# Third-party licenses

This project is distributed under the MIT License (see `LICENSE`). MIT requires that the upstream LICENSE text be preserved in each third-party dependency's installed artifact — npm and Go's module cache do this by default.


## Summary

| Category | Count |
|---|---:|
| Permissive | 1795 |
| Permissive (w/ attribution) | 616 |
| Weak copyleft | 21 |
| **Total** | **2432** |

## What each category means

- **Permissive** — MIT, BSD, ISC, 0BSD, Unlicense, CC0, Boost. Use freely; keep the upstream LICENSE text in the dep.
- **Permissive (w/ attribution)** — Apache-2.0, Artistic, CC-BY. Same as permissive, plus preserve any upstream NOTICE file.
- **Weak copyleft** — MPL-2.0, LGPL, EPL, CDDL. Modifications to the licensed files must stay under the same license, but using the library as a dep does not force this project to open-source.

## Weak-copyleft dependencies

Explicit list — all safe as unmodified library deps:

| Package | Version | Ecosystem | License |
|---|---|---|---|
| `github.com/go-sql-driver/mysql` | v1.9.3 | golang | MPL-2.0 |
| `github.com/hashicorp/errwrap` | v1.1.0 | golang | MPL-2.0 |
| `github.com/hashicorp/go-cleanhttp` | v0.5.2 | golang | MPL-2.0 |
| `github.com/hashicorp/go-multierror` | v1.1.1 | golang | MPL-2.0 |
| `github.com/hashicorp/go-version` | v1.9.0 | golang | MPL-2.0 |
| `@img/sharp-libvips-darwin-arm64` | 1.2.4 | npm | LGPL-3.0-or-later |
| `@img/sharp-libvips-darwin-x64` | 1.2.4 | npm | LGPL-3.0-or-later |
| `@img/sharp-libvips-linux-arm` | 1.2.4 | npm | LGPL-3.0-or-later |
| `@img/sharp-libvips-linux-arm64` | 1.2.4 | npm | LGPL-3.0-or-later |
| `@img/sharp-libvips-linux-ppc64` | 1.2.4 | npm | LGPL-3.0-or-later |
| `@img/sharp-libvips-linux-riscv64` | 1.2.4 | npm | LGPL-3.0-or-later |
| `@img/sharp-libvips-linux-s390x` | 1.2.4 | npm | LGPL-3.0-or-later |
| `@img/sharp-libvips-linux-x64` | 1.2.4 | npm | LGPL-3.0-or-later |
| `@img/sharp-libvips-linuxmusl-arm64` | 1.2.4 | npm | LGPL-3.0-or-later |
| `@img/sharp-libvips-linuxmusl-x64` | 1.2.4 | npm | LGPL-3.0-or-later |
| `@img/sharp-wasm32` | 0.34.5 | npm | Apache-2.0 AND LGPL-3.0-or-later AND MIT |
| `@img/sharp-win32-arm64` | 0.34.5 | npm | Apache-2.0 AND LGPL-3.0-or-later |
| `@img/sharp-win32-ia32` | 0.34.5 | npm | Apache-2.0 AND LGPL-3.0-or-later |
| `@img/sharp-win32-x64` | 0.34.5 | npm | Apache-2.0 AND LGPL-3.0-or-later |
| `axe-core` | 4.10.2 | npm | MPL-2.0 |
| `ip6addr` | 0.2.5 | npm | MPL-2.0 |