Regenerate the license inventory for the current dependency graph
Dependabot merges update lockfiles but never the inventory, so it had drifted: gridstack was recorded at 11.5.1 and vite at 8.2.1, the agent still listed tonic 0.12 and toml 0.8, and alerting -- named in the audit's methodology -- had no rows at all. Regenerated with the audit's own tools against this tree: cargo deny list for agent and search, go-licenses csv per Go module, license-checker for web. 52 versions bumped, 71 rows added, 55 gone, 786 -> 802 rows. Everything added is permissive (MIT, Apache-2.0, BSD-3-Clause, Zlib or an OR of those), so nothing is newly flagged; flagged rows go 36 -> 35 because ryu (Apache-2.0 OR BSL-1.0) left search's graph with reqwest 0.13. No bumped crate changed its license. Built on the rustls update, so agent records rustls 0.23.45 and no longer lists rustls-pemfile. As last time, rows whose name and version are unchanged are left byte-for-byte alone -- 679 of them -- so the diff is only the real change. That also keeps every hand-written row: the segmentio/asm MIT-0 confirmations, the fonts, the favicon, and the three Docker images. First-party github.com/cairnobs/cairnobs packages are left out, as before. New rows follow the conventions the existing ones use, which the regeneration reproduced exactly for every unchanged Rust and npm row. Signed-off-by: John Coffey <[email protected]>
This commit is contained in:
