Appearance
Third-party notices
Generated by tools/generate_notices.py from the actual dependency tree. Do not edit by hand - CI regenerates this file and fails if it differs from what the lockfiles produce.
MyDLP incorporates the open-source components listed below. None of these licences is obligation-free: every permissive licence here requires at minimum that its copyright and licence text travel with any redistribution. The full licence texts are reproduced in licenses/ in the distribution archive and are available in each project's repository.
Components: 318 Rust crates, 56 dashboard packages.
See Open-source inventory for the assessment of each major component and Licence policy for the rules CI enforces.
Rust components (server and endpoint agent)
Statically linked into the distributed binaries.
MIT OR Apache-2.0
Obligation. Retain the copyright notice and the permission notice.
179 component(s)
- aes v0.8.4
- ahash v0.8.12
- allocator-api2 v0.2.21
- anstream v1.0.0
- anstyle v1.0.14
- anstyle-parse v1.0.0
- anstyle-query v1.1.5
- anyhow v1.0.104
- argon2 v0.5.3
- arrayvec v0.7.8
- asn1-rs v0.6.2
- asn1-rs v0.7.2
- asn1-rs-derive v0.5.1 (proc-macro)
- asn1-rs-derive v0.6.0 (proc-macro)
- asn1-rs-impl v0.2.0 (proc-macro)
- async-compression v0.4.47
- async-trait v0.1.92 (proc-macro)
- base64 v0.22.1
- bitflags v2.13.2
- blake2 v0.10.6
- block-buffer v0.10.4
- block-buffer v0.12.1
- bumpalo v3.20.3
- bzip2-rs v0.1.2
- cfg-if v1.0.4
- chrono v0.4.45
- chrono-tz v0.10.4
- cipher v0.4.4
- clap v4.6.7
- clap_builder v4.6.7
- clap_derive v4.6.7 (proc-macro)
- clap_lex v1.1.1
- colorchoice v1.0.5
- compression-codecs v0.4.42
- compression-core v0.4.33
- cookie v0.18.2
- core_detect v1.0.0
- cpufeatures v0.2.17
- cpufeatures v0.3.1
- crc v3.4.0
- crc-catalog v2.5.0
- crc32fast v1.5.2
- crossbeam-queue v0.3.14
- crossbeam-utils v0.8.23
- crypto-common v0.1.7
- crypto-common v0.2.2
- curve25519-dalek-derive v0.1.1 (proc-macro)
- der-parser v10.0.0
- der-parser v9.0.0
- deranged v0.5.8
- digest v0.10.7
- digest v0.11.3
- displaydoc v0.2.7 (proc-macro)
- dyn-clone v1.0.20
- either v1.18.0
- errno v0.3.14
- fallible-iterator v0.3.0
- fallible-streaming-iterator v0.1.9
- flate2 v1.1.10
- form_urlencoded v1.2.2
- futures v0.3.34
- futures-channel v0.3.34
- futures-core v0.3.34
- futures-executor v0.3.34
- futures-intrusive v0.5.0
- futures-io v0.3.34
- futures-macro v0.3.34 (proc-macro)
- futures-sink v0.3.34
- futures-task v0.3.34
- futures-util v0.3.34
- getrandom v0.2.17
- getrandom v0.4.3
- hashbrown v0.14.5
- hashbrown v0.15.5
- hashbrown v0.17.1
- hashlink v0.10.0
- hashlink v0.9.1
- heck v0.5.0
- hex v0.4.3
- hkdf v0.12.4
- hmac v0.12.1
- home v0.5.12
- http v1.5.0
- httparse v1.10.1
- httpdate v1.0.3
- hybrid-array v0.4.15
- iana-time-zone v0.1.65
- idna v1.1.0
- inout v0.1.4
- ipnet v2.12.2
- is_terminal_polyfill v1.70.2
- itoa v1.0.18
- lazy_static v1.5.0
- ldap3 v0.12.1
- libc v0.2.189
- lock_api v0.4.14
- log v0.4.34
- lzxd v0.2.7
- md-5 v0.10.6
- mime v0.3.17
- minimal-lexical v0.2.1
