coffey-labs/cairnobs
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Upgrade tantivy to 0.26 and clear the lru advisory

Browse Source 
Dependabot #10: lru's IterMut violates Stacked Borrows, fixed in 0.16.3.
lru was transitive through tantivy 0.22.1, which pins lru ^0.12.0, so
there was no in-range fix -- cargo update -p lru locks nothing. The
advisory was also not reachable: tantivy calls only get, put, len,
peek_lru and new on its LruCache, never iter_mut. Upgrading rather than
dismissing because it is early enough that carrying four versions of
drift costs more than paying it now, and the alert then closes on its
own evidence rather than on an argument.

lru resolves to 0.16.4, past the patch line.

One API change across the four releases. TopDocs no longer implements
Collector on its own -- an ordering has to be chosen rather than
defaulted into. order_by_score() is exactly what bare TopDocs did in
0.22, so result order is preserved rather than quietly changed, which
matters for a search endpoint whose contract is "most relevant first".

Index compatibility checked rather than assumed, since a format change
would have meant a reindex for every existing deployment. Against a live
index of 1757 documents written by 0.22: the service opened it without
error, a document indexed hours earlier by 0.22 is still findable, new
documents written by 0.26 are findable, and a phrase query spans both.
No migration needed.

The compliance inventory is regenerated for the new graph: 17 crates
added, 5 gone, 20 bumped, and three duplicate-version entries collapsed
where the graph no longer needs two. Nothing newly flagged -- every
addition is permissive -- and cargo-deny check licenses, which is the
gate CI actually runs, passes. Rows for crates whose name and version
are unchanged are left byte-for-byte alone, so the diff shows the real
change rather than 200 rows of SPDX term reordering.

Signed-off-by: John Coffey <[email protected]>
This commit is contained in:
jcoffey-dev
2026-09-04 22:17:28 -07:00
parent bd49fb7685
commit a53c309bad
5 changed files with 8898 additions and 8696 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/compliance/license-inventory.csv
+38 -28
View File
@@ -509,6 +509,8 @@ search,base64,0.22.1,Apache-2.0 OR MIT,transitive,rust,False,,a
search,bitflags,2.13.1,Apache-2.0 OR MIT,transitive,rust,False,,a
search,bitpacking,0.9.3,MIT,transitive,rust,False,,a
search,block-buffer,0.10.4,Apache-2.0 OR MIT,transitive,rust,False,,a
search,bon,3.10.0,Apache-2.0 OR MIT,transitive,rust,False,,a
search,bon-macros,3.10.0,Apache-2.0 OR MIT,transitive,rust,False,,a
search,bumpalo,3.20.3,Apache-2.0 OR MIT,transitive,rust,False,,a
search,byteorder,1.5.0,MIT OR Unlicense,transitive,rust,False,,a
search,bytes,1.12.1,MIT,transitive,rust,False,,a
@@ -525,12 +527,17 @@ search,crossbeam-epoch,0.9.20,Apache-2.0 OR MIT,transitive,rust,False,,a
search,crossbeam-utils,0.8.22,Apache-2.0 OR MIT,transitive,rust,False,,a
search,crunchy,0.2.4,MIT,transitive,rust,False,,a
search,crypto-common,0.1.7,Apache-2.0 OR MIT,transitive,rust,False,,a
search,darling,0.24.1,MIT,transitive,rust,False,,a
search,darling_core,0.24.1,MIT,transitive,rust,False,,a
search,darling_macro,0.24.1,MIT,transitive,rust,False,,a
search,datasketches,0.2.0,Apache-2.0,transitive,rust,False,,a
search,deranged,0.5.8,Apache-2.0 OR MIT,transitive,rust,False,,a
search,digest,0.10.7,Apache-2.0 OR MIT,transitive,rust,False,,a
search,displaydoc,0.2.7,Apache-2.0 OR MIT,transitive,rust,False,,a
search,downcast-rs,1.2.1,Apache-2.0 OR MIT,transitive,rust,False,,a
search,downcast-rs,2.0.2,Apache-2.0 OR MIT,transitive,rust,False,,a
search,either,1.17.0,Apache-2.0 OR MIT,transitive,rust,False,,a
search,equivalent,1.0.2,Apache-2.0 OR MIT,transitive,rust,False,,a
search,erased-serde,0.4.10,Apache-2.0 OR MIT,transitive,rust,False,,a
search,errno,0.3.14,Apache-2.0 OR MIT,transitive,rust,False,,a
search,fastdivide,0.4.2,MIT OR zlib-acknowledgement,transitive,rust,True,carries a copyleft/less-common license alongside permissive alternatives (SPDX OR) -- see classification,a
search,fastrand,2.5.0,Apache-2.0 OR MIT,transitive,rust,False,,a
@@ -538,9 +545,9 @@ search,find-msvc-tools,0.1.10,Apache-2.0 OR MIT,transitive,rust,False,,a
search,fixedbitset,0.5.7,Apache-2.0 OR MIT,transitive,rust,False,,a
search,flate2,1.1.9,Apache-2.0 OR MIT,transitive,rust,False,,a
search,fnv,1.0.7,Apache-2.0 OR MIT,transitive,rust,False,,a
search,foldhash,0.1.5,Zlib,transitive,rust,False,,a
search,foldhash,0.2.0,Zlib,transitive,rust,False,,a
search,form_urlencoded,1.2.2,Apache-2.0 OR MIT,transitive,rust,False,,a
search,fs4,0.8.4,Apache-2.0 OR MIT,transitive,rust,False,,a
search,fs4,0.13.1,Apache-2.0 OR MIT,transitive,rust,False,,a
search,futures,0.3.34,Apache-2.0 OR MIT,transitive,rust,False,,a
search,futures-channel,0.3.34,Apache-2.0 OR MIT,transitive,rust,False,,a
search,futures-core,0.3.34,Apache-2.0 OR MIT,transitive,rust,False,,a
@@ -553,12 +560,11 @@ search,futures-util,0.3.34,Apache-2.0 OR MIT,transitive,rust,False,,a
search,generic-array,0.14.7,MIT,transitive,rust,False,,a
search,getrandom,0.2.17,Apache-2.0 OR MIT,transitive,rust,False,,a
search,getrandom,0.4.3,Apache-2.0 OR MIT,transitive,rust,False,,a
search,h2,0.4.15,MIT,transitive,rust,False,,a
search,h2,0.4.16,MIT,transitive,rust,False,,a
search,hashbrown,0.12.3,Apache-2.0 OR MIT,transitive,rust,False,,a
search,hashbrown,0.15.5,Apache-2.0 OR MIT,transitive,rust,False,,a
search,hashbrown,0.16.1,Apache-2.0 OR MIT,transitive,rust,False,,a
search,hashbrown,0.17.1,Apache-2.0 OR MIT,transitive,rust,False,,a
search,heck,0.5.0,Apache-2.0 OR MIT,transitive,rust,False,,a
search,hermit-abi,0.5.2,Apache-2.0 OR MIT,transitive,rust,False,,a
search,hmac,0.12.1,Apache-2.0 OR MIT,transitive,rust,False,,a
search,htmlescape,0.3.1,Apache-2.0 OR MIT OR MPL-2.0,transitive,rust,True,carries a copyleft/less-common license alongside permissive alternatives (SPDX OR) -- see classification,a
search,http,1.5.0,Apache-2.0 OR MIT,transitive,rust,False,,a
@@ -576,14 +582,14 @@ search,icu_normalizer_data,2.3.0,Unicode-3.0,transitive,rust,False,,a
search,icu_properties,2.3.0,Unicode-3.0,transitive,rust,False,,a
search,icu_properties_data,2.3.0,Unicode-3.0,transitive,rust,False,,a
search,icu_provider,2.3.0,Unicode-3.0,transitive,rust,False,,a
search,ident_case,1.0.1,Apache-2.0 OR MIT,transitive,rust,False,,a
search,idna,1.1.0,Apache-2.0 OR MIT,transitive,rust,False,,a
search,idna_adapter,1.2.2,Apache-2.0 OR MIT,transitive,rust,False,,a
search,indexmap,1.9.3,Apache-2.0 OR MIT,transitive,rust,False,,a
search,indexmap,2.14.0,Apache-2.0 OR MIT,transitive,rust,False,,a
search,instant,0.1.13,BSD-3-Clause,transitive,rust,False,,a
search,integer-encoding,4.1.0,MIT,transitive,rust,False,,a
search,inventory,0.3.24,Apache-2.0 OR MIT,transitive,rust,False,,a
search,ipnet,2.12.1,Apache-2.0 OR MIT,transitive,rust,False,,a
search,itertools,0.12.1,Apache-2.0 OR MIT,transitive,rust,False,,a
search,itertools,0.14.0,Apache-2.0 OR MIT,transitive,rust,False,,a
search,itoa,1.0.18,Apache-2.0 OR MIT,transitive,rust,False,,a
search,jobserver,0.1.35,Apache-2.0 OR MIT,transitive,rust,False,,a
@@ -591,19 +597,17 @@ search,js-sys,0.3.104,Apache-2.0 OR MIT,transitive,rust,False,,a
search,lazy_static,1.5.0,Apache-2.0 OR MIT,transitive,rust,False,,a
search,levenshtein_automata,0.2.1,MIT,transitive,rust,False,,a
search,libc,0.2.189,Apache-2.0 OR MIT,transitive,rust,False,,a
search,libm,0.2.16,MIT,transitive,rust,False,,a
search,linux-raw-sys,0.12.1,Apache-2.0 OR Apache-2.0 WITH LLVM-exception OR MIT,transitive,rust,False,,a
search,linux-raw-sys,0.4.15,Apache-2.0 OR Apache-2.0 WITH LLVM-exception OR MIT,transitive,rust,False,,a
search,litemap,0.8.3,Unicode-3.0,transitive,rust,False,,a
search,lock_api,0.4.14,Apache-2.0 OR MIT,transitive,rust,False,,a
search,log,0.4.33,Apache-2.0 OR MIT,transitive,rust,False,,a
search,lru,0.12.5,MIT,transitive,rust,False,,a
search,lru,0.16.4,MIT,transitive,rust,False,,a
search,lz4,1.28.1,MIT,transitive,rust,False,,a
search,lz4-sys,1.11.1+lz4-1.10.0,MIT,transitive,rust,False,,a
search,lz4_flex,0.11.6,MIT,transitive,rust,False,,a
search,lz4_flex,0.13.1,MIT,transitive,rust,False,,a
search,matchers,0.2.0,MIT,transitive,rust,False,,a
search,matchit,0.7.3,BSD-3-Clause OR MIT,transitive,rust,False,,a
search,measure_time,0.8.3,MIT,transitive,rust,False,,a
search,measure_time,0.9.0,MIT,transitive,rust,False,,a
search,memchr,2.8.3,MIT OR Unlicense,transitive,rust,False,,a
search,memmap2,0.9.11,Apache-2.0 OR MIT,transitive,rust,False,,a
search,mime,0.3.17,Apache-2.0 OR MIT,transitive,rust,False,,a
@@ -616,10 +620,10 @@ search,nom,7.1.3,MIT,transitive,rust,False,,a
search,nu-ansi-term,0.50.3,MIT,transitive,rust,False,,a
search,num-conv,0.2.2,Apache-2.0 OR MIT,transitive,rust,False,,a
search,num-traits,0.2.19,Apache-2.0 OR MIT,transitive,rust,False,,a
search,num_cpus,1.17.0,Apache-2.0 OR MIT,transitive,rust,False,,a
search,once_cell,1.21.4,Apache-2.0 OR MIT,transitive,rust,False,,a
search,oneshot,0.1.13,Apache-2.0 OR MIT,transitive,rust,False,,a
search,ownedbytes,0.7.0,MIT,transitive,rust,False,,a
search,ordered-float,5.5.0,MIT,transitive,rust,False,,a
search,ownedbytes,0.9.0,MIT,transitive,rust,False,,a
search,parking_lot,0.12.5,Apache-2.0 OR MIT,transitive,rust,False,,a
search,parking_lot_core,0.9.12,Apache-2.0 OR MIT,transitive,rust,False,,a
search,pbkdf2,0.12.2,Apache-2.0 OR MIT,transitive,rust,False,,a
@@ -633,6 +637,7 @@ search,potential_utf,0.1.6,Unicode-3.0,transitive,rust,False,,a
