License Inventory
All open source licenses found in dependencies across SIROS Foundation repositories, generated automatically from GitHub dependency graph SBOMs.
Licenses are classified against the SIROS license policy, which defines allowed, restricted, and blocked license categories. NOASSERTION entries from SBOM tooling are resolved using verified overrides.
info
This page is automatically updated daily. For programmatic access, use the JSON catalog:
https://developers.siros.org/catalog/license-inventory.json
26 repositories scanned · 3015 unique packages · 66 license types · 57 unresolved
Policy Compliance
| Category | Packages | Description |
|---|---|---|
| allowed | 2715 | |
| ci-only | 106 | |
| build-only | 97 | |
| unclassified | 69 | |
| test-only | 22 | |
| weak-copyleft | 4 | |
| documentation | 2 |
License policy overrides applied: 633 · Dual-license selections: 197
License Summary
| License | Category | Unique Packages | Total Usages |
|---|---|---|---|
| MIT | allowed | 1290 | 2561 |
| Apache-2.0 | allowed | 580 | 952 |
| BSD-2-Clause | allowed | 79 | 162 |
| BSD-3-Clause | allowed | 84 | 162 |
| ISC | allowed | 43 | 99 |
| MPL-2.0 | build-only | 20 | 80 |
| NOASSERTION | unclassified | 57 | 58 |
| BSD-3-Clause AND LicenseRef-scancode-google-patent-license-golang | allowed | 10 | 55 |
| LGPL-3.0 | ci-only | 1 | 20 |
| Unicode-3.0 | allowed | 18 | 18 |
| Apache-2.0 AND MIT | allowed | 7 | 12 |
| Apache-2.0 AND BSD-3-Clause | allowed | 12 | 12 |
| LGPL-3.0-or-later | build-only | 10 | 10 |
| BSD-2-Clause AND LGPL-2.0-only AND LGPL-2.1-only AND LGPL-3.0-only AND LGPL-3.0-or-later AND MIT AND MPL-2.0 | build-only | 10 | 10 |
| 0BSD | allowed | 1 | 8 |
| CC0-1.0 AND MIT | allowed | 5 | 7 |
| CC0-1.0 | allowed | 4 | 6 |
| MIT-0 | allowed | 3 | 6 |
| BSD-2-Clause AND BSD-2-Clause-Views | allowed | 2 | 6 |
| EPL-2.0 | test-only | 6 | 6 |
| mit | unclassified | 6 | 6 |
| ISC AND MIT | allowed | 4 | 6 |
| BlueOak-1.0.0 | allowed | 3 | 5 |
| Apache-2.0 AND BSD-3-Clause AND MIT | allowed | 1 | 5 |
| BSD-2-Clause-Views AND BSD-2-Clause AND BSD-2-Clause-Views | allowed | 1 | 4 |
| EUPL-1.2 | weak-copyleft | 1 | 3 |
| MIT AND Zlib | allowed | 1 | 3 |
| Apache-2.0 AND LGPL-3.0-or-later | build-only | 3 | 3 |
| Apache-2.0 AND BSD-2-Clause AND LGPL-2.0-only AND LGPL-2.1-only AND LGPL-3.0-only AND LGPL-3.0-or-later AND MIT AND MPL-2.0 | build-only | 3 | 3 |
| Apache-2.0 AND BSD-2-Clause AND CC0-1.0 AND ISC AND MIT | allowed | 1 | 2 |
| Apache-2.0 AND CC-BY-3.0 AND MIT | allowed | 1 | 2 |
| bsd-3-clause | unclassified | 2 | 2 |
| apache-2.0 | unclassified | 2 | 2 |
| 0BSD AND ISC AND MIT | allowed | 1 | 2 |
| Python-2.0 | allowed | 1 | 2 |
| BSD-2-Clause AND BSD-3-Clause | allowed | 1 | 2 |
| Apache-2.0 AND BSD-2-Clause | allowed | 1 | 2 |
| MIT AND BSD-3-Clause | allowed | 1 | 1 |
| MIT AND MIT AND Apache-2.0 | allowed | 1 | 1 |
| MIT OR Apache-2.0 OR BSD-1-Clause | allowed | 1 | 1 |
| CDLA-Permissive-2.0 | allowed | 1 | 1 |
| Apache-2.0 AND ISC | allowed | 1 | 1 |
| MIT OR Apache-2.0 OR LGPL-2.1-or-later | allowed | 1 | 1 |
| LicenseRef-scancode-jdom | allowed | 1 | 1 |
| Apache-2.0 AND LicenseRef-scancode-public-domain AND bzip2-1.0.6 | allowed | 1 | 1 |
| EPL-1.0 | test-only | 1 | 1 |
| Apache-2.0 AND CC0-1.0 | allowed | 1 | 1 |
| Apache-2.0 AND BSD-2-Clause AND BSD-3-Clause AND Elastic-2.0 AND LicenseRef-scancode-public-domain AND MIT AND bzip2-1.0.6 | build-only | 1 | 1 |
| LicenseRef-bad-non-standard | test-only | 1 | 1 |
