THIRD-PARTY-LICENSES.md

Rama main · réplica de lectura del repositorio original.

<!-- Generated by scripts/licenses.mjs -- do not edit by hand.
     Regenerate with `pnpm licenses:write` and commit the result. -->

# Third-party licences

GoodWorkshop is licensed under Apache-2.0 with the Commons Clause (see LICENSE).
It is distributed as a Docker image that contains other people's code, which
carries its own terms.

This file is the reviewable index: which packages, under which licence. It
deliberately carries no version numbers, so that a dependency bump does not
rewrite it -- versions are in the SBOM published with each release.

The **notices themselves** -- the copyright lines and licence texts that MIT,
BSD and Apache require to travel with the code -- ship inside the image at
`/app/THIRD-PARTY-LICENSES.txt` and are attached to each GitHub release.

The set below is pnpm's production dependency closure. That is deliberately
wider than what the image actually carries: Next traces the server down to a
few dozen packages, but code from other packages is *bundled into* the
JavaScript that goes to the browser and into the collaboration server, and no
cheap computation tells those apart. Attributing more than is strictly
required is safe; attributing less is not.

## 0BSD

Permissive, no attribution required.

- [tslib](https://www.typescriptlang.org/)

## Apache-2.0

Permissive with a patent grant. The base licence of this project itself.

- [@img/sharp-*](https://sharp.pixelplumbing.com)
- [@playwright/test](https://playwright.dev)
- [@swc/core](https://swc.rs)
- [@swc/counter](https://swc.rs)
- [@swc/helpers](https://swc.rs)
- [@swc/types](https://swc.rs)
- [baseline-browser-mapping](https://github.com/web-platform-dx/baseline-browser-mapping#readme)
- [detect-libc](https://github.com/lovell/detect-libc#readme)
- [drizzle-orm](https://orm.drizzle.team)
- [playwright](https://playwright.dev)
- [playwright-core](https://playwright.dev)
- [reflect-metadata](http://rbuckton.github.io/reflect-metadata)
- [sharp](https://sharp.pixelplumbing.com)
- [uuidv7](https://github.com/LiosK/uuidv7#readme)

## Apache-2.0 AND MIT

Both halves are allowed above.

- [@swc/core-*](https://swc.rs)

## BSD-2-Clause

Permissive.

- [json-schema-typed](https://github.com/RemyRylan/json-schema-typed/tree/main/dist/node)

## BSD-3-Clause

Permissive, plus a no-endorsement clause we do not violate.

- [asn1js](https://github.com/PeculiarVentures/ASN1.js#readme)
- [fast-uri](https://github.com/fastify/fast-uri)
- [intl-messageformat](https://github.com/formatjs/formatjs)
- [qs](https://github.com/ljharb/qs)
- [source-map-js](https://github.com/7rulnik/source-map-js)

## CC-BY-4.0

Attribution required and nothing else -- usually data or documentation rather than code. The notice file carries the attribution.

- [caniuse-lite](https://github.com/browserslist/caniuse-lite#readme)

## CC0-1.0

Public-domain dedication.

- [fractional-indexing](https://github.com/rocicorp/fractional-indexing#readme)

## ISC

Permissive, functionally MIT.

- [electron-to-chromium](https://github.com/Kilian/electron-to-chromium#readme)
- [inherits](https://github.com/isaacs/inherits#readme)
- [isexe](https://github.com/isaacs/isexe#readme)
- [lru-cache](https://github.com/isaacs/node-lru-cache#readme)
- [lucide-react](https://lucide.dev)
- [once](https://github.com/isaacs/once#readme)
- [pg-int8](https://github.com/charmander/pg-int8#readme)
- [picocolors](https://github.com/alexeyraspopov/picocolors#readme)
- [semver](https://github.com/npm/node-semver#readme)
- [setprototypeof](https://github.com/wesleytodd/setprototypeof)
- [split2](https://github.com/mcollina/split2#readme)
- [which](https://github.com/isaacs/node-which#readme)
- [wrappy](https://github.com/npm/wrappy)
- [yallist](https://github.com/isaacs/yallist#readme)
- [zod-to-json-schema](https://github.com/StefanTerdell/zod-to-json-schema#readme)

## LGPL-3.0-or-later

Library copyleft. Fine as a separately replaceable library -- sharp ships libvips as its own shared object. The Commons Clause restricts GoodWorkshop, not the library, and changes to the library itself would stay LGPL.

