Third-Party Licenses

PyneHub platform code is licensed under Apache-2.0. It also incorporates open-source dependencies, each under its own license. This file lists the direct runtime dependencies bundled with the platform, their versions, and their licenses.

How to (re)generate this list

This file was generated by reading the license / version fields from each dependency's installed package.json. Regenerate after any dependency change:

# Option A: quick, no extra tooling (reads installed node_modules metadata)
node -e '
  const fs=require("fs"),p=require("path");
  const pkg=JSON.parse(fs.readFileSync("package.json","utf8"));
  for (const [name] of Object.entries(pkg.dependencies).sort()) {
    let v="?",l="UNKNOWN";
    try { const m=JSON.parse(fs.readFileSync(p.join("node_modules",name,"package.json"),"utf8"));
      v=m.version; l=typeof m.license==="string"?m.license:(m.license&&m.license.type)||l; } catch(e){ l="NOT_INSTALLED"; }
    console.log(`| ${name} | ${v} | ${l} |`);
  }'

# Option B: dedicated tool for a fuller report (dev machine only)
npx license-checker --production --summary
# or
npx license-checker --production --csv --out THIRD_PARTY_LICENSES.csv

Instructions for maintainers:

1. Run one of the commands above from nextjs_space/.
2. Paste the generated rows into the table below (keep it alphabetical).
3. For the on-device client (pynehub.py) list any Python packages it requires at runtime (currently: Python 3 standard library + PyGObject / GTK4 / libadwaita, which are provided by the OS and licensed under LGPL-2.1+/GPL-compatible terms — confirm versions per distro).
4. Commit the updated file with the dependency change in the same PR/upload.

License summary (direct runtime dependencies)

Compatibility note: All detected licenses (MIT, Apache-2.0, ISC, BSD-2-Clause, BSD-3-Clause, Unlicense) are permissive and compatible with the Apache-2.0 license used by PyneHub. No copyleft (GPL/LGPL/AGPL/MPL) dependencies were detected among direct runtime dependencies. See "Conflicts" below.

Direct runtime dependencies

Note: Build-time-only devDependencies (TypeScript, ESLint, Prisma CLI, Tailwind, tsx, etc.) are not redistributed in the deployed artifact and are omitted here. Add them to a separate section if your compliance policy requires listing build tooling.

Conflicts

None detected at generation time. All direct runtime dependency licenses are permissive and compatible with Apache-2.0. If a future dependency introduces a copyleft or otherwise incompatible license, do not change the project license unilaterally — record it here, open a review item, and consult legal counsel per the remediation guidance in SECURITY_POLICY.md.