| MPL-1.1 | build-only | 1 | 1 |
| CDDL-1.0 | build-only | 1 | 1 |
| CDDL-1.1 | build-only | 1 | 1 |
| LGPL-2.1 | build-only | 1 | 1 |
| mpl-2.0 | unclassified | 1 | 1 |
| BSD-2-Clause-Views | allowed | 1 | 1 |
| MPL-1.1 AND MPL-2.0 | weak-copyleft | 1 | 1 |
| Apache-2.0 AND LicenseRef-scancode-dco-1.1 AND MIT | allowed | 1 | 1 |
| Apache-2.0 AND CC-BY-SA-4.0 | documentation | 1 | 1 |
| BSD-3-Clause AND ISC AND MIT | allowed | 1 | 1 |
| BSD-2-Clause AND CC0-1.0 AND ISC AND MIT | allowed | 1 | 1 |
| Apache-2.0 AND LGPL-3.0-or-later AND MIT | build-only | 1 | 1 |
| LicenseRef-scancode-unicode AND MIT | allowed | 1 | 1 |
| OFL-1.1 | unclassified | 1 | 1 |
| CC-BY-4.0 | documentation | 1 | 1 |
| AFL-2.1 AND AFL-3.0 AND BSD-3-Clause | allowed | 1 | 1 |
| Apache-2.0 AND OFL-1.1 AND Ubuntu-font-1.0 | allowed | 1 | 1 |
Per-Repository Breakdown
| Repository | Dependencies | Licenses |
|---|---|---|
| browser-log | 288 | MIT (229), Apache-2.0 (24), MPL-2.0 (12), ISC (8), BSD-2-Clause (7), BSD-3-Clause (2), CC0-1.0 (1), MIT-0 (1), BlueOak-1.0.0 (1), NOASSERTION (1), 0BSD (1), Apache-2.0 AND BSD-2-Clause AND CC0-1.0 AND ISC AND MIT (1) |
| dc-api | 143 | MIT (101), Apache-2.0 (24), MPL-2.0 (12), ISC (2), BSD-2-Clause (2), 0BSD (1), BSD-3-Clause (1) |
| facetec-api | 61 | MIT (32), Apache-2.0 (13), BSD-3-Clause AND LicenseRef-scancode-google-patent-license-golang (6), BSD-3-Clause (3), BSD-2-Clause (3), ISC (1), Apache-2.0 AND MIT (1), BSD-2-Clause AND BSD-2-Clause-Views (1), LGPL-3.0 (1) |
| g119612 | 36 | MIT (16), BSD-2-Clause (7), Apache-2.0 (5), BSD-3-Clause AND LicenseRef-scancode-google-patent-license-golang (3), BSD-3-Clause (3), ISC (1), EUPL-1.2 (1) |
| go-cryptoutil | 18 | MIT (10), BSD-2-Clause (3), EUPL-1.2 (1), BSD-3-Clause AND LicenseRef-scancode-google-patent-license-golang (1), BSD-3-Clause (1), Apache-2.0 (1), LGPL-3.0 (1) |
| go-invite-op | 135 | MIT (80), Apache-2.0 (19), MPL-2.0 (12), BSD-3-Clause AND LicenseRef-scancode-google-patent-license-golang (8), BSD-3-Clause (7), ISC (3), BSD-2-Clause (3), Apache-2.0 AND MIT (1), Apache-2.0 AND BSD-3-Clause AND MIT (1), LGPL-3.0 (1) |
| go-r2ps-service | 49 | MIT (21), Apache-2.0 (10), BSD-3-Clause (6), BSD-3-Clause AND LicenseRef-scancode-google-patent-license-golang (5), BSD-2-Clause (4), Apache-2.0 AND MIT (1), Apache-2.0 AND BSD-3-Clause AND MIT (1), LGPL-3.0 (1) |
| go-spocp | 19 | MIT (13), BSD-2-Clause (3), Apache-2.0 (1), BSD-3-Clause (1), LGPL-3.0 (1) |
| go-tokenauth | 45 | MIT (26), Apache-2.0 (9), BSD-3-Clause AND LicenseRef-scancode-google-patent-license-golang (6), BSD-2-Clause (2), BSD-3-Clause (1), LGPL-3.0 (1) |
| go-trust | 164 | MIT (77), Apache-2.0 (39), BSD-3-Clause (15), BSD-2-Clause (12), BSD-3-Clause AND LicenseRef-scancode-google-patent-license-golang (10), Apache-2.0 AND MIT (2), Apache-2.0 AND BSD-3-Clause AND MIT (1), BSD-2-Clause AND BSD-2-Clause-Views (1), ISC (1), Apache-2.0 AND CC-BY-3.0 AND MIT (1), NOASSERTION (1), MIT-0 (1), EUPL-1.2 (1), BSD-2-Clause-Views AND BSD-2-Clause AND BSD-2-Clause-Views (1), LGPL-3.0 (1) |
| go-wallet-backend | 103 | MIT (43), Apache-2.0 (23), BSD-2-Clause (12), BSD-3-Clause (12), BSD-3-Clause AND LicenseRef-scancode-google-patent-license-golang (6), BSD-2-Clause AND BSD-2-Clause-Views (1), BSD-2-Clause-Views AND BSD-2-Clause AND BSD-2-Clause-Views (1), MIT AND BSD-3-Clause (1), MIT AND MIT AND Apache-2.0 (1), Apache-2.0 AND BSD-3-Clause AND MIT (1), Apache-2.0 AND MIT (1), LGPL-3.0 (1) |