- [@img/sharp-libvips-*](https://sharp.pixelplumbing.com)

## MIT

Permissive. Requires the notice to travel with the code -- see --notices.

- [@babel/code-frame](https://babel.dev/docs/en/next/babel-code-frame)
- [@babel/compat-data](https://github.com/babel/babel#readme)
- [@babel/core](https://babel.dev/docs/en/next/babel-core)
- [@babel/generator](https://babel.dev/docs/en/next/babel-generator)
- [@babel/helper-compilation-targets](https://github.com/babel/babel#readme)
- [@babel/helper-globals](https://github.com/babel/babel#readme)
- [@babel/helper-module-imports](https://babel.dev/docs/en/next/babel-helper-module-imports)
- [@babel/helper-module-transforms](https://babel.dev/docs/en/next/babel-helper-module-transforms)
- [@babel/helper-string-parser](https://babel.dev/docs/en/next/babel-helper-string-parser)
- [@babel/helper-validator-identifier](https://github.com/babel/babel#readme)
- [@babel/helper-validator-option](https://github.com/babel/babel#readme)
- [@babel/helpers](https://babel.dev/docs/en/next/babel-helpers)
- [@babel/parser](https://babel.dev/docs/en/next/babel-parser)
- [@babel/template](https://babel.dev/docs/en/next/babel-template)
- [@babel/traverse](https://babel.dev/docs/en/next/babel-traverse)
- [@babel/types](https://babel.dev/docs/en/next/babel-types)
- [@dnd-kit/accessibility](https://github.com/clauderic/dnd-kit#readme)
- [@dnd-kit/core](https://github.com/clauderic/dnd-kit#readme)
- [@dnd-kit/modifiers](https://github.com/clauderic/dnd-kit#readme)
- [@dnd-kit/sortable](https://github.com/clauderic/dnd-kit#readme)
- [@dnd-kit/utilities](https://github.com/clauderic/dnd-kit#readme)
- [@eloqnt/config](https://cli.eloqnt.dev/docs/configuration)
- [@eloqnt/format-json](https://cli.eloqnt.dev/docs/configuration)
- [@eloqnt/format-po](https://cli.eloqnt.dev/docs/formats/po)
- [@formatjs/fast-memoize](https://github.com/formatjs/formatjs#readme)
- [@formatjs/icu-messageformat-parser](https://github.com/formatjs/formatjs#readme)
- [@formatjs/icu-skeleton-parser](https://github.com/formatjs/formatjs#readme)
- [@formatjs/intl-localematcher](https://github.com/formatjs/formatjs#readme)
- [@hexagon/base64](https://base64.56k.guru)
- [@hono/node-server](https://github.com/honojs/node-server)
- [@img/colour](https://github.com/lovell/colour#readme)
- [@jridgewell/gen-mapping](https://github.com/jridgewell/sourcemaps/tree/main/packages/gen-mapping)
- [@jridgewell/remapping](https://github.com/jridgewell/sourcemaps/tree/main/packages/remapping)
- [@jridgewell/resolve-uri](https://github.com/jridgewell/resolve-uri#readme)
- [@jridgewell/sourcemap-codec](https://github.com/jridgewell/sourcemaps/tree/main/packages/sourcemap-codec)
- [@jridgewell/trace-mapping](https://github.com/jridgewell/sourcemaps/tree/main/packages/trace-mapping)
- [@levischuck/tiny-cbor](https://github.com/levischuck/tiny-cbor#readme)
- [@modelcontextprotocol/sdk](https://modelcontextprotocol.io)
- [@next/env](https://github.com/vercel/next.js#readme)
- [@next/swc-*](https://github.com/vercel/next.js#readme)
- [@parcel/watcher](https://github.com/parcel-bundler/watcher#readme)
- [@parcel/watcher-*](https://github.com/parcel-bundler/watcher#readme)