search,powerfmt,0.2.0,Apache-2.0 OR MIT,transitive,rust,False,,a
search,ppv-lite86,0.2.21,Apache-2.0 OR MIT,transitive,rust,False,,a
search,prettyplease,0.2.37,Apache-2.0 OR MIT,transitive,rust,False,,a
search,prettyplease,0.3.0,Apache-2.0 OR MIT,transitive,rust,False,,a
search,proc-macro2,1.0.107,Apache-2.0 OR MIT,transitive,rust,False,,a
search,prost,0.13.5,Apache-2.0,direct,rust,False,,a
search,prost-build,0.13.5,Apache-2.0,transitive,rust,False,,a
@@ -643,7 +648,6 @@ search,r-efi,6.0.0,Apache-2.0 OR LGPL-2.1-or-later OR MIT,transitive,rust,True,c
search,rand,0.8.7,Apache-2.0 OR MIT,transitive,rust,False,,a
search,rand_chacha,0.3.1,Apache-2.0 OR MIT,transitive,rust,False,,a
search,rand_core,0.6.4,Apache-2.0 OR MIT,transitive,rust,False,,a
search,rand_distr,0.4.3,Apache-2.0 OR MIT,transitive,rust,False,,a
search,rayon,1.12.0,Apache-2.0 OR MIT,transitive,rust,False,,a
search,rayon-core,1.13.0,Apache-2.0 OR MIT,transitive,rust,False,,a
search,redox_syscall,0.5.18,MIT,transitive,rust,False,,a
@@ -654,9 +658,8 @@ search,reqwest,0.12.28,Apache-2.0 OR MIT,direct,rust,False,,a
search,rsasl,2.3.1,Apache-2.0 OR MIT,transitive,rust,False,,a
search,rskafka,0.6.0,Apache-2.0 OR MIT,direct,rust,False,,a
search,rust-stemmers,1.2.0,BSD-3-Clause OR MIT,transitive,rust,False,,a
search,rustc-hash,1.1.0,Apache-2.0 OR MIT,transitive,rust,False,,a
search,rustc-hash,2.1.3,Apache-2.0 OR MIT,transitive,rust,False,,a
search,rustc_version,0.4.1,Apache-2.0 OR MIT,transitive,rust,False,,a
search,rustix,0.38.44,Apache-2.0 OR Apache-2.0 WITH LLVM-exception OR MIT,transitive,rust,False,,a
search,rustix,1.1.4,Apache-2.0 OR Apache-2.0 WITH LLVM-exception OR MIT,transitive,rust,False,,a
search,rustversion,1.0.23,Apache-2.0 OR MIT,transitive,rust,False,,a
search,ryu,1.0.23,Apache-2.0 OR BSL-1.0,transitive,rust,True,carries a copyleft/less-common license alongside permissive alternatives (SPDX OR) -- see classification,a
@@ -672,7 +675,7 @@ search,sharded-slab,0.1.7,MIT,transitive,rust,False,,a
search,shlex,2.0.1,Apache-2.0 OR MIT,transitive,rust,False,,a
search,signal-hook-registry,1.4.8,Apache-2.0 OR MIT,transitive,rust,False,,a
search,simd-adler32,0.3.10,MIT,transitive,rust,False,,a
search,sketches-ddsketch,0.2.2,Apache-2.0,transitive,rust,False,,a
search,sketches-ddsketch,0.4.1,Apache-2.0,transitive,rust,False,,a
search,slab,0.4.12,MIT,transitive,rust,False,,a
search,smallvec,1.15.2,Apache-2.0 OR MIT,transitive,rust,False,,a
search,snap,1.1.2,BSD-3-Clause,transitive,rust,False,,a
@@ -680,20 +683,21 @@ search,socket2,0.5.10,Apache-2.0 OR MIT,transitive,rust,False,,a
search,socket2,0.6.5,Apache-2.0 OR MIT,transitive,rust,False,,a
search,stable_deref_trait,1.2.1,Apache-2.0 OR MIT,transitive,rust,False,,a
search,stringprep,0.1.5,Apache-2.0 OR MIT,transitive,rust,False,,a
search,strsim,0.11.1,MIT,transitive,rust,False,,a
search,subtle,2.6.1,BSD-3-Clause,transitive,rust,False,,a
search,syn,2.0.119,Apache-2.0 OR MIT,transitive,rust,False,,a
search,syn,3.0.3,Apache-2.0 OR MIT,transitive,rust,False,,a
search,sync_wrapper,1.0.2,Apache-2.0,transitive,rust,False,,a
search,synstructure,0.13.2,MIT,transitive,rust,False,,a
search,tantivy,0.22.1,MIT,direct,rust,False,,a
search,tantivy-bitpacker,0.6.0,MIT,transitive,rust,False,,a
search,tantivy-columnar,0.3.0,MIT,transitive,rust,False,,a
search,tantivy-common,0.7.0,MIT,transitive,rust,False,,a
search,tantivy,0.26.1,MIT,direct,rust,False,,a
search,tantivy-bitpacker,0.10.0,MIT,transitive,rust,False,,a
search,tantivy-columnar,0.7.0,MIT,transitive,rust,False,,a
search,tantivy-common,0.11.0,MIT,transitive,rust,False,,a
search,tantivy-fst,0.5.0,MIT OR Unlicense,transitive,rust,False,,a
search,tantivy-query-grammar,0.22.0,MIT,transitive,rust,False,,a
search,tantivy-sstable,0.3.0,MIT,transitive,rust,False,,a
search,tantivy-stacker,0.3.0,MIT,transitive,rust,False,,a
search,tantivy-tokenizer-api,0.3.0,MIT,transitive,rust,False,,a
search,tantivy-query-grammar,0.26.0,MIT,transitive,rust,False,,a
search,tantivy-sstable,0.7.0,MIT,transitive,rust,False,,a
search,tantivy-stacker,0.7.0,MIT,transitive,rust,False,,a
search,tantivy-tokenizer-api,0.7.0,MIT,transitive,rust,False,,a
search,tempfile,3.27.0,Apache-2.0 OR MIT,direct,rust,False,,a
search,thiserror,1.0.69,Apache-2.0 OR MIT,transitive,rust,False,,a
search,thiserror,2.0.20,Apache-2.0 OR MIT,transitive,rust,False,,a
@@ -702,6 +706,7 @@ search,thiserror-impl,2.0.20,Apache-2.0 OR MIT,transitive,rust,False,,a
search,thread_local,1.1.10,Apache-2.0 OR MIT,transitive,rust,False,,a
search,time,0.3.55,Apache-2.0 OR MIT,transitive,rust,False,,a
search,time-core,0.1.9,Apache-2.0 OR MIT,transitive,rust,False,,a
search,time-macros,0.2.32,Apache-2.0 OR MIT,transitive,rust,False,,a
search,tinystr,0.8.4,Unicode-3.0,transitive,rust,False,,a
search,tinyvec,1.12.0,Apache-2.0 OR MIT OR Zlib,transitive,rust,False,,a
search,tinyvec_macros,0.1.1,Apache-2.0 OR MIT OR Zlib,transitive,rust,False,,a
@@ -722,7 +727,10 @@ search,tracing-core,0.1.36,MIT,transitive,rust,False,,a
search,tracing-log,0.2.0,MIT,transitive,rust,False,,a
search,tracing-subscriber,0.3.23,MIT,direct,rust,False,,a
search,try-lock,0.2.5,MIT,transitive,rust,False,,a
search,typeid,1.0.3,Apache-2.0 OR MIT,transitive,rust,False,,a
search,typenum,1.20.1,Apache-2.0 OR MIT,transitive,rust,False,,a
search,typetag,0.2.23,Apache-2.0 OR MIT,transitive,rust,False,,a
search,typetag-impl,0.2.23,Apache-2.0 OR MIT,transitive,rust,False,,a
search,unicode-bidi,0.3.18,Apache-2.0 OR MIT,transitive,rust,False,,a
search,unicode-ident,1.0.24,Apache-2.0 OR MIT OR Unicode-3.0,transitive,rust,False,,a
search,unicode-normalization,0.1.25,Apache-2.0 OR MIT,transitive,rust,False,,a
@@ -731,6 +739,7 @@ search,url,2.5.8,Apache-2.0 OR MIT,transitive,rust,False,,a
search,utf8-ranges,1.0.5,MIT OR Unlicense,transitive,rust,False,,a
search,utf8_iter,1.0.4,Apache-2.0 OR MIT,transitive,rust,False,,a
search,uuid,1.24.0,Apache-2.0 OR MIT,transitive,rust,False,,a
search,valuable,0.1.1,MIT,transitive,rust,False,,a
search,version_check,0.9.5,Apache-2.0 OR MIT,transitive,rust,False,,a
search,want,0.3.1,MIT,transitive,rust,False,,a
search,wasi,0.11.1+wasi-snapshot-preview1,Apache-2.0 OR Apache-2.0 WITH LLVM-exception OR MIT,transitive,rust,False,,a
@@ -760,6 +769,7 @@ search,writeable,0.6.4,Unicode-3.0,transitive,rust,False,,a
search,yoke,0.8.3,Unicode-3.0,transitive,rust,False,,a
search,yoke-derive,0.8.2,Unicode-3.0,transitive,rust,False,,a
search,zerocopy,0.8.56,Apache-2.0 OR BSD-2-Clause OR MIT,transitive,rust,False,,a
search,zerocopy-derive,0.8.56,Apache-2.0 OR BSD-2-Clause OR MIT,transitive,rust,False,,a
search,zerofrom,0.1.8,Unicode-3.0,transitive,rust,False,,a
search,zerofrom-derive,0.1.7,Unicode-3.0,transitive,rust,False,,a
search,zerotrie,0.2.5,Unicode-3.0,transitive,rust,False,,a
@@ -772,6 +782,6 @@ search,zstd-sys,2.0.16+zstd.1.5.7,Apache-2.0 OR MIT,transitive,rust,False,,a
web,Overpass (font),variable,OFL-1.1,direct,font-asset,False,,a
web,Overpass Mono (font),variable,OFL-1.1,direct,font-asset,False,,a
web,favicon.svg,n/a,MIT (Svelte project asset),direct,vendored-asset,True,"Copied from SvelteKit's default project scaffold (<title>svelte-logo</title>), never replaced with an original mark -- not a license-compatibility blocker (Svelte's own assets are MIT) but is unauthored, unattributed, third-party branded content shipping as this product's own favicon. Flagged for replacement, not a legal blocker.",n/a-branding
transport,redpanda (docker image),v24.2.7,"BSL 1.1 (Business Source License) for Redpanda Core, as pinned (v24.2.7, released 2024-10-11) -- NOT yet converted to Apache-2.0 (4-year Change Date is ~2028-10-11). Source-available, not OSI-approved open source. Additional Use Grant permits any use except offering it as a hosted 'Streaming or Queuing Service' to third parties.",direct,docker-image,True,"Category (c): BSL is explicitly source-available, not OSI-approved open source, per the audit's own classification framework. Verified against the actual licenses/bsl.md at the v24.2.7 tag, not assumed. No AGPL linking-compatibility issue (Redpanda is consumed only over the Kafka wire protocol, never linked into Sentry's own code -- same relationship as ClickHouse/Postgres). Real open question: whether a third party self-hosting Sentry (now fully AGPLv3 per task 6) 'as a service' would trip BSL's Streaming-or-Queuing-Service restriction on the bundled Redpanda image -- Sentry's ingest pipeline creates fixed internal topics, not per-end-user topics, so this is very likely NOT a Streaming-or-Queuing-Service under BSL's own definition, but this is a business/redistribution judgment call, not a pure technical one -- flagged for your decision, not resolved unilaterally. See license-audit-report.md's Redpanda section for the three remediation options (accept as-is / swap to Apache Kafka / flag only). RESOLVED 2026-08-16 (business decision): accept as-is. Sentry's own use (internal Kafka-protocol transport, no resale of broker access) is within BSL's Additional Use Grant; the third-party self-hosting-as-a-service question was judged unlikely to trip BSL's Streaming-or-Queuing-Service restriction, and was accepted as a known, disclosed risk rather than swapping to a heavier broker or dropping the bundled image. See license-audit-report.md's Redpanda section.",c
