dependency-licenses.json

{
  "_comment": [
    "Dependencies whose license is not plainly permissive, read by a person",
    "and accepted for this app. utils/dependency_licenses.py (CI and the",
    "Claude Code hook) fails on any other such dependency. An entry covers",
    "the license it names: a package that changes its license is asked about",
    "again. Keys are package names as the ecosystem writes them (pip names",
    "normalized: lowercase, '-' for '_' and '.').",
    "App-owned: an app adds its own entries; the template sync keeps them."
  ],
  "accepted": {
    "certifi": {
      "license": "Mozilla Public License 2.0 (MPL 2.0)",
      "reason": "MPL-2.0 is file-level copyleft: it applies to certifi's own files, which ship unmodified as installed from PyPI; the app's code is not affected.",
      "attribution": "About dialog, Python packages (license text from the installed package)."
    },
    "streamlit-js-eval": {
      "license": "MIT",
      "reason": "PyPI metadata says UNKNOWN, but the wheel ships an MIT LICENSE file (Copyright (c) 2022-2024 Alireza Ghasemi).",
      "attribution": "About dialog, Python packages (the wheel's LICENSE file)."
    }
  }
}