- [@peculiar/asn1-android](https://github.com/PeculiarVentures/asn1-schema/tree/master/packages/android#readme)
- [@peculiar/asn1-asym-key](https://github.com/PeculiarVentures/asn1-schema/tree/master/packages/asym-key#readme)
- [@peculiar/asn1-cms](https://github.com/PeculiarVentures/asn1-schema/tree/master/packages/cms#readme)
- [@peculiar/asn1-csr](https://github.com/PeculiarVentures/asn1-schema/tree/master/packages/csr#readme)
- [@peculiar/asn1-ecc](https://github.com/PeculiarVentures/asn1-schema/tree/master/packages/ecc#readme)
- [@peculiar/asn1-pfx](https://github.com/PeculiarVentures/asn1-schema/tree/master/packages/pfx#readme)
- [@peculiar/asn1-pkcs8](https://github.com/PeculiarVentures/asn1-schema/tree/master/packages/pkcs8#readme)
- [@peculiar/asn1-pkcs9](https://github.com/PeculiarVentures/asn1-schema/tree/master/packages/pkcs9#readme)
- [@peculiar/asn1-rsa](https://github.com/PeculiarVentures/asn1-schema/tree/master/packages/rsa#readme)
- [@peculiar/asn1-schema](https://github.com/PeculiarVentures/asn1-schema/tree/master/packages/schema#readme)
- [@peculiar/asn1-x509](https://github.com/PeculiarVentures/asn1-schema/tree/master/packages/x509#readme)
- [@peculiar/asn1-x509-attr](https://github.com/PeculiarVentures/asn1-schema/tree/master/packages/x509-attr#readme)
- [@peculiar/asn1-x509-post-quantum](https://github.com/PeculiarVentures/asn1-schema/tree/master/packages/x509-post-quantum#readme)
- [@peculiar/utils](https://github.com/PeculiarVentures/pvtsutils#readme)
- [@peculiar/x509](https://github.com/PeculiarVentures/x509#readme)
- [@schummar/icu-type-parser](https://github.com/schummar/schummar-translate#readme)
- [@simplewebauthn/browser](https://github.com/MasterKale/SimpleWebAuthn/tree/master/packages/browser#readme)
- [@simplewebauthn/server](https://github.com/MasterKale/SimpleWebAuthn/tree/master/packages/server#readme)
- [@types/node](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/master/types/node)
- [@types/pg](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/master/types/pg)
- [accepts](https://github.com/jshttp/accepts#readme)
- [ajv](https://ajv.js.org)
- [ajv-formats](https://github.com/ajv-validator/ajv-formats#readme)
- [body-parser](https://github.com/expressjs/body-parser#readme)
- [browserslist](https://github.com/browserslist/browserslist#readme)
- [bytes](https://github.com/visionmedia/bytes.js#readme)
- [call-bind-apply-helpers](https://github.com/ljharb/call-bind-apply-helpers#readme)
- [call-bound](https://github.com/ljharb/call-bound#readme)
- [client-only](https://reactjs.org/)
- [clsx](https://github.com/lukeed/clsx#readme)
- [content-disposition](https://github.com/jshttp/content-disposition#readme)
- [content-type](https://github.com/jshttp/content-type#readme)
- [convert-source-map](https://github.com/thlorenz/convert-source-map)
- [cookie](https://github.com/jshttp/cookie#readme)
- [cookie-signature](https://github.com/visionmedia/node-cookie-signature#readme)
- [cors](https://github.com/expressjs/cors#readme)
- [cross-spawn](https://github.com/moxystudio/node-cross-spawn)
- [debug](https://github.com/debug-js/debug#readme)
- [depd](https://github.com/dougwilson/nodejs-depd#readme)
- [dunder-proto](https://github.com/es-shims/dunder-proto#readme)
