# Third-party licences GoodWorkshop is licensed under Apache-2.0 with the Commons Clause (see LICENSE). It is distributed as a Docker image that contains other people's code, which carries its own terms. This file is the reviewable index: which packages, under which licence. It deliberately carries no version numbers, so that a dependency bump does not rewrite it -- versions are in the SBOM published with each release. The **notices themselves** -- the copyright lines and licence texts that MIT, BSD and Apache require to travel with the code -- ship inside the image at `/app/THIRD-PARTY-LICENSES.txt` and are attached to each GitHub release. The set below is pnpm's production dependency closure. That is deliberately wider than what the image actually carries: Next traces the server down to a few dozen packages, but code from other packages is *bundled into* the JavaScript that goes to the browser and into the collaboration server, and no cheap computation tells those apart. Attributing more than is strictly required is safe; attributing less is not. ## 0BSD Permissive, no attribution required. - [tslib](https://www.typescriptlang.org/) ## Apache-2.0 Permissive with a patent grant. The base licence of this project itself. - [@img/sharp-*](https://sharp.pixelplumbing.com) - [@playwright/test](https://playwright.dev) - [@swc/core](https://swc.rs) - [@swc/counter](https://swc.rs) - [@swc/helpers](https://swc.rs) - [@swc/types](https://swc.rs) - [baseline-browser-mapping](https://github.com/web-platform-dx/baseline-browser-mapping#readme) - [detect-libc](https://github.com/lovell/detect-libc#readme) - [drizzle-orm](https://orm.drizzle.team) - [playwright](https://playwright.dev) - [playwright-core](https://playwright.dev) - [reflect-metadata](http://rbuckton.github.io/reflect-metadata) - [sharp](https://sharp.pixelplumbing.com) - [uuidv7](https://github.com/LiosK/uuidv7#readme) ## Apache-2.0 AND MIT Both halves are allowed above. - [@swc/core-*](https://swc.rs) ## BSD-2-Clause Permissive. - [json-schema-typed](https://github.com/RemyRylan/json-schema-typed/tree/main/dist/node) ## BSD-3-Clause Permissive, plus a no-endorsement clause we do not violate. - [asn1js](https://github.com/PeculiarVentures/ASN1.js#readme) - [fast-uri](https://github.com/fastify/fast-uri) - [intl-messageformat](https://github.com/formatjs/formatjs) - [qs](https://github.com/ljharb/qs) - [source-map-js](https://github.com/7rulnik/source-map-js) ## CC-BY-4.0 Attribution required and nothing else -- usually data or documentation rather than code. The notice file carries the attribution. - [caniuse-lite](https://github.com/browserslist/caniuse-lite#readme) ## CC0-1.0 Public-domain dedication. - [fractional-indexing](https://github.com/rocicorp/fractional-indexing#readme) ## ISC Permissive, functionally MIT. - [electron-to-chromium](https://github.com/Kilian/electron-to-chromium#readme) - [inherits](https://github.com/isaacs/inherits#readme) - [isexe](https://github.com/isaacs/isexe#readme) - [lru-cache](https://github.com/isaacs/node-lru-cache#readme) - [lucide-react](https://lucide.dev) - [once](https://github.com/isaacs/once#readme) - [pg-int8](https://github.com/charmander/pg-int8#readme) - [picocolors](https://github.com/alexeyraspopov/picocolors#readme) - [semver](https://github.com/npm/node-semver#readme) - [setprototypeof](https://github.com/wesleytodd/setprototypeof) - [split2](https://github.com/mcollina/split2#readme) - [which](https://github.com/isaacs/node-which#readme) - [wrappy](https://github.com/npm/wrappy) - [yallist](https://github.com/isaacs/yallist#readme) - [zod-to-json-schema](https://github.com/StefanTerdell/zod-to-json-schema#readme) ## LGPL-3.0-or-later Library copyleft. Fine as a separately replaceable library -- sharp ships libvips as its own shared object. The Commons Clause restricts GoodWorkshop, not the library, and changes to the library itself would stay LGPL. - [@img/sharp-libvips-*](https://sharp.pixelplumbing.com) ## MIT Permissive. Requires the notice to travel with the code -- see --notices. - [@babel/code-frame](https://babel.dev/docs/en/next/babel-code-frame) - [@babel/compat-data](https://github.com/babel/babel#readme) - [@babel/core](https://babel.dev/docs/en/next/babel-core) - [@babel/generator](https://babel.dev/docs/en/next/babel-generator) - [@babel/helper-compilation-targets](https://github.com/babel/babel#readme) - [@babel/helper-globals](https://github.com/babel/babel#readme) - [@babel/helper-module-imports](https://babel.dev/docs/en/next/babel-helper-module-imports) - [@babel/helper-module-transforms](https://babel.dev/docs/en/next/babel-helper-module-transforms) - [@babel/helper-string-parser](https://babel.dev/docs/en/next/babel-helper-string-parser) - [@babel/helper-validator-identifier](https://github.com/babel/babel#readme) - [@babel/helper-validator-option](https://github.com/babel/babel#readme) - [@babel/helpers](https://babel.dev/docs/en/next/babel-helpers) - [@babel/parser](https://babel.dev/docs/en/next/babel-parser) - [@babel/template](https://babel.dev/docs/en/next/babel-template) - [@babel/traverse](https://babel.dev/docs/en/next/babel-traverse) - [@babel/types](https://babel.dev/docs/en/next/babel-types) - [@dnd-kit/accessibility](https://github.com/clauderic/dnd-kit#readme) - [@dnd-kit/core](https://github.com/clauderic/dnd-kit#readme) - [@dnd-kit/modifiers](https://github.com/clauderic/dnd-kit#readme) - [@dnd-kit/sortable](https://github.com/clauderic/dnd-kit#readme) - [@dnd-kit/utilities](https://github.com/clauderic/dnd-kit#readme) - [@eloqnt/config](https://cli.eloqnt.dev/docs/configuration) - [@eloqnt/format-json](https://cli.eloqnt.dev/docs/configuration) - [@eloqnt/format-po](https://cli.eloqnt.dev/docs/formats/po) - [@formatjs/fast-memoize](https://github.com/formatjs/formatjs#readme) - [@formatjs/icu-messageformat-parser](https://github.com/formatjs/formatjs#readme) - [@formatjs/icu-skeleton-parser](https://github.com/formatjs/formatjs#readme) - [@formatjs/intl-localematcher](https://github.com/formatjs/formatjs#readme) - [@hexagon/base64](https://base64.56k.guru) - [@hono/node-server](https://github.com/honojs/node-server) - [@img/colour](https://github.com/lovell/colour#readme) - [@jridgewell/gen-mapping](https://github.com/jridgewell/sourcemaps/tree/main/packages/gen-mapping) - [@jridgewell/remapping](https://github.com/jridgewell/sourcemaps/tree/main/packages/remapping) - [@jridgewell/resolve-uri](https://github.com/jridgewell/resolve-uri#readme) - [@jridgewell/sourcemap-codec](https://github.com/jridgewell/sourcemaps/tree/main/packages/sourcemap-codec) - [@jridgewell/trace-mapping](https://github.com/jridgewell/sourcemaps/tree/main/packages/trace-mapping) - [@levischuck/tiny-cbor](https://github.com/levischuck/tiny-cbor#readme) - [@modelcontextprotocol/sdk](https://modelcontextprotocol.io) - [@next/env](https://github.com/vercel/next.js#readme) - [@next/swc-*](https://github.com/vercel/next.js#readme) - [@parcel/watcher](https://github.com/parcel-bundler/watcher#readme) - [@parcel/watcher-*](https://github.com/parcel-bundler/watcher#readme) - [@peculiar/asn1-android](https://github.com/PeculiarVentures/asn1-schema/tree/master/packages/android#readme) - [@peculiar/asn1-asym-key](https://github.com/PeculiarVentures/asn1-schema/tree/master/packages/asym-key#readme) - [@peculiar/asn1-cms](https://github.com/PeculiarVentures/asn1-schema/tree/master/packages/cms#readme) - [@peculiar/asn1-csr](https://github.com/PeculiarVentures/asn1-schema/tree/master/packages/csr#readme) - [@peculiar/asn1-ecc](https://github.com/PeculiarVentures/asn1-schema/tree/master/packages/ecc#readme) - [@peculiar/asn1-pfx](https://github.com/PeculiarVentures/asn1-schema/tree/master/packages/pfx#readme) - [@peculiar/asn1-pkcs8](https://github.com/PeculiarVentures/asn1-schema/tree/master/packages/pkcs8#readme) - [@peculiar/asn1-pkcs9](https://github.com/PeculiarVentures/asn1-schema/tree/master/packages/pkcs9#readme) - [@peculiar/asn1-rsa](https://github.com/PeculiarVentures/asn1-schema/tree/master/packages/rsa#readme) - [@peculiar/asn1-schema](https://github.com/PeculiarVentures/asn1-schema/tree/master/packages/schema#readme) - [@peculiar/asn1-x509](https://github.com/PeculiarVentures/asn1-schema/tree/master/packages/x509#readme) - [@peculiar/asn1-x509-attr](https://github.com/PeculiarVentures/asn1-schema/tree/master/packages/x509-attr#readme) - [@peculiar/asn1-x509-post