| go-wmp | 15 | MIT (8), BSD-2-Clause (3), Apache-2.0 (2), BSD-3-Clause AND LicenseRef-scancode-google-patent-license-golang (1), LGPL-3.0 (1) |
| goFF | 32 | MIT (14), BSD-2-Clause (6), BSD-3-Clause (4), Apache-2.0 (4), BSD-3-Clause AND LicenseRef-scancode-google-patent-license-golang (2), ISC (1), LGPL-3.0 (1) |
| goxmldsig | 17 | MIT (7), Apache-2.0 (4), BSD-2-Clause (3), BSD-3-Clause (2), ISC (1) |
| mini-oidc | 18 | MIT (9), Apache-2.0 (7), LGPL-3.0 (1), BSD-2-Clause (1) |
| r2ps-client | 211 | MIT (128), Apache-2.0 (52), Unicode-3.0 (18), BSD-3-Clause (3), NOASSERTION (2), ISC (2), LGPL-3.0 (1), MIT OR Apache-2.0 OR BSD-1-Clause (1), CDLA-Permissive-2.0 (1), Apache-2.0 AND ISC (1), MIT OR Apache-2.0 OR LGPL-2.1-or-later (1), BSD-2-Clause (1) |
| registry-cli | 43 | MIT (16), BSD-3-Clause (12), Apache-2.0 (7), BSD-2-Clause (5), ISC (1), BSD-3-Clause AND LicenseRef-scancode-google-patent-license-golang (1), LGPL-3.0 (1) |
| siros-sdk-kotlin | 524 | Apache-2.0 (461), MIT (20), BSD-3-Clause (15), EPL-2.0 (6), BSD-2-Clause (6), NOASSERTION (2), Apache-2.0 AND BSD-3-Clause (1), Apache-2.0 AND MIT (1), LicenseRef-scancode-jdom (1), Apache-2.0 AND LicenseRef-scancode-public-domain AND bzip2-1.0.6 (1), EPL-1.0 (1), Apache-2.0 AND CC0-1.0 (1), Apache-2.0 AND BSD-2-Clause AND BSD-3-Clause AND Elastic-2.0 AND LicenseRef-scancode-public-domain AND MIT AND bzip2-1.0.6 (1), LicenseRef-bad-non-standard (1), MPL-1.1 (1), CDDL-1.0 (1), CC0-1.0 (1), CDDL-1.1 (1), LGPL-2.1 (1), LGPL-3.0 (1) |
| siros-sdk-swift | 17 | MIT (11), BSD-2-Clause (4), Apache-2.0 (1), LGPL-3.0 (1) |
| siros-verifier-app | 70 | NOASSERTION (47), MIT (8), mit (6), bsd-3-clause (2), apache-2.0 (2), BSD-2-Clause (2), mpl-2.0 (1), Apache-2.0 (1), LGPL-3.0 (1) |
| siros-wrpac-tool | 34 | MIT (15), BSD-2-Clause (7), Apache-2.0 (6), BSD-3-Clause (3), BSD-3-Clause AND LicenseRef-scancode-google-patent-license-golang (1), BSD-2-Clause-Views AND BSD-2-Clause AND BSD-2-Clause-Views (1), LGPL-3.0 (1) |
| vc | 239 | MIT (100), Apache-2.0 (71), BSD-3-Clause (26), BSD-2-Clause (11), Apache-2.0 AND BSD-3-Clause (11), BSD-3-Clause AND LicenseRef-scancode-google-patent-license-golang (5), ISC (2), Apache-2.0 AND MIT (2), BSD-2-Clause-Views (1), MPL-2.0 (1), MPL-1.1 AND MPL-2.0 (1), Apache-2.0 AND LicenseRef-scancode-dco-1.1 AND MIT (1), Apache-2.0 AND BSD-3-Clause AND MIT (1), Apache-2.0 AND CC-BY-SA-4.0 (1), BSD-2-Clause AND BSD-2-Clause-Views (1), MIT-0 (1), BSD-2-Clause-Views AND BSD-2-Clause AND BSD-2-Clause-Views (1), Apache-2.0 AND CC-BY-3.0 AND MIT (1), NOASSERTION (1) |
| wallet-common | 210 | MIT (175), Apache-2.0 (18), BSD-3-Clause (7), 0BSD (2), ISC (2), BSD-2-Clause (2), MIT AND Zlib (1), BSD-3-Clause AND ISC AND MIT (1), BSD-2-Clause AND CC0-1.0 AND ISC AND MIT (1), 0BSD AND ISC AND MIT (1) |
| wallet-companion | 644 | MIT (450), Apache-2.0 (68), ISC (31), BSD-2-Clause (27), MPL-2.0 (18), BSD-3-Clause (12), LGPL-3.0-or-later (10), CC0-1.0 AND MIT (5), BlueOak-1.0.0 (3), Apache-2.0 AND LGPL-3.0-or-later (3), NOASSERTION (2), CC0-1.0 (2), Apache-2.0 AND MIT (2), MIT-0 (1), BSD-2-Clause AND BSD-2-Clause-Views (1), MIT AND Zlib (1), Apache-2.0 AND LGPL-3.0-or-later AND MIT (1), LicenseRef-scancode-unicode AND MIT (1), 0BSD (1), ISC AND MIT (1), Python-2.0 (1), BSD-2-Clause AND BSD-3-Clause (1), OFL-1.1 (1), LGPL-3.0 (1) |
| wallet-frontend | 1056 | MIT (859), Apache-2.0 (58), ISC (40), BSD-2-Clause (24), BSD-3-Clause (21), MPL-2.0 (13), BSD-2-Clause AND LGPL-2.0-only AND LGPL-2.1-only AND LGPL-3.0-only AND LGPL-3.0-or-later AND MIT AND MPL-2.0 (10), ISC AND MIT (4), Apache-2.0 AND BSD-2-Clause AND LGPL-2.0-only AND LGPL-2.1-only AND LGPL-3.0-only AND LGPL-3.0-or-later AND MIT AND MPL-2.0 (3), NOASSERTION (2), Apache-2.0 AND BSD-2-Clause (2), MIT-0 (2), CC0-1.0 (2), 0BSD (2), CC0-1.0 AND MIT (2), MIT AND Zlib (1), BlueOak-1.0.0 (1), CC-BY-4.0 (1), Python-2.0 (1), Apache-2.0 AND MIT (1), Apache-2.0 AND BSD-2-Clause AND CC0-1.0 AND ISC AND MIT (1), BSD-2-Clause AND BSD-3-Clause (1), AFL-2.1 AND AFL-3.0 AND BSD-3-Clause (1), Apache-2.0 AND OFL-1.1 AND Ubuntu-font-1.0 (1), BSD-2-Clause AND BSD-2-Clause-Views (1), 0BSD AND ISC AND MIT (1), LGPL-3.0 (1) |
| wmp-js | 142 | MIT (93), Apache-2.0 (24), MPL-2.0 (12), BSD-3-Clause (5), ISC (3), BSD-2-Clause (2), ISC AND MIT (1), 0BSD (1), LGPL-3.0 (1) |
Packages Requiring Review
The following packages do not fall into the allowed category and may require additional review. Each entry shows which repositories pull in the dependency, enabling audit of the dependency graph.
weak-copyleft (4 packages)
| Package | Version | License | Source | Repositories | Reason |
|---|---|---|---|---|---|
| axe-core | 4.10.2 | MPL-2.0 | sbom | wallet-frontend | |
| github.com/gematik/zero-lab/go/brainpool | v0.0.0-20260309133150-5b2b80ad6517 | EUPL-1.2 | policy-override | g119612, go-cryptoutil, go-trust | Repository root LICENSE is EUPL-1.2 |
| github.com/go-sql-driver/mysql | v1.10.0 | MPL-1.1 AND MPL-2.0 | sbom | vc | |
| github.com/hashicorp/go-uuid | v1.0.3 | MPL-2.0 | sbom | vc |
unclassified (69 packages)
| Package | Version | License | Source | Repositories | Reason |
|---|---|---|---|---|---|
| @csstools/color-helpers | 6.1.1 | NOASSERTION | sbom | browser-log, wallet-companion | |
| @fontsource/inter | 5.3.0 | OFL-1.1 | sbom | wallet-companion | |
| @sirosfoundation/wcc-types | 0.1.0-beta.1 | NOASSERTION | sbom | wallet-frontend | |
| aquasecurity/trivy-action | ed142fd0673e97e23eac54620cfb913e5ce36c25 | NOASSERTION | sbom | vc | |
| args | 2.7.0 | NOASSERTION | sbom | siros-verifier-app | |
| async | 2.13.1 | NOASSERTION | sbom | siros-verifier-app | |
| bluez | 0.8.3 | NOASSERTION | sbom | siros-verifier-app | |
| boolean_selector | 2.1.2 | NOASSERTION | sbom | siros-verifier-app | |
| cbor | 6.5.1 | NOASSERTION | sbom | siros-verifier-app | |
| characters | 1.4.1 | NOASSERTION | sbom | siros-verifier-app | |
| clock | 1.1.2 | apache-2.0 | sbom | siros-verifier-app | |
| collection | 1.19.1 | NOASSERTION | sbom | siros-verifier-app | |
| com.github.peteroupc:datautilities | 1.1.0 | NOASSERTION | sbom | siros-sdk-kotlin | |
| convert | 3.1.2 | NOASSERTION | sbom | siros-verifier-app | |
| dbus | 0.7.14 | mpl-2.0 | sbom | siros-verifier-app | |
| fake_async | 1.3.3 | NOASSERTION | sbom | siros-verifier-app | |
| ffi | 2.2.0 | NOASSERTION | sbom | siros-verifier-app | |
| filippo.io/mldsa | v0.0.0-20260711112038-ff3f469cee29 | NOASSERTION | sbom | go-trust | |
| fixnum | 1.1.1 | NOASSERTION | sbom | siros-verifier-app | |
| flutter_blue_plus | 1.36.8 | NOASSERTION | sbom | siros-verifier-app | |
| flutter_blue_plus_android | 7.0.4 | NOASSERTION | sbom | siros-verifier-app | |
| flutter_blue_plus_darwin | 7.0.3 | NOASSERTION | sbom | siros-verifier-app | |
| flutter_blue_plus_linux | 7.0.3 | NOASSERTION | sbom | siros-verifier-app | |
| flutter_blue_plus_platform_interface | 7.0.0 | NOASSERTION | sbom | siros-verifier-app | |
| flutter_blue_plus_web | 7.0.2 | NOASSERTION | sbom | siros-verifier-app | |
| flutter_lints | 6.0.0 | NOASSERTION | sbom | siros-verifier-app | |
| flutter_reactive_ble | 5.5.0 | NOASSERTION | sbom | siros-verifier-app | |
| functional_data | 1.2.0 | NOASSERTION | sbom | siros-verifier-app | |
| hex | 0.2.0 | NOASSERTION | sbom | siros-verifier-app | |
| js | 0.7.2 | NOASSERTION | sbom | siros-verifier-app | |
| leak_tracker | 11.0.2 | NOASSERTION | sbom | siros-verifier-app | |
| leak_tracker_flutter_testing | 3.0.10 | NOASSERTION | sbom | siros-verifier-app | |
| leak_tracker_testing | 3.0.2 | NOASSERTION | sbom | siros-verifier-app | |
| lints | 6.1.0 | NOASSERTION | sbom | siros-verifier-app | |
| matcher | 0.12.19 | NOASSERTION | sbom | siros-verifier-app | |
| material_color_utilities | 0.13.0 | apache-2.0 | sbom | siros-verifier-app | |
| meta | 1.18.0 | NOASSERTION | sbom | siros-verifier-app | |
| mobile_scanner | 5.2.3 | NOASSERTION | sbom | siros-verifier-app | |
| path | 1.9.1 | NOASSERTION | sbom | siros-verifier-app | |
| permission_handler | 11.4.0 | mit | sbom | siros-verifier-app | |
| permission_handler_android | 12.1.0 | mit | sbom | siros-verifier-app | |
| permission_handler_apple | 9.4.10 | mit | sbom | siros-verifier-app | |
| permission_handler_html | 0.1.3+5 | mit | sbom | siros-verifier-app | |
| permission_handler_platform_interface | 4.3.0 | mit | sbom | siros-verifier-app | |
| permission_handler_windows | 0.2.1 | mit | sbom | siros-verifier-app | |
| petitparser | 7.0.2 | NOASSERTION | sbom | siros-verifier-app | |
| plugin_platform_interface | 2.1.8 | NOASSERTION | sbom | siros-verifier-app | |
| pointycastle | 3.9.1 | NOASSERTION | sbom | siros-verifier-app | |
| protobuf | 6.0.0 | NOASSERTION | sbom | siros-verifier-app | |
| r0adkll/upload-google-play | 1.. | NOASSERTION | sbom | siros-sdk-kotlin | |
| reactive_ble_mobile | 5.5.0 | NOASSERTION | sbom | siros-verifier-app | |
| reactive_ble_platform_interface | 5.5.0 | NOASSERTION | sbom | siros-verifier-app | |
| rxdart | 0.28.0 | NOASSERTION | sbom | siros-verifier-app | |
| source_span | 1.10.2 | NOASSERTION | sbom | siros-verifier-app | |
| stack_trace | 1.12.1 | bsd-3-clause | sbom | siros-verifier-app | |
| stream_channel | 2.1.4 | NOASSERTION | sbom | siros-verifier-app | |
| string_scanner | 1.4.1 | NOASSERTION | sbom | siros-verifier-app | |
| subosito/flutter-action | 2.. | NOASSERTION | sbom | siros-verifier-app | |
| taiki-e/install-action | e67fa11c4b9316fa714ddf0abed07a0c3143b95b | NOASSERTION | sbom | r2ps-client | |
| term_glyph | 1.2.2 | NOASSERTION | sbom | siros-verifier-app | |
| test_api | 0.7.11 | bsd-3-clause | sbom | siros-verifier-app | |
| tsdown | ^0.22.14 | NOASSERTION | sbom | wallet-companion | |
| typed_data | 1.4.0 | NOASSERTION | sbom | siros-verifier-app | |
| vector_math | 2.2.0 | NOASSERTION | sbom | siros-verifier-app | |
| vm_service | 15.2.0 | NOASSERTION | sbom | siros-verifier-app | |
| wallet-common | https://codeload.github.com/sirosfoundation/wallet-common/tar.gz/1e538ad904f183256e3f45a59c2d78dc2fec2b7e | NOASSERTION | sbom | wallet-frontend | |
| web | 1.1.1 | NOASSERTION | sbom | siros-verifier-app | |
| webpki-roots | 1.0.8 | NOASSERTION | sbom | r2ps-client | |
| xml | 6.6.1 | NOASSERTION | sbom | siros-verifier-app |
build-only (97 packages)
| Package | Version | License | Source | Repositories | Reason |
|---|---|---|---|---|---|
| @img/sharp-darwin-arm64 | 0.35.3 | Apache-2.0 | sbom | wallet-companion | Native image binaries — build-time optional platform deps, dynamic linking |
