transitive rust False a
614 search murmurhash32 0.3.1 MIT transitive rust False a
615 search nom 7.1.3 MIT transitive rust False a
616 search nu-ansi-term 0.50.3 MIT transitive rust False a
617 search num-conv 0.2.2 Apache-2.0 OR MIT transitive rust False a
618 search num-traits 0.2.19 Apache-2.0 OR MIT transitive rust False a
619 search num_cpus 1.17.0 Apache-2.0 OR MIT transitive rust False a
620 search once_cell 1.21.4 Apache-2.0 OR MIT transitive rust False a
621 search oneshot 0.1.13 Apache-2.0 OR MIT transitive rust False a
622 search ownedbytes 0.7.0 MIT transitive rust False a
623 search parking_lot 0.12.5 Apache-2.0 OR MIT transitive rust False a
624 search parking_lot_core 0.9.12 Apache-2.0 OR MIT transitive rust False a
625 search pbkdf2 0.12.2 Apache-2.0 OR MIT transitive rust False a
626 search percent-encoding 2.3.2 Apache-2.0 OR MIT transitive rust False a
627 search petgraph 0.7.1 Apache-2.0 OR MIT transitive rust False a
628 search pin-project 1.1.13 Apache-2.0 OR MIT transitive rust False a
629 search pin-project-internal 1.1.13 Apache-2.0 OR MIT transitive rust False a
630 search pin-project-lite 0.2.17 Apache-2.0 OR MIT transitive rust False a
631 search pkg-config 0.3.33 Apache-2.0 OR MIT transitive rust False a
632 search potential_utf 0.1.6 Unicode-3.0 transitive rust False a
633 search powerfmt 0.2.0 Apache-2.0 OR MIT transitive rust False a
634 search ppv-lite86 0.2.21 Apache-2.0 OR MIT transitive rust False a
635 search prettyplease 0.2.37 Apache-2.0 OR MIT transitive rust False a
636 search proc-macro2 1.0.107 Apache-2.0 OR MIT transitive rust False a
637 search prost 0.13.5 Apache-2.0 direct rust False a
638 search prost-build 0.13.5 Apache-2.0 transitive rust False a
639 search prost-derive 0.13.5 Apache-2.0 transitive rust False a
640 search prost-types 0.13.5 Apache-2.0 transitive rust False a
641 search quote 1.0.47 Apache-2.0 OR MIT transitive rust False a
642 search r-efi 6.0.0 Apache-2.0 OR LGPL-2.1-or-later OR MIT transitive rust True carries a copyleft/less-common license alongside permissive alternatives (SPDX OR) -- see classification a
643 search rand 0.8.7 Apache-2.0 OR MIT transitive rust False a
644 search rand_chacha 0.3.1 Apache-2.0 OR MIT transitive rust False a
645 search rand_core 0.6.4 Apache-2.0 OR MIT transitive rust False a
646 search rand_distr 0.4.3 Apache-2.0 OR MIT transitive rust False a
647 search rayon 1.12.0 Apache-2.0 OR MIT transitive rust False a
648 search rayon-core 1.13.0 Apache-2.0 OR MIT transitive rust False a
649 search redox_syscall 0.5.18 MIT transitive rust False a
650 search regex 1.13.1 Apache-2.0 OR MIT transitive rust False a
651 search regex-automata 0.4.18 Apache-2.0 OR MIT transitive rust False a
652 search regex-syntax 0.8.11 Apache-2.0 OR MIT transitive rust False a
653 search reqwest 0.12.28 Apache-2.0 OR MIT direct rust False a
654 search rsasl 2.3.1 Apache-2.0 OR MIT transitive rust False a
655 search rskafka 0.6.0 Apache-2.0 OR MIT direct rust False a
656 search rust-stemmers 1.2.0 BSD-3-Clause OR MIT transitive rust False a
657 search rustc-hash 1.1.0 Apache-2.0 OR MIT transitive rust False a
658 search rustc_version 0.4.1 Apache-2.0 OR MIT transitive rust False a
659 search rustix 0.38.44 Apache-2.0 OR Apache-2.0 WITH LLVM-exception OR MIT transitive rust False a
660 search rustix 1.1.4 Apache-2.0 OR Apache-2.0 WITH LLVM-exception OR MIT transitive rust False a
661 search rustversion 1.0.23 Apache-2.0 OR MIT transitive rust False a
662 search ryu 1.0.23 Apache-2.0 OR BSL-1.0 transitive rust True carries a copyleft/less-common license alongside permissive alternatives (SPDX OR) -- see classification a