transport,redpanda (docker image),v24.2.7,"BSL 1.1 (Business Source License) for Redpanda Core, as pinned (v24.2.7, released 2024-10-11) -- NOT yet converted to Apache-2.0 (4-year Change Date is ~2028-10-11). Source-available, not OSI-approved open source. Additional Use Grant permits any use except offering it as a hosted 'Streaming or Queuing Service' to third parties.",direct,docker-image,True,"Category (c): BSL is explicitly source-available, not OSI-approved open source, per the audit's own classification framework. Verified against the actual licenses/bsl.md at the v24.2.7 tag, not assumed. No AGPL linking-compatibility issue (Redpanda is consumed only over the Kafka wire protocol, never linked into Cairn OBS's own code -- same relationship as ClickHouse/Postgres). Real open question: whether a third party self-hosting Cairn OBS (now fully AGPLv3 per task 6) 'as a service' would trip BSL's Streaming-or-Queuing-Service restriction on the bundled Redpanda image -- Cairn OBS's ingest pipeline creates fixed internal topics, not per-end-user topics, so this is very likely NOT a Streaming-or-Queuing-Service under BSL's own definition, but this is a business/redistribution judgment call, not a pure technical one -- flagged for your decision, not resolved unilaterally. See license-audit-report.md's Redpanda section for the three remediation options (accept as-is / swap to Apache Kafka / flag only). RESOLVED 2026-08-16 (business decision): accept as-is. Cairn OBS's own use (internal Kafka-protocol transport, no resale of broker access) is within BSL's Additional Use Grant; the third-party self-hosting-as-a-service question was judged unlikely to trip BSL's Streaming-or-Queuing-Service restriction, and was accepted as a known, disclosed risk rather than swapping to a heavier broker or dropping the bundled image. See license-audit-report.md's Redpanda section.",c
storage,clickhouse-server (docker image),24.8,"Apache-2.0, confirmed directly against ClickHouse's LICENSE file. No evidence of any historical license change (unlike Redpanda/Elastic/MongoDB) -- confirmed via web search plus direct file fetch, not assumed from general reputation.",direct,docker-image,False,,a
metadata,postgres (docker image),16-alpine,"PostgreSQL License (OSI-approved, MIT/BSD-equivalent permissive terms), confirmed directly against the official postgres/postgres COPYRIGHT file.",direct,docker-image,False,,a
1 component dependency version license direct_or_transitive ecosystem flagged flag_reason classification
509 search bitflags 2.13.1 Apache-2.0 OR MIT transitive rust False a
510 search bitpacking 0.9.3 MIT transitive rust False a
511 search block-buffer 0.10.4 Apache-2.0 OR MIT transitive rust False a
512 search bon 3.10.0 Apache-2.0 OR MIT transitive rust False a
513 search bon-macros 3.10.0 Apache-2.0 OR MIT transitive rust False a
514 search bumpalo 3.20.3 Apache-2.0 OR MIT transitive rust False a
515 search byteorder 1.5.0 MIT OR Unlicense transitive rust False a
516 search bytes 1.12.1 MIT transitive rust False a
527 search crossbeam-utils 0.8.22 Apache-2.0 OR MIT transitive rust False a
528 search crunchy 0.2.4 MIT transitive rust False a
529 search crypto-common 0.1.7 Apache-2.0 OR MIT transitive rust False a
530 search darling 0.24.1 MIT transitive rust False a
531 search darling_core 0.24.1 MIT transitive rust False a
532 search darling_macro 0.24.1 MIT transitive rust False a
533 search datasketches 0.2.0 Apache-2.0 transitive rust False a
534 search deranged 0.5.8 Apache-2.0 OR MIT transitive rust False a
535 search digest 0.10.7 Apache-2.0 OR MIT transitive rust False a
536 search displaydoc 0.2.7 Apache-2.0 OR MIT transitive rust False a
537 search downcast-rs 1.2.1 2.0.2 Apache-2.0 OR MIT transitive rust False a
538 search either 1.17.0 Apache-2.0 OR MIT transitive rust False a
539 search equivalent 1.0.2 Apache-2.0 OR MIT transitive rust False a
540 search erased-serde 0.4.10 Apache-2.0 OR MIT transitive rust False a
541 search errno 0.3.14 Apache-2.0 OR MIT transitive rust False a
542 search fastdivide 0.4.2 MIT OR zlib-acknowledgement transitive rust True carries a copyleft/less-common license alongside permissive alternatives (SPDX OR) -- see classification a
543 search fastrand 2.5.0 Apache-2.0 OR MIT transitive rust False a
545 search fixedbitset 0.5.7 Apache-2.0 OR MIT transitive rust False a
546 search flate2 1.1.9 Apache-2.0 OR MIT transitive rust False a
547 search fnv 1.0.7 Apache-2.0 OR MIT transitive rust False a
548 search foldhash 0.1.5 0.2.0 Zlib transitive rust False a
549 search form_urlencoded 1.2.2 Apache-2.0 OR MIT transitive rust False a
550 search fs4 0.8.4 0.13.1 Apache-2.0 OR MIT transitive rust False a
551 search futures 0.3.34 Apache-2.0 OR MIT transitive rust False a
552 search futures-channel 0.3.34 Apache-2.0 OR MIT transitive rust False a
553 search futures-core 0.3.34 Apache-2.0 OR MIT transitive rust False a
560 search generic-array 0.14.7 MIT transitive rust False a