| @img/sharp-darwin-arm64 | 0.34.5 | Apache-2.0 | sbom | wallet-frontend | Native image binaries — build-time optional platform deps, dynamic linking |
| @img/sharp-darwin-x64 | 0.35.3 | Apache-2.0 | sbom | wallet-companion | Native image binaries — build-time optional platform deps, dynamic linking |
| @img/sharp-darwin-x64 | 0.34.5 | Apache-2.0 | sbom | wallet-frontend | Native image binaries — build-time optional platform deps, dynamic linking |
| @img/sharp-freebsd-wasm32 | 0.35.3 | Apache-2.0 | sbom | wallet-companion | Native image binaries — build-time optional platform deps, dynamic linking |
| @img/sharp-libvips-darwin-arm64 | 1.3.2 | LGPL-3.0-or-later | sbom | wallet-companion | Native image binaries — build-time optional platform deps, dynamic linking |
| @img/sharp-libvips-darwin-arm64 | 1.2.4 | BSD-2-Clause AND LGPL-2.0-only AND LGPL-2.1-only AND LGPL-3.0-only AND LGPL-3.0-or-later AND MIT AND MPL-2.0 | sbom | wallet-frontend | Native image binaries — build-time optional platform deps, dynamic linking |
| @img/sharp-libvips-darwin-x64 | 1.3.2 | LGPL-3.0-or-later | sbom | wallet-companion | Native image binaries — build-time optional platform deps, dynamic linking |
| @img/sharp-libvips-darwin-x64 | 1.2.4 | BSD-2-Clause AND LGPL-2.0-only AND LGPL-2.1-only AND LGPL-3.0-only AND LGPL-3.0-or-later AND MIT AND MPL-2.0 | sbom | wallet-frontend | Native image binaries — build-time optional platform deps, dynamic linking |
| @img/sharp-libvips-linux-arm | 1.3.2 | LGPL-3.0-or-later | sbom | wallet-companion | Native image binaries — build-time optional platform deps, dynamic linking |
| @img/sharp-libvips-linux-arm | 1.2.4 | BSD-2-Clause AND LGPL-2.0-only AND LGPL-2.1-only AND LGPL-3.0-only AND LGPL-3.0-or-later AND MIT AND MPL-2.0 | sbom | wallet-frontend | Native image binaries — build-time optional platform deps, dynamic linking |
| @img/sharp-libvips-linux-arm64 | 1.3.2 | LGPL-3.0-or-later | sbom | wallet-companion | Native image binaries — build-time optional platform deps, dynamic linking |
| @img/sharp-libvips-linux-arm64 | 1.2.4 | BSD-2-Clause AND LGPL-2.0-only AND LGPL-2.1-only AND LGPL-3.0-only AND LGPL-3.0-or-later AND MIT AND MPL-2.0 | sbom | wallet-frontend | Native image binaries — build-time optional platform deps, dynamic linking |
| @img/sharp-libvips-linux-ppc64 | 1.3.2 | LGPL-3.0-or-later | sbom | wallet-companion | Native image binaries — build-time optional platform deps, dynamic linking |
| @img/sharp-libvips-linux-ppc64 | 1.2.4 | BSD-2-Clause AND LGPL-2.0-only AND LGPL-2.1-only AND LGPL-3.0-only AND LGPL-3.0-or-later AND MIT AND MPL-2.0 | sbom | wallet-frontend | Native image binaries — build-time optional platform deps, dynamic linking |
| @img/sharp-libvips-linux-riscv64 | 1.3.2 | LGPL-3.0-or-later | sbom | wallet-companion | Native image binaries — build-time optional platform deps, dynamic linking |
| @img/sharp-libvips-linux-riscv64 | 1.2.4 | BSD-2-Clause AND LGPL-2.0-only AND LGPL-2.1-only AND LGPL-3.0-only AND LGPL-3.0-or-later AND MIT AND MPL-2.0 | sbom | wallet-frontend | Native image binaries — build-time optional platform deps, dynamic linking |
| @img/sharp-libvips-linux-s390x | 1.3.2 | LGPL-3.0-or-later | sbom | wallet-companion | Native image binaries — build-time optional platform deps, dynamic linking |
| @img/sharp-libvips-linux-s390x | 1.2.4 | BSD-2-Clause AND LGPL-2.0-only AND LGPL-2.1-only AND LGPL-3.0-only AND LGPL-3.0-or-later AND MIT AND MPL-2.0 | sbom | wallet-frontend | Native image binaries — build-time optional platform deps, dynamic linking |