663 search scopeguard 1.2.0 Apache-2.0 OR MIT transitive rust False a
664 search semver 1.0.28 Apache-2.0 OR MIT transitive rust False a
665 search serde 1.0.229 Apache-2.0 OR MIT direct rust False a
666 search serde_core 1.0.229 Apache-2.0 OR MIT transitive rust False a
667 search serde_derive 1.0.229 Apache-2.0 OR MIT transitive rust False a
668 search serde_json 1.0.151 Apache-2.0 OR MIT direct rust False a
669 search serde_urlencoded 0.7.1 Apache-2.0 OR MIT transitive rust False a
670 search sha2 0.10.9 Apache-2.0 OR MIT transitive rust False a
671 search sharded-slab 0.1.7 MIT transitive rust False a
672 search shlex 2.0.1 Apache-2.0 OR MIT transitive rust False a
673 search signal-hook-registry 1.4.8 Apache-2.0 OR MIT transitive rust False a
674 search simd-adler32 0.3.10 MIT transitive rust False a
675 search sketches-ddsketch 0.2.2 Apache-2.0 transitive rust False a
676 search slab 0.4.12 MIT transitive rust False a
677 search smallvec 1.15.2 Apache-2.0 OR MIT transitive rust False a
678 search snap 1.1.2 BSD-3-Clause transitive rust False a
679 search socket2 0.5.10 Apache-2.0 OR MIT transitive rust False a
680 search socket2 0.6.5 Apache-2.0 OR MIT transitive rust False a
681 search stable_deref_trait 1.2.1 Apache-2.0 OR MIT transitive rust False a
682 search stringprep 0.1.5 Apache-2.0 OR MIT transitive rust False a
683 search subtle 2.6.1 BSD-3-Clause transitive rust False a
684 search syn 2.0.119 Apache-2.0 OR MIT transitive rust False a
685 search syn 3.0.3 Apache-2.0 OR MIT transitive rust False a
686 search sync_wrapper 1.0.2 Apache-2.0 transitive rust False a
687 search synstructure 0.13.2 MIT transitive rust False a
688 search tantivy 0.22.1 MIT direct rust False a
689 search tantivy-bitpacker 0.6.0 MIT transitive rust False a
690 search tantivy-columnar 0.3.0 MIT transitive rust False a
691 search tantivy-common 0.7.0 MIT transitive rust False a
692 search tantivy-fst 0.5.0 MIT OR Unlicense transitive rust False a
693 search tantivy-query-grammar 0.22.0 MIT transitive rust False a
694 search tantivy-sstable 0.3.0 MIT transitive rust False a
695 search tantivy-stacker 0.3.0 MIT transitive rust False a
696 search tantivy-tokenizer-api 0.3.0 MIT transitive rust False a
697 search tempfile 3.27.0 Apache-2.0 OR MIT direct rust False a
698 search thiserror 1.0.69 Apache-2.0 OR MIT transitive rust False a
699 search thiserror 2.0.20 Apache-2.0 OR MIT transitive rust False a
700 search thiserror-impl 1.0.69 Apache-2.0 OR MIT transitive rust False a
701 search thiserror-impl 2.0.20 Apache-2.0 OR MIT transitive rust False a
702 search thread_local 1.1.10 Apache-2.0 OR MIT transitive rust False a
703 search time 0.3.55 Apache-2.0 OR MIT transitive rust False a
704 search time-core 0.1.9 Apache-2.0 OR MIT transitive rust False a
705 search tinystr 0.8.4 Unicode-3.0 transitive rust False a
706 search tinyvec 1.12.0 Apache-2.0 OR MIT OR Zlib transitive rust False a
707 search tinyvec_macros 0.1.1 Apache-2.0 OR MIT OR Zlib transitive rust False a
708 search tokio 1.53.1 MIT direct rust False a
709 search tokio-macros 2.7.2 MIT transitive rust False a
710 search tokio-stream 0.1.19 MIT transitive rust False a
711 search tokio-util 0.7.19 MIT transitive rust False a
712 search tonic 0.12.3 MIT direct rust False a
713 search tonic-build 0.12.3 MIT direct rust False a
714 search tower 0.4.13 MIT transitive rust False a
715 search tower 0.5.3 MIT transitive rust False a
716 search tower-http 0.6.11 MIT transitive rust False a
717 search tower-layer 0.3.3 MIT transitive rust False a
718 search tower-service 0.3.3 MIT transitive rust False a
719 search tracing 0.1.44 MIT direct rust False a