561 search getrandom 0.2.17 Apache-2.0 OR MIT transitive rust False a
562 search getrandom 0.4.3 Apache-2.0 OR MIT transitive rust False a
563 search h2 0.4.15 0.4.16 MIT transitive rust False a
564 search hashbrown 0.12.3 Apache-2.0 OR MIT transitive rust False a
565 search hashbrown 0.15.5 0.16.1 Apache-2.0 OR MIT transitive rust False a
566 search hashbrown 0.17.1 Apache-2.0 OR MIT transitive rust False a
567 search heck 0.5.0 Apache-2.0 OR MIT transitive rust False a
search hermit-abi 0.5.2 Apache-2.0 OR MIT transitive rust False a
568 search hmac 0.12.1 Apache-2.0 OR MIT transitive rust False a
569 search htmlescape 0.3.1 Apache-2.0 OR MIT OR MPL-2.0 transitive rust True carries a copyleft/less-common license alongside permissive alternatives (SPDX OR) -- see classification a
570 search http 1.5.0 Apache-2.0 OR MIT transitive rust False a
582 search icu_properties 2.3.0 Unicode-3.0 transitive rust False a
583 search icu_properties_data 2.3.0 Unicode-3.0 transitive rust False a
584 search icu_provider 2.3.0 Unicode-3.0 transitive rust False a
585 search ident_case 1.0.1 Apache-2.0 OR MIT transitive rust False a
586 search idna 1.1.0 Apache-2.0 OR MIT transitive rust False a
587 search idna_adapter 1.2.2 Apache-2.0 OR MIT transitive rust False a
588 search indexmap 1.9.3 Apache-2.0 OR MIT transitive rust False a
589 search indexmap 2.14.0 Apache-2.0 OR MIT transitive rust False a
search instant 0.1.13 BSD-3-Clause transitive rust False a
590 search integer-encoding 4.1.0 MIT transitive rust False a
591 search inventory 0.3.24 Apache-2.0 OR MIT transitive rust False a
592 search ipnet 2.12.1 Apache-2.0 OR MIT transitive rust False a
search itertools 0.12.1 Apache-2.0 OR MIT transitive rust False a
593 search itertools 0.14.0 Apache-2.0 OR MIT transitive rust False a
594 search itoa 1.0.18 Apache-2.0 OR MIT transitive rust False a
595 search jobserver 0.1.35 Apache-2.0 OR MIT transitive rust False a
597 search lazy_static 1.5.0 Apache-2.0 OR MIT transitive rust False a
598 search levenshtein_automata 0.2.1 MIT transitive rust False a
599 search libc 0.2.189 Apache-2.0 OR MIT transitive rust False a
search libm 0.2.16 MIT transitive rust False a
600 search linux-raw-sys 0.12.1 Apache-2.0 OR Apache-2.0 WITH LLVM-exception OR MIT transitive rust False a
search linux-raw-sys 0.4.15 Apache-2.0 OR Apache-2.0 WITH LLVM-exception OR MIT transitive rust False a
601 search litemap 0.8.3 Unicode-3.0 transitive rust False a
602 search lock_api 0.4.14 Apache-2.0 OR MIT transitive rust False a
603 search log 0.4.33 Apache-2.0 OR MIT transitive rust False a
604 search lru 0.12.5 0.16.4 MIT transitive rust False a
605 search lz4 1.28.1 MIT transitive rust False a
606 search lz4-sys 1.11.1+lz4-1.10.0 MIT transitive rust False a
607 search lz4_flex 0.11.6 0.13.1 MIT transitive rust False a
608 search matchers 0.2.0 MIT transitive rust False a
609 search matchit 0.7.3 BSD-3-Clause OR MIT transitive rust False a
610 search measure_time 0.8.3 0.9.0 MIT transitive rust False a
611 search memchr 2.8.3 MIT OR Unlicense transitive rust False a
612 search memmap2 0.9.11 Apache-2.0 OR MIT transitive rust False a
613 search mime 0.3.17 Apache-2.0 OR MIT transitive rust False a
620 search nu-ansi-term 0.50.3 MIT transitive rust False a
621 search num-conv 0.2.2 Apache-2.0 OR MIT transitive rust False a
622 search num-traits 0.2.19 Apache-2.0 OR MIT transitive rust False a
search num_cpus 1.17.0 Apache-2.0 OR MIT transitive rust False a
623 search once_cell 1.21.4 Apache-2.0 OR MIT transitive rust False a
624 search oneshot 0.1.13 Apache-2.0 OR MIT transitive rust False a
625 search ownedbytes ordered-float 0.7.0 5.5.0 MIT transitive rust False a
626 search ownedbytes 0.9.0 MIT transitive rust False a
627 search parking_lot 0.12.5 Apache-2.0 OR MIT transitive rust False a
628 search parking_lot_core 0.9.12 Apache-2.0 OR MIT transitive rust False a
629 search pbkdf2 0.12.2 Apache-2.0 OR MIT transitive rust False a
637 search powerfmt 0.2.0 Apache-2.0 OR MIT transitive rust False a
638 search ppv-lite86 0.2.21 Apache-2.0 OR MIT transitive rust False a
639 search prettyplease 0.2.37 Apache-2.0 OR MIT transitive rust False a
640 search prettyplease 0.3.0 Apache-2.0 OR MIT transitive rust False a
641 search proc-macro2 1.0.107 Apache-2.0 OR MIT transitive rust False a
642 search prost 0.13.5 Apache-2.0 direct rust False a
643 search prost-build 0.13.5 Apache-2.0 transitive rust False a
648 search rand 0.8.7 Apache-2.0 OR MIT transitive rust False a
649 search rand_chacha 0.3.1 Apache-2.0 OR MIT transitive rust False a
650 search rand_core 0.6.4 Apache-2.0 OR MIT transitive rust False a
search rand_distr 0.4.3 Apache-2.0 OR MIT transitive rust False a
651 search rayon 1.12.0 Apache-2.0 OR MIT transitive rust False a