- [ee-first](https://github.com/jonathanong/ee-first#readme)
- [encodeurl](https://github.com/pillarjs/encodeurl#readme)
- [es-define-property](https://github.com/ljharb/es-define-property#readme)
- [es-errors](https://github.com/ljharb/es-errors#readme)
- [es-object-atoms](https://github.com/ljharb/es-object-atoms#readme)
- [escalade](https://github.com/lukeed/escalade#readme)
- [escape-html](https://github.com/component/escape-html#readme)
- [etag](https://github.com/jshttp/etag#readme)
- [eventsource](https://github.com/EventSource/eventsource#readme)
- [eventsource-parser](https://github.com/rexxars/eventsource-parser#readme)
- [express](https://expressjs.com/)
- [express-rate-limit](https://github.com/express-rate-limit/express-rate-limit)
- [fast-deep-equal](https://github.com/epoberezkin/fast-deep-equal#readme)
- [finalhandler](https://github.com/pillarjs/finalhandler#readme)
- [forwarded](https://github.com/jshttp/forwarded#readme)
- [fresh](https://github.com/jshttp/fresh#readme)
- [function-bind](https://github.com/Raynos/function-bind)
- [gensync](https://github.com/loganfsmyth/gensync)
- [get-intrinsic](https://github.com/ljharb/get-intrinsic#readme)
- [get-proto](https://github.com/ljharb/get-proto#readme)
- [gopd](https://github.com/ljharb/gopd#readme)
- [has-symbols](https://github.com/ljharb/has-symbols#readme)
- [hasown](https://github.com/inspect-js/hasOwn#readme)
- [hono](https://hono.dev)
- [http-errors](https://github.com/jshttp/http-errors#readme)
- [iconv-lite](https://github.com/pillarjs/iconv-lite)
- [icu-minify](https://next-intl.dev)
- [ip-address](https://github.com/beaugunderson/ip-address#readme)
- [ipaddr.js](https://github.com/whitequark/ipaddr.js#readme)
- [is-extglob](https://github.com/jonschlinkert/is-extglob)
- [is-glob](https://github.com/micromatch/is-glob)
- [is-promise](https://github.com/then/is-promise#readme)
- [isomorphic.js](https://github.com/dmonad/isomorphic.js#readme)
- [jose](https://github.com/panva/jose)
- [js-tokens](https://github.com/lydell/js-tokens#readme)
- [jsesc](https://mths.be/jsesc)
- [json-schema-traverse](https://github.com/epoberezkin/json-schema-traverse#readme)
- [json5](http://json5.org/)
- [lib0](https://github.com/dmonad/lib0#readme)
- [math-intrinsics](https://github.com/es-shims/math-intrinsics#readme)
- [media-typer](https://github.com/jshttp/media-typer#readme)
- [merge-descriptors](https://github.com/sindresorhus/merge-descriptors#readme)
- [mime-db](https://github.com/jshttp/mime-db#readme)
- [mime-types](https://github.com/jshttp/mime-types#readme)
- [ms](https://github.com/vercel/ms#readme)
- [nanoid](https://github.com/ai/nanoid#readme)
- [negotiator](https://github.com/jshttp/negotiator#readme)
- [next](https://nextjs.org)
- [next-intl](https://next-intl.dev)
- [next-intl-swc-plugin-extractor](https://next-intl.dev)
- [next-themes](https://github.com/pacocoursey/next-themes#readme)
- [node-addon-api](https://github.com/nodejs/node-addon-api)
- [node-releases](https://github.com/chicoxyzzy/node-releases#readme)
- [object-assign](https://github.com/sindresorhus/object-assign#readme)
- [object-inspect](https://github.com/inspect-js/object-inspect)
- [on-finished](https://github.com/jshttp/on-finished#readme)