720 search tracing-attributes 0.1.31 MIT transitive rust False a
721 search tracing-core 0.1.36 MIT transitive rust False a
722 search tracing-log 0.2.0 MIT transitive rust False a
723 search tracing-subscriber 0.3.23 MIT direct rust False a
724 search try-lock 0.2.5 MIT transitive rust False a
725 search typenum 1.20.1 Apache-2.0 OR MIT transitive rust False a
726 search unicode-bidi 0.3.18 Apache-2.0 OR MIT transitive rust False a
727 search unicode-ident 1.0.24 Apache-2.0 OR MIT OR Unicode-3.0 transitive rust False a
728 search unicode-normalization 0.1.25 Apache-2.0 OR MIT transitive rust False a
729 search unicode-properties 0.1.4 Apache-2.0 OR MIT transitive rust False a
730 search url 2.5.8 Apache-2.0 OR MIT transitive rust False a
731 search utf8-ranges 1.0.5 MIT OR Unlicense transitive rust False a
732 search utf8_iter 1.0.4 Apache-2.0 OR MIT transitive rust False a
733 search uuid 1.24.0 Apache-2.0 OR MIT transitive rust False a
734 search version_check 0.9.5 Apache-2.0 OR MIT transitive rust False a
735 search want 0.3.1 MIT transitive rust False a
736 search wasi 0.11.1+wasi-snapshot-preview1 Apache-2.0 OR Apache-2.0 WITH LLVM-exception OR MIT transitive rust False a
737 search wasm-bindgen 0.2.127 Apache-2.0 OR MIT transitive rust False a
738 search wasm-bindgen-futures 0.4.77 Apache-2.0 OR MIT transitive rust False a
739 search wasm-bindgen-macro 0.2.127 Apache-2.0 OR MIT transitive rust False a
740 search wasm-bindgen-macro-support 0.2.127 Apache-2.0 OR MIT transitive rust False a
741 search wasm-bindgen-shared 0.2.127 Apache-2.0 OR MIT transitive rust False a
742 search web-sys 0.3.104 Apache-2.0 OR MIT transitive rust False a
743 search winapi 0.3.9 Apache-2.0 OR MIT transitive rust False a
744 search winapi-i686-pc-windows-gnu 0.4.0 Apache-2.0 OR MIT transitive rust False a
745 search winapi-x86_64-pc-windows-gnu 0.4.0 Apache-2.0 OR MIT transitive rust False a
746 search windows-link 0.2.1 Apache-2.0 OR MIT transitive rust False a
747 search windows-sys 0.52.0 Apache-2.0 OR MIT transitive rust False a
748 search windows-sys 0.59.0 Apache-2.0 OR MIT transitive rust False a
749 search windows-sys 0.61.2 Apache-2.0 OR MIT transitive rust False a
750 search windows-targets 0.52.6 Apache-2.0 OR MIT transitive rust False a
751 search windows_aarch64_gnullvm 0.52.6 Apache-2.0 OR MIT transitive rust False a
752 search windows_aarch64_msvc 0.52.6 Apache-2.0 OR MIT transitive rust False a
753 search windows_i686_gnu 0.52.6 Apache-2.0 OR MIT transitive rust False a
754 search windows_i686_gnullvm 0.52.6 Apache-2.0 OR MIT transitive rust False a
755 search windows_i686_msvc 0.52.6 Apache-2.0 OR MIT transitive rust False a
756 search windows_x86_64_gnu 0.52.6 Apache-2.0 OR MIT transitive rust False a
757 search windows_x86_64_gnullvm 0.52.6 Apache-2.0 OR MIT transitive rust False a
758 search windows_x86_64_msvc 0.52.6 Apache-2.0 OR MIT transitive rust False a
759 search writeable 0.6.4 Unicode-3.0 transitive rust False a
760 search yoke 0.8.3 Unicode-3.0 transitive rust False a
761 search yoke-derive 0.8.2 Unicode-3.0 transitive rust False a
762 search zerocopy 0.8.56 Apache-2.0 OR BSD-2-Clause OR MIT transitive rust False a
763 search zerofrom 0.1.8 Unicode-3.0 transitive rust False a
764 search zerofrom-derive 0.1.7 Unicode-3.0 transitive rust False a
765 search zerotrie 0.2.5 Unicode-3.0 transitive rust False a
766 search zerovec 0.11.7 Unicode-3.0 transitive rust False a
767 search zerovec-derive 0.11.4 Unicode-3.0 transitive rust False a
768 search zmij 1.0.23 MIT transitive rust False a
769 search zstd 0.13.3 MIT transitive rust False a
770 search zstd-safe 7.2.4 Apache-2.0 OR MIT transitive rust False a