652 search rayon-core 1.13.0 Apache-2.0 OR MIT transitive rust False a
653 search redox_syscall 0.5.18 MIT transitive rust False a
658 search rsasl 2.3.1 Apache-2.0 OR MIT transitive rust False a
659 search rskafka 0.6.0 Apache-2.0 OR MIT direct rust False a
660 search rust-stemmers 1.2.0 BSD-3-Clause OR MIT transitive rust False a
661 search rustc-hash 1.1.0 2.1.3 Apache-2.0 OR MIT transitive rust False a
662 search rustc_version 0.4.1 Apache-2.0 OR MIT transitive rust False a
search rustix 0.38.44 Apache-2.0 OR Apache-2.0 WITH LLVM-exception OR MIT transitive rust False a
663 search rustix 1.1.4 Apache-2.0 OR Apache-2.0 WITH LLVM-exception OR MIT transitive rust False a
664 search rustversion 1.0.23 Apache-2.0 OR MIT transitive rust False a
665 search ryu 1.0.23 Apache-2.0 OR BSL-1.0 transitive rust True carries a copyleft/less-common license alongside permissive alternatives (SPDX OR) -- see classification a
675 search shlex 2.0.1 Apache-2.0 OR MIT transitive rust False a
676 search signal-hook-registry 1.4.8 Apache-2.0 OR MIT transitive rust False a
677 search simd-adler32 0.3.10 MIT transitive rust False a
678 search sketches-ddsketch 0.2.2 0.4.1 Apache-2.0 transitive rust False a
679 search slab 0.4.12 MIT transitive rust False a
680 search smallvec 1.15.2 Apache-2.0 OR MIT transitive rust False a
681 search snap 1.1.2 BSD-3-Clause transitive rust False a
683 search socket2 0.6.5 Apache-2.0 OR MIT transitive rust False a
684 search stable_deref_trait 1.2.1 Apache-2.0 OR MIT transitive rust False a
685 search stringprep 0.1.5 Apache-2.0 OR MIT transitive rust False a
686 search strsim 0.11.1 MIT transitive rust False a
687 search subtle 2.6.1 BSD-3-Clause transitive rust False a
688 search syn 2.0.119 Apache-2.0 OR MIT transitive rust False a
689 search syn 3.0.3 Apache-2.0 OR MIT transitive rust False a
690 search sync_wrapper 1.0.2 Apache-2.0 transitive rust False a
691 search synstructure 0.13.2 MIT transitive rust False a
692 search tantivy 0.22.1 0.26.1 MIT direct rust False a
693 search tantivy-bitpacker 0.6.0 0.10.0 MIT transitive rust False a
694 search tantivy-columnar 0.3.0 0.7.0 MIT transitive rust False a
695 search tantivy-common 0.7.0 0.11.0 MIT transitive rust False a
696 search tantivy-fst 0.5.0 MIT OR Unlicense transitive rust False a
697 search tantivy-query-grammar 0.22.0 0.26.0 MIT transitive rust False a
698 search tantivy-sstable 0.3.0 0.7.0 MIT transitive rust False a
699 search tantivy-stacker 0.3.0 0.7.0 MIT transitive rust False a
700 search tantivy-tokenizer-api 0.3.0 0.7.0 MIT transitive rust False a
701 search tempfile 3.27.0 Apache-2.0 OR MIT direct rust False a
702 search thiserror 1.0.69 Apache-2.0 OR MIT transitive rust False a
703 search thiserror 2.0.20 Apache-2.0 OR MIT transitive rust False a
706 search thread_local 1.1.10 Apache-2.0 OR MIT transitive rust False a
707 search time 0.3.55 Apache-2.0 OR MIT transitive rust False a
708 search time-core 0.1.9 Apache-2.0 OR MIT transitive rust False a
709 search time-macros 0.2.32 Apache-2.0 OR MIT transitive rust False a
710 search tinystr 0.8.4 Unicode-3.0 transitive rust False a
711 search tinyvec 1.12.0 Apache-2.0 OR MIT OR Zlib transitive rust False a
712 search tinyvec_macros 0.1.1 Apache-2.0 OR MIT OR Zlib transitive rust False a
727 search tracing-log 0.2.0 MIT transitive rust False a
728 search tracing-subscriber 0.3.23 MIT direct rust False a
729 search try-lock 0.2.5 MIT transitive rust False a
730 search typeid 1.0.3 Apache-2.0 OR MIT transitive rust False a
731 search typenum 1.20.1 Apache-2.0 OR MIT transitive rust False a
732 search typetag 0.2.23 Apache-2.0 OR MIT transitive rust False a
733 search typetag-impl 0.2.23 Apache-2.0 OR MIT transitive rust False a
734 search unicode-bidi 0.3.18 Apache-2.0 OR MIT transitive rust False a
735 search unicode-ident 1.0.24 Apache-2.0 OR MIT OR Unicode-3.0 transitive rust False a
736 search unicode-normalization 0.1.25 Apache-2.0 OR MIT transitive rust False a
739 search utf8-ranges 1.0.5 MIT OR Unlicense transitive rust False a
740 search utf8_iter 1.0.4 Apache-2.0 OR MIT transitive rust False a
741 search uuid 1.24.0 Apache-2.0 OR MIT transitive rust False a
742 search valuable 0.1.1 MIT transitive rust False a
743 search version_check 0.9.5 Apache-2.0 OR MIT transitive rust False a
744 search want 0.3.1 MIT transitive rust False a
745 search wasi 0.11.1+wasi-snapshot-preview1 Apache-2.0 OR Apache-2.0 WITH LLVM-exception OR MIT transitive rust False a
769 search yoke 0.8.3 Unicode-3.0 transitive rust False a
770 search yoke-derive 0.8.2 Unicode-3.0 transitive rust False a
771 search zerocopy 0.8.56 Apache-2.0 OR BSD-2-Clause OR MIT transitive rust False a
772 search zerocopy-derive 0.8.56 Apache-2.0 OR BSD-2-Clause OR MIT transitive rust False a