-quantum](https://github.com/PeculiarVentures/asn1-schema/tree/master/packages/x509-post-quantum#readme) - [@peculiar/utils](https://github.com/PeculiarVentures/pvtsutils#readme) - [@peculiar/x509](https://github.com/PeculiarVentures/x509#readme) - [@schummar/icu-type-parser](https://github.com/schummar/schummar-translate#readme) - [@simplewebauthn/browser](https://github.com/MasterKale/SimpleWebAuthn/tree/master/packages/browser#readme) - [@simplewebauthn/server](https://github.com/MasterKale/SimpleWebAuthn/tree/master/packages/server#readme) - [@types/node](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/master/types/node) - [@types/pg](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/master/types/pg) - [accepts](https://github.com/jshttp/accepts#readme) - [ajv](https://ajv.js.org) - [ajv-formats](https://github.com/ajv-validator/ajv-formats#readme) - [body-parser](https://github.com/expressjs/body-parser#readme) - [browserslist](https://github.com/browserslist/browserslist#readme) - [bytes](https://github.com/visionmedia/bytes.js#readme) - [call-bind-apply-helpers](https://github.com/ljharb/call-bind-apply-helpers#readme) - [call-bound](https://github.com/ljharb/call-bound#readme) - [client-only](https://reactjs.org/) - [clsx](https://github.com/lukeed/clsx#readme) - [content-disposition](https://github.com/jshttp/content-disposition#readme) - [content-type](https://github.com/jshttp/content-type#readme) - [convert-source-map](https://github.com/thlorenz/convert-source-map) - [cookie](https://github.com/jshttp/cookie#readme) - [cookie-signature](https://github.com/visionmedia/node-cookie-signature#readme) - [cors](https://github.com/expressjs/cors#readme) - [cross-spawn](https://github.com/moxystudio/node-cross-spawn) - [debug](https://github.com/debug-js/debug#readme) - [depd](https://github.com/dougwilson/nodejs-depd#readme) - [dunder-proto](https://github.com/es-shims/dunder-proto#readme) - [ee-first](https://github.com/jonathanong/ee-first#readme) - [encodeurl](https://github.com/pillarjs/encodeurl#readme) - [es-define-property](https://github.com/ljharb/es-define-property#readme) - [es-errors](https://github.com/ljharb/es-errors#readme) - [es-object-atoms](https://github.com/ljharb/es-object-atoms#readme) - [escalade](https://github.com/lukeed/escalade#readme) - [escape-html](https://github.com/component/escape-html#readme) - [etag](https://github.com/jshttp/etag#readme) - [eventsource](https://github.com/EventSource/eventsource#readme) - [eventsource-parser](https://github.com/rexxars/eventsource-parser#readme) - [express](https://expressjs.com/) - [express-rate-limit](https://github.com/express-rate-limit/express-rate-limit) - [fast-deep-equal](https://github.com/epoberezkin/fast-deep-equal#readme) - [finalhandler](https://github.com/pillarjs/finalhandler#readme) - [forwarded](https://github.com/jshttp/forwarded#readme) - [fresh](https://github.com/jshttp/fresh#readme) - [function-bind](https://github.com/Raynos/function-bind) - [gensync](https://github.com/loganfsmyth/gensync) - [get-intrinsic](https://github.com/ljharb/get-intrinsic#readme) - [get-proto](https://github.com/ljharb/get-proto#readme) - [gopd](https://github.com/ljharb/gopd#readme) - [has-symbols](https://github.com/ljharb/has-symbols#readme) - [hasown](https://github.com/inspect-js/hasOwn#readme) - [hono](https://hono.dev) - [http-errors](https://github.com/jshttp/http-errors#readme) - [iconv-lite](https://github.com/pillarjs/iconv-lite) - [icu-minify](https://next-intl.dev) - [ip-address](https://github.com/beaugunderson/ip-address#readme) - [ipaddr.js](https://github.com/whitequark/ipaddr.js#readme) - [is-extglob](https://github.com/jonschlinkert/is-extglob) - [is-glob](https://github.com/micromatch/is-glob) - [is-promise](https://github.com/then/is-promise#readme) - [isomorphic.js](https://github.com/dmonad/isomorphic.js#readme) - [jose](https://github.com/panva/jose) - [js-tokens](https://github.com/lydell/js-tokens#readme) - [jsesc](https://mths.be/jsesc) - [json-schema-traverse](https://github.com/epoberezkin/json-schema-traverse#readme) - [json5](http://json5.org/) - [lib0](https://github.com/dmonad/lib0#readme) - [math-intrinsics](https://github