Third-party licenses¶
This inventory lists every third-party package that ships in the Kebivo container image: the runtime Python dependencies resolved in uv.lock for Linux CPython, and the npm packages bundled into the admin UI from frontend/package-lock.json. Development and test tools are not shipped and are not listed. License identifiers come from the package metadata and are not legal advice.
Kebivo itself is licensed under Apache-2.0 (the LICENSE file in the repository root). The compatibility column is checked against Apache-2.0: permissive licenses are marked compatible, and an OR expression is compatible when one alternative is.
Packages flagged for review: 1.
Python runtime packages (46)¶
| Package | Version | License | Apache-2.0 |
|---|---|---|---|
| alembic | 1.16.1 | MIT | Compatible |
| annotated-doc | 0.0.5 | MIT | Compatible |
| annotated-types | 0.8.0 | MIT | Compatible |
| anyio | 4.15.1 | MIT | Compatible |
| argon2-cffi | 23.1.0 | MIT | Compatible |
| argon2-cffi-bindings | 26.1.0 | MIT | Compatible |
| attrs | 26.1.0 | MIT | Compatible |
| certifi | 2026.10.19 | MPL-2.0 | Review (weak copyleft) |
| cffi | 2.1.1 | MIT-0 | Compatible |
| click | 8.5.0 | BSD-3-Clause | Compatible |
| cryptography | 50.0.2 | Apache-2.0 OR BSD-3-Clause | Compatible |
| fastapi | 0.143.3 | MIT | Compatible |
| greenlet | 3.5.6 | MIT AND PSF-2.0 | Compatible |
| h11 | 0.16.0 | MIT | Compatible |
| httpcore | 1.0.9 | BSD-3-Clause | Compatible |
| httpcore2 | 2.13.1 | BSD-3-Clause | Compatible |
| httptools | 0.9.0 | MIT | Compatible |
| httpx | 0.28.1 | BSD-3-Clause | Compatible |
| httpx2 | 2.13.1 | BSD-3-Clause | Compatible |
| idna | 3.20 | BSD-3-Clause | Compatible |
| jsonschema | 4.26.0 | MIT | Compatible |
| jsonschema-specifications | 2025.9.1 | MIT | Compatible |
| mako | 1.4.3 | MIT | Compatible |
| markupsafe | 3.0.4 | BSD-3-Clause | Compatible |
| mcp | 2.3.0 | MIT | Compatible |
| mcp-types | 2.3.0 | MIT | Compatible |
| opentelemetry-api | 1.45.1 | Apache-2.0 | Compatible |
| pycparser | 3.11 | BSD-3-Clause | Compatible |
| pydantic | 2.14.1 | MIT | Compatible |
| pydantic-core | 2.50.1 | MIT | Compatible |
| pyjwt | 2.15.1 | MIT | Compatible |
| python-dotenv | 1.2.4 | BSD-3-Clause | Compatible |
| python-multipart | 0.0.32 | Apache-2.0 | Compatible |
| pyyaml | 6.0.3 | MIT | Compatible |
| referencing | 0.37.0 | MIT | Compatible |
| rpds-py | 2026.9.1 | MIT | Compatible |
| sqlalchemy | 2.0.41 | MIT | Compatible |
| sse-starlette | 3.0.3 | BSD-3-Clause | Compatible |
| starlette | 1.8.0 | BSD-3-Clause | Compatible |
| truststore | 0.10.5 | MIT | Compatible |
| typing-extensions | 4.16.0 | PSF-2.0 | Compatible |
| typing-inspection | 0.4.4 | MIT | Compatible |
| uvicorn | 0.34.2 | BSD-3-Clause | Compatible |
| uvloop | 0.23.0 | Apache-2.0 OR MIT | Compatible |
| watchfiles | 1.3.0 | MIT | Compatible |
| websockets | 17.2 | BSD-3-Clause | Compatible |
npm packages in the admin UI bundle (3)¶
| Package | Version | License | Apache-2.0 |
|---|---|---|---|
| react | 19.1.0 | MIT | Compatible |
| react-dom | 19.1.0 | MIT | Compatible |
| scheduler | 0.26.0 | MIT | Compatible |
Review notes¶
- certifi 2026.10.19 (MPL-2.0): File-level copyleft. Kebivo ships the files unmodified, which an Apache-2.0 distribution may include; keep the MPL notice and point to the upstream source. Modified MPL files would have to stay under MPL-2.0.
Other shipped components¶
| Component | License | Notes |
|---|---|---|
| Fonts | None bundled | The UI uses the operating system font stack (system-ui). |
Kebivo mark and favicon (frontend/public/) |
Project asset | Created for this project; covered by the project license (Apache-2.0). |
python:3.12-slim base image |
PSF-2.0 (Python) and Debian package licenses | Not inventoried here; inspect the image with an SBOM tool before redistribution. |
uv binary copied into the image |
MIT OR Apache-2.0 | Installs the locked dependencies at build time and remains in the image. |