Dependency licence report (SPDX SBOMs)
Generated by tools/components/licence_report.py from the SPDX 2.3 SBOMs of release/sbom/ (Syft 1.55.0, tools/components/sbom.sh). Policy: ADR-0101. Do not edit by hand.
Summary per artefact
| Artefact | Packages | Allowed (permissive) | Internal | Under exception | Uncovered |
|---|---|---|---|---|---|
| control-plane | 122 | 114 | 1 | 7 | 0 |
| navin-manager-agent | 0 | 0 | 0 | 0 | 0 |
| navin-manager-server | 52 | 46 | 0 | 6 | 0 |
| navin-manager-ui | 174 | 173 | 1 | 0 | 0 |
| navin-rag-backend | 51 | 49 | 0 | 2 | 0 |
| navin-rag-web | 269 | 254 | 1 | 14 | 0 |
| portal | 295 | 280 | 1 | 14 | 0 |
| sdk-go | 3 | 3 | 0 | 0 | 0 |
| sdk-java | 22 | 21 | 1 | 0 | 0 |
| sdk-python | 56 | 53 | 0 | 3 | 0 |
| sdk-typescript | 11 | 8 | 3 | 0 | 0 |
| voice-agent | 79 | 74 | 1 | 4 | 0 |
Dependencies outside MIT/Apache-2.0 and outside the permissive list
| Package | Version | SPDX licence | Artefacts | Exception | Licence source |
|---|---|---|---|---|---|
| @img/sharp-libvips-darwin-arm64 | 1.3.4 | LGPL-3.0-or-later | navin-rag-web, portal | LEX-016 | SBOM |
| @img/sharp-libvips-darwin-x64 | 1.3.4 | LGPL-3.0-or-later | navin-rag-web, portal | LEX-016 | SBOM |
| @img/sharp-libvips-linux-arm | 1.3.4 | LGPL-3.0-or-later | navin-rag-web, portal | LEX-016 | SBOM |
| @img/sharp-libvips-linux-arm64 | 1.3.4 | LGPL-3.0-or-later | navin-rag-web, portal | LEX-016 | SBOM |
| @img/sharp-libvips-linux-ppc64 | 1.3.4 | LGPL-3.0-or-later | navin-rag-web, portal | LEX-016 | SBOM |
| @img/sharp-libvips-linux-riscv64 | 1.3.4 | LGPL-3.0-or-later | navin-rag-web, portal | LEX-016 | SBOM |
| @img/sharp-libvips-linux-s390x | 1.3.4 | LGPL-3.0-or-later | navin-rag-web, portal | LEX-016 | SBOM |
| @img/sharp-libvips-linux-x64 | 1.3.4 | LGPL-3.0-or-later | navin-rag-web, portal | LEX-016 | SBOM |
| @img/sharp-libvips-linuxmusl-arm64 | 1.3.4 | LGPL-3.0-or-later | navin-rag-web, portal | LEX-016 | SBOM |
| @img/sharp-libvips-linuxmusl-x64 | 1.3.4 | LGPL-3.0-or-later | navin-rag-web, portal | LEX-016 | SBOM |
| @img/sharp-wasm32 | 0.35.5 | (Apache-2.0 AND LGPL-3.0-or-later AND MIT) | navin-rag-web, portal | LEX-016 | SBOM |
| @img/sharp-win32-arm64 | 0.35.5 | (Apache-2.0 AND LGPL-3.0-or-later) | navin-rag-web, portal | LEX-016 | SBOM |
| @img/sharp-win32-ia32 | 0.35.5 | (Apache-2.0 AND LGPL-3.0-or-later) | navin-rag-web, portal | LEX-016 | SBOM |
| @img/sharp-win32-x64 | 0.35.5 | (Apache-2.0 AND LGPL-3.0-or-later) | navin-rag-web, portal | LEX-016 | SBOM |
| certifi | 2026.10.23 | MPL-2.0 | control-plane, navin-manager-server, navin-rag-backend, sdk-python, voice-agent | LEX-014 | SBOM |
| ffmpeg | 9.0.2 | LGPL-3.0-or-later AND GPL-2.0-or-later | voice-agent | LEX-030 | override: FFmpeg 9.0.2 libraries bundled in the av 19.0.2 wheel (av.libs): libavcodec reports 'LGPL version 3 or later' (--enable-version3), the bundled libx264 and libx265 are GPL-2.0-or-later |
| ldap3 | 2.9.1 | LGPL-3.0-only | navin-manager-server | LEX-015 | SBOM |
| livekit-local-inference | 0.2.7 | (Apache-2.0 AND LicenseRef-LiveKit-Model) | voice-agent | LEX-029 | SBOM |
| orjson | 3.13.0 | MPL-2.0 AND (Apache-2.0 OR MIT) | sdk-python | LEX-017 | SBOM |
| pathspec | 1.1.1 | MPL-2.0 | sdk-python | LEX-018 | override: dist-info classifier MPL 2.0 and LICENSE |
| pillow | 13.0.0 | MIT-CMU | voice-agent | LEX-031 | SBOM |
| postgresql | 16.2 | PostgreSQL | control-plane, navin-manager-server, navin-rag-backend | LEX-001 | override: PostgreSQL server binaries bundled by the test only package pgserver |
| psycopg | 3.3.6 | LGPL-3.0-only | control-plane, navin-manager-server | LEX-013 | SBOM |
| psycopg-binary | 3.3.6 | LGPL-3.0-only | control-plane, navin-manager-server | LEX-013 | SBOM |
| psycopg-pool | 3.3.3 | LGPL-3.0-only | control-plane, navin-manager-server | LEX-013 | SBOM |
| regex | 2026.9.29 | (Apache-2.0 AND CNRI-Python) | control-plane | LEX-021 | SBOM |
| tqdm | 4.70.1 | (MPL-2.0 AND MIT) | control-plane | LEX-017 | SBOM |
Permissive licences listed (other than MIT and Apache-2.0)
| Licence | Packages |
|---|---|
| 0BSD | numpy, tslib |
| BSD-2-Clause | entities, nest-asyncio, prometheus-client, pyasn1, pygments, wrapt, xxhash |
| BSD-3-Clause | @bufbuild/protobuf, @webgpu/types, asgiref, av, click, colorama, d3-ease, fast-uri, fastuuid, fsspec, golang.org/x/net, golang.org/x/text, highlight.js, hoist-non-react-statics, httpcore, httpcore2, httpx, httpx2, idna, ieee754, jinja2, jsonpatch, jsonpointer, markupsafe, networkx, numpy, protobuf, psutil, pycparser, python-dotenv, react-transition-group, source-map, source-map-js, spring-aop, spring-beans, spring-context, spring-core, spring-expression, spring-jcl, spring-web, spring-webmvc, starlette, uuid-utils, uvicorn, webrtc-adapter, websockets, zstandard |
| CC-BY-4.0 | caniuse-lite |
| CC0-1.0 | numpy |
| ISC | @ungap/structured-clone, anymatch, cliui, d3-array, d3-color, d3-format, d3-interpolate, d3-path, d3-scale, d3-shape, d3-time, d3-time-format, d3-timer, fastq, get-caller-file, glob-parent, hast-util-from-dom, internmap, isexe, lucide-react, picocolors, potpack, require-main-filename, semver, set-blocking, shellingham, victory-vendor, which, which-module, y18n, yaml, yargs-parser |
| MIT-0 | cffi |
| OFL-1.1 | @fontsource-variable/inter, @fontsource-variable/jetbrains-mono |
| PSF-2.0 | aiohappyeyeballs, greenlet, typing-extensions |
| Zlib | numpy |