.com/es-shims/math-intrinsics#readme) - [media-typer](https://github.com/jshttp/media-typer#readme) - [merge-descriptors](https://github.com/sindresorhus/merge-descriptors#readme) - [mime-db](https://github.com/jshttp/mime-db#readme) - [mime-types](https://github.com/jshttp/mime-types#readme) - [ms](https://github.com/vercel/ms#readme) - [nanoid](https://github.com/ai/nanoid#readme) - [negotiator](https://github.com/jshttp/negotiator#readme) - [next](https://nextjs.org) - [next-intl](https://next-intl.dev) - [next-intl-swc-plugin-extractor](https://next-intl.dev) - [next-themes](https://github.com/pacocoursey/next-themes#readme) - [node-addon-api](https://github.com/nodejs/node-addon-api) - [node-releases](https://github.com/chicoxyzzy/node-releases#readme) - [object-assign](https://github.com/sindresorhus/object-assign#readme) - [object-inspect](https://github.com/inspect-js/object-inspect) - [on-finished](https://github.com/jshttp/on-finished#readme) - [parseurl](https://github.com/pillarjs/parseurl#readme) - [path-key](https://github.com/sindresorhus/path-key#readme) - [path-to-regexp](https://github.com/pillarjs/path-to-regexp#readme) - [pg](https://github.com/brianc/node-postgres) - [pg-cloudflare](https://github.com/brianc/node-postgres#readme) - [pg-connection-string](https://github.com/brianc/node-postgres/tree/master/packages/pg-connection-string) - [pg-pool](https://github.com/brianc/node-postgres/tree/master/packages/pg-pool#readme) - [pg-protocol](https://github.com/brianc/node-postgres#readme) - [pg-types](https://github.com/brianc/node-pg-types) - [pgpass](https://github.com/hoegaarden/pgpass#readme) - [picomatch](https://github.com/micromatch/picomatch) - [pkce-challenge](https://github.com/crouchcd/pkce-challenge#readme) - [po-parser](https://github.com/amannn/po-parser) - [postcss](https://postcss.org/) - [postgres-array](https://github.com/bendrucker/postgres-array#readme) - [postgres-bytea](https://github.com/bendrucker/postgres-bytea#readme) - [postgres-date](https://github.com/bendrucker/postgres-date#readme) - [postgres-interval](https://github.com/bendrucker/postgres-interval#readme) - [proxy-addr](https://github.com/jshttp/proxy-addr#readme) - [pvtsutils](https://github.com/PeculiarVentures/pvtsutils#readme) - [pvutils](https://github.com/PeculiarVentures/pvutils#readme) - [range-parser](https://github.com/jshttp/range-parser#readme) - [raw-body](https://github.com/stream-utils/raw-body#readme) - [react](https://react.dev/) - [react-dom](https://react.dev/) - [require-from-string](https://github.com/floatdrop/require-from-string#readme) - [router](https://github.com/pillarjs/router#readme) - [safer-buffer](https://github.com/ChALkeR/safer-buffer#readme) - [scheduler](https://react.dev/) - [send](https://github.com/pillarjs/send#readme) - [serve-static](https://github.com/expressjs/serve-static#readme) - [shebang-command](https://github.com/kevva/shebang-command#readme) - [shebang-regex](https://github.com/sindresorhus/shebang-regex#readme) - [side-channel](https://github.com/ljharb/side-channel#readme) - [side-channel-list](https://github.com/ljharb/side-channel-list#readme) - [side-channel-map](https://github.com/ljharb/side-channel-map#readme) - [side-channel-weakmap](https://github.com/ljharb/side-channel-weakmap#readme) - [statuses](https://github.com/jshttp/statuses#readme) - [styled-jsx](https://github.com/vercel/styled-jsx#readme) - [tailwind-merge](https://github.com/dcastil/tailwind-merge) - [toidentifier](https://github.com/component/toidentifier#readme) - [tsyringe](https://github.com/Microsoft/tsyringe#readme) - [type-is](https://github.com/jshttp/type-is#readme) - [undici-types](https://undici.nodejs.org) - [unpipe](https://github.com/stream-utils/unpipe#readme) - [update-browserslist-db](https://github.com/browserslist/update-db#readme) - [use-intl](https://next-intl.dev) - [vary](https://github.com/jshttp/vary#readme) - [ws](https://github.com/websockets/ws) - [xtend](https://github.com/Raynos/xtend) - [y-protocols](https://github.com/yjs/y-protocols#readme) - [yjs](https://docs.yjs.dev) - [zod](https://zod.dev) ## MIT-0 MIT without the attribution requirement. - [nodemailer](https://nodemailer.com/)