771 search zstd-sys 2.0.16+zstd.1.5.7 Apache-2.0 OR MIT transitive rust False a
772 web Overpass (font) variable OFL-1.1 direct font-asset False a
773 web Overpass Mono (font) variable OFL-1.1 direct font-asset False a
774 web favicon.svg n/a MIT (Svelte project asset) direct vendored-asset True Copied from SvelteKit's default project scaffold (<title>svelte-logo</title>), never replaced with an original mark -- not a license-compatibility blocker (Svelte's own assets are MIT) but is unauthored, unattributed, third-party branded content shipping as this product's own favicon. Flagged for replacement, not a legal blocker. n/a-branding
775 transport redpanda (docker image) v24.2.7 BSL 1.1 (Business Source License) for Redpanda Core, as pinned (v24.2.7, released 2024-10-11) -- NOT yet converted to Apache-2.0 (4-year Change Date is ~2028-10-11). Source-available, not OSI-approved open source. Additional Use Grant permits any use except offering it as a hosted 'Streaming or Queuing Service' to third parties. direct docker-image True Category (c): BSL is explicitly source-available, not OSI-approved open source, per the audit's own classification framework. Verified against the actual licenses/bsl.md at the v24.2.7 tag, not assumed. No AGPL linking-compatibility issue (Redpanda is consumed only over the Kafka wire protocol, never linked into Sentry's own code -- same relationship as ClickHouse/Postgres). Real open question: whether a third party self-hosting Sentry (now fully AGPLv3 per task 6) 'as a service' would trip BSL's Streaming-or-Queuing-Service restriction on the bundled Redpanda image -- Sentry's ingest pipeline creates fixed internal topics, not per-end-user topics, so this is very likely NOT a Streaming-or-Queuing-Service under BSL's own definition, but this is a business/redistribution judgment call, not a pure technical one -- flagged for your decision, not resolved unilaterally. See license-audit-report.md's Redpanda section for the three remediation options (accept as-is / swap to Apache Kafka / flag only). RESOLVED 2026-08-16 (business decision): accept as-is. Sentry's own use (internal Kafka-protocol transport, no resale of broker access) is within BSL's Additional Use Grant; the third-party self-hosting-as-a-service question was judged unlikely to trip BSL's Streaming-or-Queuing-Service restriction, and was accepted as a known, disclosed risk rather than swapping to a heavier broker or dropping the bundled image. See license-audit-report.md's Redpanda section. c
776 storage clickhouse-server (docker image) 24.8 Apache-2.0, confirmed directly against ClickHouse's LICENSE file. No evidence of any historical license change (unlike Redpanda/Elastic/MongoDB) -- confirmed via web search plus direct file fetch, not assumed from general reputation. direct docker-image False a
777 metadata postgres (docker image) 16-alpine PostgreSQL License (OSI-approved, MIT/BSD-equivalent permissive terms), confirmed directly against the official postgres/postgres COPYRIGHT file. direct docker-image False a
docs/compliance/license-inventory.json
+8538
View File
File diff suppressed because it is too large Load Diff
docs/compliance/license-policy.md
+125
View File
@@ -0,0 +1,125 @@
# License policy
**This is a policy document derived from a first-pass compliance audit,
not a legal opinion.** See `/docs/compliance/license-audit-report.md`
for the audit itself and its findings; this document is the resulting
ongoing policy, enforced in CI (`.github/workflows/license-compliance.yml`)
on every PR across all three dependency ecosystems (Rust, Go, npm) plus
the deployment-image surface reviewed manually at audit time.