| @img/sharp-libvips-linux-x64 | 1.3.2 | LGPL-3.0-or-later | sbom | wallet-companion | Native image binaries — build-time optional platform deps, dynamic linking |
| @img/sharp-libvips-linux-x64 | 1.2.4 | BSD-2-Clause AND LGPL-2.0-only AND LGPL-2.1-only AND LGPL-3.0-only AND LGPL-3.0-or-later AND MIT AND MPL-2.0 | sbom | wallet-frontend | Native image binaries — build-time optional platform deps, dynamic linking |
| @img/sharp-libvips-linuxmusl-arm64 | 1.3.2 | LGPL-3.0-or-later | sbom | wallet-companion | Native image binaries — build-time optional platform deps, dynamic linking |
| @img/sharp-libvips-linuxmusl-arm64 | 1.2.4 | BSD-2-Clause AND LGPL-2.0-only AND LGPL-2.1-only AND LGPL-3.0-only AND LGPL-3.0-or-later AND MIT AND MPL-2.0 | sbom | wallet-frontend | Native image binaries — build-time optional platform deps, dynamic linking |
| @img/sharp-libvips-linuxmusl-x64 | 1.3.2 | LGPL-3.0-or-later | sbom | wallet-companion | Native image binaries — build-time optional platform deps, dynamic linking |
| @img/sharp-libvips-linuxmusl-x64 | 1.2.4 | BSD-2-Clause AND LGPL-2.0-only AND LGPL-2.1-only AND LGPL-3.0-only AND LGPL-3.0-or-later AND MIT AND MPL-2.0 | sbom | wallet-frontend | Native image binaries — build-time optional platform deps, dynamic linking |
| @img/sharp-linux-arm | 0.35.3 | Apache-2.0 | sbom | wallet-companion | Native image binaries — build-time optional platform deps, dynamic linking |
| @img/sharp-linux-arm | 0.34.5 | Apache-2.0 | sbom | wallet-frontend | Native image binaries — build-time optional platform deps, dynamic linking |
| @img/sharp-linux-arm64 | 0.35.3 | Apache-2.0 | sbom | wallet-companion | Native image binaries — build-time optional platform deps, dynamic linking |
| @img/sharp-linux-arm64 | 0.34.5 | Apache-2.0 | sbom | wallet-frontend | Native image binaries — build-time optional platform deps, dynamic linking |
| @img/sharp-linux-ppc64 | 0.35.3 | Apache-2.0 | sbom | wallet-companion | Native image binaries — build-time optional platform deps, dynamic linking |
| @img/sharp-linux-ppc64 | 0.34.5 | Apache-2.0 | sbom | wallet-frontend | Native image binaries — build-time optional platform deps, dynamic linking |
| @img/sharp-linux-riscv64 | 0.35.3 | Apache-2.0 | sbom | wallet-companion | Native image binaries — build-time optional platform deps, dynamic linking |
| @img/sharp-linux-riscv64 | 0.34.5 | Apache-2.0 | sbom | wallet-frontend | Native image binaries — build-time optional platform deps, dynamic linking |
| @img/sharp-linux-s390x | 0.35.3 | Apache-2.0 | sbom | wallet-companion | Native image binaries — build-time optional platform deps, dynamic linking |
| @img/sharp-linux-s390x | 0.34.5 | Apache-2.0 | sbom | wallet-frontend | Native image binaries — build-time optional platform deps, dynamic linking |
| @img/sharp-linux-x64 | 0.35.3 | Apache-2.0 | sbom | wallet-companion | Native image binaries — build-time optional platform deps, dynamic linking |
| @img/sharp-linux-x64 | 0.34.5 | Apache-2.0 | sbom | wallet-frontend | Native image binaries — build-time optional platform deps, dynamic linking |
| @img/sharp-linuxmusl-arm64 | 0.35.3 | Apache-2.0 | sbom | wallet-companion | Native image binaries — build-time optional platform deps, dynamic linking |
| @img/sharp-linuxmusl-arm64 | 0.34.5 | Apache-2.0 | sbom | wallet-frontend | Native image binaries — build-time optional platform deps, dynamic linking |
| @img/sharp-linuxmusl-x64 | 0.35.3 | Apache-2.0 | sbom | wallet-companion | Native image binaries — build-time optional platform deps, dynamic linking |