- [parseurl](https://github.com/pillarjs/parseurl#readme)
- [path-key](https://github.com/sindresorhus/path-key#readme)
- [path-to-regexp](https://github.com/pillarjs/path-to-regexp#readme)
- [pg](https://github.com/brianc/node-postgres)
- [pg-cloudflare](https://github.com/brianc/node-postgres#readme)
- [pg-connection-string](https://github.com/brianc/node-postgres/tree/master/packages/pg-connection-string)
- [pg-pool](https://github.com/brianc/node-postgres/tree/master/packages/pg-pool#readme)
- [pg-protocol](https://github.com/brianc/node-postgres#readme)
- [pg-types](https://github.com/brianc/node-pg-types)
- [pgpass](https://github.com/hoegaarden/pgpass#readme)
- [picomatch](https://github.com/micromatch/picomatch)
- [pkce-challenge](https://github.com/crouchcd/pkce-challenge#readme)
- [po-parser](https://github.com/amannn/po-parser)
- [postcss](https://postcss.org/)
- [postgres-array](https://github.com/bendrucker/postgres-array#readme)
- [postgres-bytea](https://github.com/bendrucker/postgres-bytea#readme)
- [postgres-date](https://github.com/bendrucker/postgres-date#readme)
- [postgres-interval](https://github.com/bendrucker/postgres-interval#readme)
- [proxy-addr](https://github.com/jshttp/proxy-addr#readme)
- [pvtsutils](https://github.com/PeculiarVentures/pvtsutils#readme)
- [pvutils](https://github.com/PeculiarVentures/pvutils#readme)
- [range-parser](https://github.com/jshttp/range-parser#readme)
- [raw-body](https://github.com/stream-utils/raw-body#readme)
- [react](https://react.dev/)
- [react-dom](https://react.dev/)
- [require-from-string](https://github.com/floatdrop/require-from-string#readme)
- [router](https://github.com/pillarjs/router#readme)
- [safer-buffer](https://github.com/ChALkeR/safer-buffer#readme)
- [scheduler](https://react.dev/)
- [send](https://github.com/pillarjs/send#readme)
- [serve-static](https://github.com/expressjs/serve-static#readme)
- [shebang-command](https://github.com/kevva/shebang-command#readme)
- [shebang-regex](https://github.com/sindresorhus/shebang-regex#readme)
- [side-channel](https://github.com/ljharb/side-channel#readme)
- [side-channel-list](https://github.com/ljharb/side-channel-list#readme)
- [side-channel-map](https://github.com/ljharb/side-channel-map#readme)
- [side-channel-weakmap](https://github.com/ljharb/side-channel-weakmap#readme)
- [statuses](https://github.com/jshttp/statuses#readme)
- [styled-jsx](https://github.com/vercel/styled-jsx#readme)
- [tailwind-merge](https://github.com/dcastil/tailwind-merge)
- [toidentifier](https://github.com/component/toidentifier#readme)
- [tsyringe](https://github.com/Microsoft/tsyringe#readme)
- [type-is](https://github.com/jshttp/type-is#readme)
- [undici-types](https://undici.nodejs.org)
- [unpipe](https://github.com/stream-utils/unpipe#readme)
- [update-browserslist-db](https://github.com/browserslist/update-db#readme)
- [use-intl](https://next-intl.dev)
- [vary](https://github.com/jshttp/vary#readme)
- [ws](https://github.com/websockets/ws)
- [xtend](https://github.com/Raynos/xtend)
- [y-protocols](https://github.com/yjs/y-protocols#readme)
- [yjs](https://docs.yjs.dev)
- [zod](https://zod.dev)

## MIT-0

MIT without the attribution requirement.

- [nodemailer](https://nodemailer.com/)