The entire project, including `enterprise/`, is licensed AGPLv3 as of
Phase 6 — there is no separate commercial-license carve-out anywhere in
this repo. Every third-party dependency must be compatible with AGPLv3
as the single project-wide license.
## Auto-allowed (CI passes without review)
These license families are pre-cleared as dependencies of AGPLv3/GPLv3
code — permissive licenses impose no copyleft obligation at all, and
MPL-2.0's file-level copyleft doesn't extend to a larger work that
merely links/imports MPL-covered code (MPL 2.0 §3.3, "Distribution of a
Larger Work"):
- MIT, MIT-0 ("MIT No Attribution")
- Apache-2.0 (including `Apache-2.0 WITH LLVM-exception`)
- BSD-2-Clause, BSD-3-Clause, 0BSD
- ISC
- MPL-2.0
- Unlicense, Zlib, Unicode-3.0, BSL-1.0 (Boost — not to be confused with
the *Business Source License*, also abbreviated BSL elsewhere in this
document; Boost's BSL-1.0 is a permissive OSI-approved license with no
relation to Redpanda's BSL 1.1)
CI enforcement:
- **Rust**: `cargo deny check licenses` against `agent/deny.toml` and
`search/deny.toml`'s `[licenses.allow]` list.
- **Go**: `go-licenses check ./... --allowed_licenses=...` per module
with real dependencies (see the workflow's matrix for the full list).
- **npm**: `license-checker --onlyAllow "..."` against `web`'s
dependency tree.
A dependency whose *only* license is outside this list fails CI. A
dependency offering one of these licenses as *one option* in an SPDX OR
expression (e.g. `MIT OR Apache-2.0 OR LGPL-2.1-or-later`) passes,
because we elect the permissive branch — this is a normal, standard
reading of a disjunctive license grant, not a loophole.
## Requires manual review (category b)
Anything not on the auto-allowed list and not obviously incompatible
needs a human to actually read the license and record reasoning here or
in the audit report before merging — not a guess, and not a silent
`--ignore`/allow-list addition. This includes:
- Other copyleft licenses not listed above: LGPL (any version), EPL,
CDDL, and similar. The specific question that matters is usually
*how* the code is consumed — a dynamically-linked/networked LGPL
dependency is generally fine; statically linking LGPL code into an
AGPL binary is murkier for some LGPL versions and needs a real
per-case read, not a blanket rule.
- Dual/multi-licensed packages where *none* of the offered licenses is
on the auto-allowed list.
- Anything with a custom license file rather than a standard SPDX
identifier, unless it's been manually confirmed (as
`github.com/segmentio/asm`'s "MIT No Attribution" text was at audit
time — SPDX `MIT-0`, added to the CI ignore list with that
citation, not silently allowed) — a new custom-licensed dependency
should not get the same free pass without its own confirmation.