- multiversion v0.9.0
- multiversion-macros v0.9.0 (proc-macro)
- notify-types v2.1.0
- num-bigint v0.4.8
- num-conv v0.2.2
- num-integer v0.1.47
- num-traits v0.2.19
- oid-registry v0.7.1
- oid-registry v0.8.1
- once_cell v1.21.4
- openssl-probe v0.2.1
- parking_lot v0.12.5
- parking_lot_core v0.9.12
- password-hash v0.5.0
- percent-encoding v2.3.2
- powerfmt v0.2.0
- ppv-lite86 v0.2.21
- proc-macro2 v1.0.107
- quote v1.0.47
- rand v0.8.8
- rand_chacha v0.3.1
- rand_core v0.6.4
- rcgen v0.13.2
- regex v1.13.1
- regex-automata v0.4.18
- regex-syntax v0.8.11
- reqwest v0.12.28
- rusticata-macros v4.1.0
- rustls-pki-types v1.15.1
- rustversion v1.0.23 (proc-macro)
- scopeguard v1.2.0
- serde v1.0.229
- serde_core v1.0.229
- serde_derive v1.0.229 (proc-macro)
- serde_derive_internals v0.29.1
- serde_json v1.0.151
- serde_path_to_error v0.1.20
- serde_spanned v0.6.9
- serde_urlencoded v0.7.1
- sha1 v0.10.7
- sha2 v0.10.9
- sha2 v0.11.0
- signal-hook-registry v1.4.8
- simdutf8 v0.1.5
- siphasher v1.0.3
- smallvec v1.16.1
- socket2 v0.6.5
- sqlx v0.8.6
- sqlx-core v0.8.6
- sqlx-macros v0.8.6 (proc-macro)
- sqlx-macros-core v0.8.6
- sqlx-postgres v0.8.6
- stable_deref_trait v1.2.1
- stringprep v0.1.5
- syn v2.0.119
- syn v3.0.5
- thiserror v1.0.69
- thiserror v2.0.20
- thiserror-impl v1.0.69 (proc-macro)
- thiserror-impl v2.0.20 (proc-macro)
- thread_local v1.1.10
- time v0.3.55
- time-core v0.1.9
- time-macros v0.2.32 (proc-macro)
- tokio-rustls v0.26.5
- toml v0.8.23
- toml_datetime v0.6.11
- toml_edit v0.22.27
- toml_write v0.1.2
- typed-path v0.12.3
- typenum v1.20.1
- unicode-bidi v0.3.18
- unicode-normalization v0.1.25
- unicode-properties v0.1.4
- url v2.5.8
- x509-parser v0.16.0
- x509-parser v0.18.1
- yasna v0.5.2
MIT
Obligation. Retain the copyright notice and the permission notice.
55 component(s)
- atoi v2.0.0
- axum v0.8.9
- axum-core v0.5.6
- axum-extra v0.10.3
- axum-macros v0.5.1 (proc-macro)
- bytes v1.12.1
- cfb v0.7.3
- data-encoding v2.11.1
- dotenvy v0.15.7
- generic-array v0.14.7
- headers v0.4.1
- headers-core v0.3.0
- http-body v1.1.0
- http-body-util v0.1.5
- hyper v1.11.1
- hyper-util v0.1.20
- infer v0.19.0
- lber v0.5.1
- libsqlite3-sys v0.30.1
- matchers v0.2.0
- mio v1.2.3
- nom v7.1.3
- nu-ansi-term v0.50.3
- pem v3.0.6
- phf v0.12.1
- phf_shared v0.12.1
- rusqlite v0.32.1
- ruzstd v0.9.1
- schemars v0.8.22
- schemars_derive v0.8.22 (proc-macro)
- sharded-slab v0.1.7
- simd-adler32 v0.3.10
- slab v0.4.12
- strsim v0.11.1
- synstructure v0.13.2
- sysinfo v0.34.2
- tokio v1.53.1
- tokio-macros v2.7.2 (proc-macro)
- tokio-stream v0.1.19
- tokio-util v0.7.19
- tower v0.5.3
- tower-http v0.6.11
- tower-layer v0.3.3
- tower-service v0.3.3
- tracing v0.1.44
- tracing-attributes v0.1.31 (proc-macro)
- tracing-core v0.1.36
- tracing-log v0.2.0
- tracing-serde v0.2.0
- tracing-subscriber v0.3.23
- try-lock v0.2.5
- want v0.3.1
- winnow v0.7.15
- zip v8.6.0
- zmij v1.0.23
Apache-2.0 OR MIT
Obligation. Retain the copyright notice and the permission notice.