773 search zerofrom 0.1.8 Unicode-3.0 transitive rust False a
774 search zerofrom-derive 0.1.7 Unicode-3.0 transitive rust False a
775 search zerotrie 0.2.5 Unicode-3.0 transitive rust False a
782 web Overpass (font) variable OFL-1.1 direct font-asset False a
783 web Overpass Mono (font) variable OFL-1.1 direct font-asset False a
784 web favicon.svg n/a MIT (Svelte project asset) direct vendored-asset True Copied from SvelteKit's default project scaffold (<title>svelte-logo</title>), never replaced with an original mark -- not a license-compatibility blocker (Svelte's own assets are MIT) but is unauthored, unattributed, third-party branded content shipping as this product's own favicon. Flagged for replacement, not a legal blocker. n/a-branding
785 transport redpanda (docker image) v24.2.7 BSL 1.1 (Business Source License) for Redpanda Core, as pinned (v24.2.7, released 2024-10-11) -- NOT yet converted to Apache-2.0 (4-year Change Date is ~2028-10-11). Source-available, not OSI-approved open source. Additional Use Grant permits any use except offering it as a hosted 'Streaming or Queuing Service' to third parties. direct docker-image True Category (c): BSL is explicitly source-available, not OSI-approved open source, per the audit's own classification framework. Verified against the actual licenses/bsl.md at the v24.2.7 tag, not assumed. No AGPL linking-compatibility issue (Redpanda is consumed only over the Kafka wire protocol, never linked into Sentry's own code -- same relationship as ClickHouse/Postgres). Real open question: whether a third party self-hosting Sentry (now fully AGPLv3 per task 6) 'as a service' would trip BSL's Streaming-or-Queuing-Service restriction on the bundled Redpanda image -- Sentry's ingest pipeline creates fixed internal topics, not per-end-user topics, so this is very likely NOT a Streaming-or-Queuing-Service under BSL's own definition, but this is a business/redistribution judgment call, not a pure technical one -- flagged for your decision, not resolved unilaterally. See license-audit-report.md's Redpanda section for the three remediation options (accept as-is / swap to Apache Kafka / flag only). RESOLVED 2026-08-16 (business decision): accept as-is. Sentry's own use (internal Kafka-protocol transport, no resale of broker access) is within BSL's Additional Use Grant; the third-party self-hosting-as-a-service question was judged unlikely to trip BSL's Streaming-or-Queuing-Service restriction, and was accepted as a known, disclosed risk rather than swapping to a heavier broker or dropping the bundled image. See license-audit-report.md's Redpanda section. Category (c): BSL is explicitly source-available, not OSI-approved open source, per the audit's own classification framework. Verified against the actual licenses/bsl.md at the v24.2.7 tag, not assumed. No AGPL linking-compatibility issue (Redpanda is consumed only over the Kafka wire protocol, never linked into Cairn OBS's own code -- same relationship as ClickHouse/Postgres). Real open question: whether a third party self-hosting Cairn OBS (now fully AGPLv3 per task 6) 'as a service' would trip BSL's Streaming-or-Queuing-Service restriction on the bundled Redpanda image -- Cairn OBS's ingest pipeline creates fixed internal topics, not per-end-user topics, so this is very likely NOT a Streaming-or-Queuing-Service under BSL's own definition, but this is a business/redistribution judgment call, not a pure technical one -- flagged for your decision, not resolved unilaterally. See license-audit-report.md's Redpanda section for the three remediation options (accept as-is / swap to Apache Kafka / flag only). RESOLVED 2026-08-16 (business decision): accept as-is. Cairn OBS's own use (internal Kafka-protocol transport, no resale of broker access) is within BSL's Additional Use Grant; the third-party self-hosting-as-a-service question was judged unlikely to trip BSL's Streaming-or-Queuing-Service restriction, and was accepted as a known, disclosed risk rather than swapping to a heavier broker or dropping the bundled image. See license-audit-report.md's Redpanda section. c
786 storage clickhouse-server (docker image) 24.8 Apache-2.0, confirmed directly against ClickHouse's LICENSE file. No evidence of any historical license change (unlike Redpanda/Elastic/MongoDB) -- confirmed via web search plus direct file fetch, not assumed from general reputation. direct docker-image False a
787 metadata postgres (docker image) 16-alpine PostgreSQL License (OSI-approved, MIT/BSD-equivalent permissive terms), confirmed directly against the official postgres/postgres COPYRIGHT file. direct docker-image False a
docs/compliance/license-inventory.json
+8646 -8536
View File
File diff suppressed because it is too large Load Diff