- Docker/container base images pulled into `docker-compose.yml` or
`/deploy` — not covered by any of the three CI dependency scans above,
since they're not a language-ecosystem dependency. Reviewed manually
at audit time (Redpanda, ClickHouse, Postgres); a new base image needs
the same manual check, not an assumption that "it's just
infrastructure."
## Rejected (category c)
Not usable as a dependency of this project without an explicit,
recorded exception:
- Source-available licenses that aren't OSI-approved open source: BSL
(Business Source License), SSPL (Server Side Public License), Commons
Clause, and similar "free to use except..." terms.
- Any license with a field-of-use restriction or a "non-compete" clause
(e.g. "may not be used to offer a competing hosted service").
- "Free for non-commercial use" or similarly non-open terms.
**Known, accepted exception**: Redpanda (the
`docker.redpanda.com/redpandadata/redpanda` image pinned in
`docker-compose.yml`/`transport/`) ships under BSL 1.1 as of the pinned
version (v24.2.7), confirmed against the actual license file at that
tag, not assumed. This is consumed only as an external networked
Kafka-protocol broker — never linked into any AGPLv3 binary — so it
doesn't create an AGPL compatibility problem in the traditional linking
sense, and BSL's specific restriction (no reselling direct broker access
as a hosted streaming/queuing service) doesn't obviously apply to how
this project uses it. **Decision recorded 2026-08-16: accept as-is** —
see the audit report's Redpanda section for the full reasoning, the
other two remediation options that were considered and not chosen, and
the condition under which this decision should be revisited (an
official hosted/managed Sentry offering). A future change to Redpanda's
license, or to this project's own redistribution posture, should trigger
re-review, not silently ride on this entry.
## What CI does not cover
The automated checks above only see what a package manager sees. They
do not catch:
- Vendored/copied code not declared as a dependency (checked manually
at audit time via a repo-wide grep for copy/attribution markers — see
the audit report's methodology section; not re-run automatically).
- Font files, icon packs, or other design assets (also checked manually
at audit time).
- Docker base images (see above).
A new instance of any of these needs the same manual treatment the
original audit gave — this policy doesn't claim CI makes the project
audit-proof going forward, only that *dependency-manifest* drift is
caught automatically.
## Legal disclaimer
This policy, and the audit it's derived from, is a strong first pass —
not a legal opinion. It should be reviewed by actual legal counsel
before the project is publicly released, pitched to customers, or used
as the basis for any compliance claim.
docs/phase-4-isolation-design.md
+5 -2
View File
@@ -42,8 +42,11 @@ boundary text names multi-tenancy as enterprise-gated, and a
"mechanism in core, feature in enterprise" split would have let a
sufficiently motivated self-hosting AGPL user wire up real isolation
without ever touching `enterprise/` — undermining that boundary in
substance even while technically respecting the AGPL/commercial import
graph. Confirmed: enterprise-only.
substance even while technically respecting the import graph (at the
time, an AGPL/commercial split; as of Phase 6, `enterprise/` is AGPLv3
too, so the import graph is now the whole reason this boundary exists,
not a proxy for a licensing one — see
`/docs/compliance/license-audit-report.md`). Confirmed: enterprise-only.
Mechanically, this works because `api/internal/querylang/executor`
already defines the seam Phase 2 needs regardless of tenancy:
docs/phase-4-rbac-design.md
+7 -4
View File
@@ -192,10 +192,13 @@ replacement for it. Full middleware/handler wiring is task 5's scope.
## Web UI boundary: a runtime capability check, not a conditional import
Core `web` never bundles enterprise-licensed Svelte components into its
build — that would put commercial-licensed source inside an AGPL
artifact, the UI-layer equivalent of the Go import-boundary problem
`hack/check-tenant-boundary.sh` already guards against. Instead: core
Core `web` never bundles `enterprise/`'s Svelte components into its
build (at the time this was written, that would have put
commercial-licensed source inside an AGPL artifact; as of Phase 6 both
are AGPLv3, but the architectural separation stands on its own merits —
core builds and ships standalone, the UI-layer equivalent of the Go
import-boundary problem `hack/check-tenant-boundary.sh` already guards
against). Instead: core
`web` ships a generic settings/admin route
(`web/src/routes/settings/+page.svelte`, added in task 5) that, on load,
calls `GET {enterprise-auth base URL}/auth/features` and renders
docs/phase-4-runbook.md
+7 -4
View File
@@ -355,8 +355,9 @@ docker run --rm --network sentry_default -v $(pwd)/api:/src -w /src \
earlier in Phase 4, once `enterprise/cmd/enterprise-api` needed to
import it: Go's compiler-enforced `internal/` visibility rule meant a
separate module like `enterprise/` could never import anything under
`api/internal/...`, regardless of the AGPL/commercial licensing
boundary, which only forbids the reverse direction.)