24 component(s)
- atomic-waker v1.1.2
- base64ct v1.8.3
- chardetng v1.0.0
- const-oid v0.10.2
- const-oid v0.9.6
- der v0.7.10
- ed25519 v2.2.3
- equivalent v1.0.2
- event-listener v5.4.2
- fnv v1.0.7
- idna_adapter v1.2.2
- indexmap v2.14.2
- multiversion_no_op v1.0.0 (proc-macro)
- parking v2.2.1
- pem-rfc7468 v0.7.0
- pin-project-lite v0.2.17
- pkcs8 v0.10.2
- secrecy v0.10.3
- signature v2.2.0
- spki v0.7.3
- utf8_iter v1.0.4
- utf8parse v0.2.2
- uuid v1.26.1
- zeroize v1.9.0
Unicode-3.0
Obligation. Retain the Unicode data licence notice.
18 component(s)
- icu_collections v2.3.0
- icu_locale_core v2.3.0
- icu_normalizer v2.3.0
- icu_normalizer_data v2.3.0
- icu_properties v2.3.0
- icu_properties_data v2.3.0
- icu_provider v2.3.1
- litemap v0.8.3
- potential_utf v0.1.6
- tinystr v0.8.4
- writeable v0.6.4
- yoke v0.8.3
- yoke-derive v0.8.2 (proc-macro)
- zerofrom v0.1.8
- zerofrom-derive v0.1.7 (proc-macro)
- zerotrie v0.2.5
- zerovec v0.11.8
- zerovec-derive v0.11.6 (proc-macro)
Unlicense OR MIT
Obligation. Retain the copyright notice and the permission notice.
7 component(s)
- aho-corasick v1.1.5
- byteorder v1.5.0
- csv v1.4.0
- csv-core v0.1.13
- memchr v2.8.3
- same-file v1.0.6
- walkdir v2.5.0
Apache-2.0
Obligation. Retain the licence, any NOTICE content, and state changes if modified.
6 component(s)
- cryptoki v0.12.1
- cryptoki-sys v0.5.0
- lzma-rust2 v0.21.0
- sevenz-rust2 v0.23.0
- sync_wrapper v1.0.2
- zopfli v0.8.3
ISC
Obligation. Retain the copyright notice and permission notice.
5 component(s)
- inotify v0.11.5
- inotify-sys v0.1.8
- libloading v0.8.9
- rustls-webpki v0.103.15
- untrusted v0.9.0
BSD-3-Clause
Obligation. Retain the copyright, conditions and disclaimer. Do not use contributor names to endorse this product.
4 component(s)
- curve25519-dalek v4.1.3
- deunicode v1.6.2
- ed25519-dalek v2.2.0
- subtle v2.6.1
Apache-2.0 OR ISC OR MIT
Obligation. Retain the copyright notice and the permission notice.
3 component(s)
- hyper-rustls v0.27.9
- rustls v0.23.45
- rustls-native-certs v0.8.3
CDLA-Permissive-2.0
Obligation. Retain the notice. This is a dataset, not code.
2 component(s)
- webpki-roots v0.26.11
- webpki-roots v1.0.9
Zlib
Obligation. Retain the notice; do not misrepresent the origin.
2 component(s)
- foldhash v0.1.5
- zlib-rs v0.6.7
(Apache-2.0 OR MIT) AND BSD-3-Clause
Obligation. Retain the copyright notice and the permission notice.
1 component(s)
- encoding_rs v0.8.41
(MIT OR Apache-2.0) AND Unicode-3.0
Obligation. Retain the copyright notice and the permission notice.
1 component(s)
- unicode-ident v1.0.24
0BSD OR MIT OR Apache-2.0
Obligation. Retain the copyright notice and the permission notice.
1 component(s)
- adler2 v2.0.1
Apache-2.0 AND ISC
Obligation. Retain the licence, any NOTICE content, and state changes if modified.
1 component(s)
- ring v0.17.14
Apache-2.0 OR BSL-1.0
Obligation. Retain the licence, any NOTICE content, and state changes if modified.
1 component(s)
- ryu v1.0.23
Apache-2.0 OR BSL-1.0 OR MIT
Obligation. Retain the copyright notice and the permission notice.
1 component(s)
- whoami v1.6.1
BSD-2-Clause OR Apache-2.0 OR MIT
Obligation. Retain the copyright notice and the permission notice.
1 component(s)
- zerocopy v0.8.57
CC0-1.0
Obligation. No attribution required. Note: CC0 explicitly does not grant patent rights.
1 component(s)
- notify v8.2.0
CC0-1.0 OR Apache-2.0 OR Apache-2.0 WITH LLVM-exception
Obligation. Retain the licence, any NOTICE content, and state changes if modified.
1 component(s)
- blake3 v1.8.7
CC0-1.0 OR MIT-0 OR Apache-2.0
Obligation. Retain the copyright notice and the permission notice.
1 component(s)
- constant_time_eq v0.4.2
MIT AND BSD-3-Clause
Obligation. Retain the copyright notice and the permission notice.
1 component(s)
- matchit v0.8.4
MIT OR Zlib OR Apache-2.0
Obligation. Retain the copyright notice and the permission notice.
1 component(s)
- miniz_oxide v0.9.1
Zlib OR Apache-2.0 OR MIT
Obligation. Retain the copyright notice and the permission notice.
1 component(s)
- tinyvec v1.13.3
Dashboard components
Bundled into the distributed static assets.
MIT
Obligation. Retain the copyright notice and the permission notice.
40 component(s)
- @babel/runtime@7.29.7
- @radix-ui/colors@3.0.0
- @remix-run/router@1.23.0
- @tanstack/query-core@5.66.0
- @tanstack/react-query@5.66.0
- @tanstack/react-table@8.21.2
- @tanstack/table-core@8.21.2
- @types/d3-array@3.2.2
- @types/d3-color@3.1.3
- @types/d3-ease@3.0.2
- @types/d3-interpolate@3.0.4
- @types/d3-path@3.1.1
- @types/d3-scale@4.0.9
- @types/d3-shape@3.2.0
- @types/d3-time@3.0.4
- @types/d3-timer@3.0.2
- clsx@2.1.1
- csstype@3.2.3
- decimal.js-light@2.5.1
- dom-helpers@5.2.1
- eventemitter3@4.0.7
- fast-equals@5.4.2
- js-tokens@4.0.0
- lodash@4.18.1
- loose-envify@1.4.0
- object-assign@4.1.1
- prop-types@15.8.1
- react-dom@18.3.1
- react-hook-form@7.54.2
- react-is@16.13.1
- react-is@18.3.1
- react-router-dom@6.30.0
- react-router@6.30.0
- react-smooth@4.0.4
- react@18.3.1
- recharts-scale@0.4.5
- recharts@2.15.1
- scheduler@0.23.2
- tiny-invariant@1.3.3
- zod@3.24.2
ISC
Obligation. Retain the copyright notice and permission notice.
12 component(s)
- d3-array@3.2.4
- d3-color@3.1.0
- d3-format@3.1.2
- d3-interpolate@3.0.1
- d3-path@3.1.0
- d3-scale@4.0.2
- d3-shape@3.2.0
- d3-time-format@4.1.0
- d3-time@3.1.0
- d3-timer@3.0.1
- internmap@2.0.3
- lucide-react@1.46.0
BSD-3-Clause
Obligation. Retain the copyright, conditions and disclaimer. Do not use contributor names to endorse this product.
2 component(s)
- d3-ease@3.0.1
- react-transition-group@4.4.5
MIT AND ISC
Obligation. Retain the copyright notice and the permission notice.
1 component(s)
- victory-vendor@36.9.2
OFL-1.1
Obligation. Retain the copyright and full OFL text; do not sell the font by itself or relicense it.
1 component(s)
- @fontsource/ibm-plex-sans@5.3.0
Vendored files
Copied into the source tree and compiled into the distributed binaries.
SecLists 10k-most-common.txt - MIT
From github.com/danielmiessler/SecLists, commit 913b3273, Passwords/Common-Credentials/10k-most-common.txt, unmodified, at apps/management-api/data/common-passwords.txt: the common-password list the management API refuses (DLP-991).
MIT License
Copyright (c) 2018 Daniel Miessler
Permission is hereby granted, free of charge, to any person obtaining a copy
of this software and associated documentation files (the "Software"), to deal
in the Software without restriction, including without limitation the rights
to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
copies of the Software, and to permit persons to whom the Software is
furnished to do so, subject to the following conditions:
The above copyright notice and this permission notice shall be included in all
copies or substantial portions of the Software.
THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
SOFTWARE.Components deployed but not redistributed
These run as separate services supplied by the operator. Their licences impose no redistribution obligation on us because we do not redistribute them; they are recorded for completeness.
| Component | Licence |
|---|---|
| PostgreSQL 16 | PostgreSQL Licence |
| nginx | BSD-2-Clause |
Components evaluated but not shipped
| Component | Licence | Status |
|---|---|---|
| Apache Tika | Apache-2.0 | Contract-only; transitive parser licences not yet enumerated |
| Presidio | MIT | Contract-only; NLP model licensing under review |
| Tesseract OCR + tessdata_fast | Apache-2.0 | Contract-only |
| Gitleaks | MIT | Licence acceptable; ruleset deliberately not imported |
| YARA-X | BSD-3-Clause | Not in this release |