`api/internal/...`, regardless of the licensing boundary (AGPL/commercial
at the time this was written; both AGPLv3 as of Phase 6), which only
forbids the reverse direction.)
Expect all `TestIntegration*` tests to pass, including
`TestIntegrationDashboardTenantForeignKeyRejectsUnknownTenant` (the
@@ -921,8 +922,10 @@ same registry the read side (§9) already uses -- routing each record's
write into its own tenant's Tantivy index instead of the single default
one. No "second binary" was needed here the way ClickHouse needed
`enterprise-ingest`: Tantivy has no grant system to gate a
commercially-licensed credential behind, so `IndexRegistry` already
lives directly in AGPL-core `search`, and read/write just share it.
separately-credentialed binary behind (commercially licensed at the
time this was written; AGPLv3 as of Phase 6, though the architectural
point never depended on that), so `IndexRegistry` already lives directly
in AGPL-core `search`, and read/write just share it.
Because Tantivy is an embedded library (no Docker/broker needed to
exercise real logic), this actually ran in this environment:
docs/security/threat-model.md
+17 -7
View File
@@ -167,9 +167,14 @@ always into the default index — genuinely verified in this environment,
same as the read-side Tantivy claim above, since Tantivy is an embedded
library with no Docker dependency. No "second binary" was needed here,
unlike ClickHouse: Tantivy has no grant system to gate a
commercially-licensed credential behind, so `IndexRegistry` already
lived directly in this AGPL-core `search` binary, and read/write simply
share it. This write path is now also active-tenant-gated:
separately-credentialed binary behind, so `IndexRegistry` already lived
directly in this AGPL-core `search` binary, and read/write simply share
it. (This reasoning predates Phase 6's relicensing of `enterprise/` to
AGPLv3 and originally referred to a commercially-licensed credential --
restated here because the architectural point holds independent of
licensing: Tantivy still has no grant system, so the split was never
about which license `enterprise/` carried.)
This write path is now also active-tenant-gated:
`search/src/tenants.rs`'s `ActiveTenantTracker` polls a new
`GET /internal/active-tenants` endpoint on `enterprise-auth` every 60
seconds (RoleService-credentialed, the same auth shape `alerting` uses
@@ -245,10 +250,15 @@ design doc doesn't yet cover, not just an implementation gap.
## Module boundary (trust boundary #1)
`enterprise/` (commercial license: SSO, RBAC storage, audit logging,
session issuance) is never imported by AGPL core (`/api`, `/alerting`,
`/web`, `/cli`) — enforced in CI by `hack/check-tenant-boundary.sh`,
which greps for the import edge on every build. Core calls
`enterprise/` (SSO, RBAC storage, audit logging, session issuance — AGPLv3,
same as core as of Phase 6, see `/docs/compliance/license-audit-report.md`)
is never imported by core (`/api`, `/alerting`, `/web`, `/cli`) —
enforced in CI by `hack/check-tenant-boundary.sh`, which greps for the
import edge on every build. This is an architectural trust boundary, not
a licensing one: it keeps core buildable and deployable with zero
multi-tenant mechanism present regardless of what license either side
carries, and keeps tenant identity resolution server-side rather than
trusting a request parameter. Core calls
`enterprise-auth` over plain HTTP (`api/authz.HTTPAuthorizer`),
forwarding only the `Cookie`/`Authorization` headers, never the full
request (`api/authz/httpauthz_test.go` asserts this — an