| @img/sharp-linuxmusl-x64 | 0.34.5 | Apache-2.0 | sbom | wallet-frontend | Native image binaries — build-time optional platform deps, dynamic linking |
| @img/sharp-wasm32 | 0.35.3 | Apache-2.0 AND LGPL-3.0-or-later AND MIT | sbom | wallet-companion | Native image binaries — build-time optional platform deps, dynamic linking |
| @img/sharp-wasm32 | 0.34.5 | Apache-2.0 | sbom | wallet-frontend | Native image binaries — build-time optional platform deps, dynamic linking |
| @img/sharp-webcontainers-wasm32 | 0.35.3 | Apache-2.0 | sbom | wallet-companion | Native image binaries — build-time optional platform deps, dynamic linking |
| @img/sharp-win32-arm64 | 0.35.3 | Apache-2.0 AND LGPL-3.0-or-later | sbom | wallet-companion | Native image binaries — build-time optional platform deps, dynamic linking |
| @img/sharp-win32-arm64 | 0.34.5 | Apache-2.0 AND BSD-2-Clause AND LGPL-2.0-only AND LGPL-2.1-only AND LGPL-3.0-only AND LGPL-3.0-or-later AND MIT AND MPL-2.0 | sbom | wallet-frontend | Native image binaries — build-time optional platform deps, dynamic linking |
| @img/sharp-win32-ia32 | 0.35.3 | Apache-2.0 AND LGPL-3.0-or-later | sbom | wallet-companion | Native image binaries — build-time optional platform deps, dynamic linking |
| @img/sharp-win32-ia32 | 0.34.5 | Apache-2.0 AND BSD-2-Clause AND LGPL-2.0-only AND LGPL-2.1-only AND LGPL-3.0-only AND LGPL-3.0-or-later AND MIT AND MPL-2.0 | sbom | wallet-frontend | Native image binaries — build-time optional platform deps, dynamic linking |
| @img/sharp-win32-x64 | 0.35.3 | Apache-2.0 AND LGPL-3.0-or-later | sbom | wallet-companion | Native image binaries — build-time optional platform deps, dynamic linking |
| @img/sharp-win32-x64 | 0.34.5 | Apache-2.0 AND BSD-2-Clause AND LGPL-2.0-only AND LGPL-2.1-only AND LGPL-3.0-only AND LGPL-3.0-or-later AND MIT AND MPL-2.0 | sbom | wallet-frontend | Native image binaries — build-time optional platform deps, dynamic linking |
| addons-linter | 10.10.0 | MPL-2.0 | sbom | wallet-companion | Firefox addons dev tooling — build-time only |
| addons-moz-compare | 1.3.0 | MPL-2.0 | sbom | wallet-companion | Firefox addons dev tooling — build-time only |
| addons-scanner-utils | 15.4.0 | MPL-2.0 | sbom | wallet-companion | Firefox addons dev tooling — build-time only |
| com.googlecode.juniversalchardet:juniversalchardet | 1.0.3 | MPL-1.1 | sbom | siros-sdk-kotlin | juniversalchardet — build tooling dependency |
| com.sun.activation:javax.activation | 1.2.0 | CDDL-1.1 | dual-license-selection | siros-sdk-kotlin | javax.activation — Gradle build dependency, CDDL+GPL with Classpath exception |
| eslint-plugin-no-unsanitized | 4.1.5 | MPL-2.0 | sbom | wallet-companion | ESLint plugin — dev-time linter |
| fx-runner | 1.6.0 | MPL-2.0 | sbom | wallet-companion | fx-runner — browser extension dev tool |
| javax.annotation:javax.annotation-api | 1.3.2 | CDDL-1.0 | dual-license-selection | siros-sdk-kotlin | javax.annotation-api — Gradle build dependency, CDDL+GPL with Classpath exception |
| lightningcss | 1.33.0 | MPL-2.0 | sbom | browser-log, wallet-companion | LightningCSS — build-time CSS compiler |
| lightningcss | 1.32.0 | MPL-2.0 | sbom | dc-api, go-invite-op, wmp-js | LightningCSS — build-time CSS compiler |
| lightningcss | 1.30.2 | MPL-2.0 | sbom | wallet-frontend | LightningCSS — build-time CSS compiler |
| lightningcss-android-arm64 | 1.33.0 | MPL-2.0 | sbom | browser-log, wallet-companion | LightningCSS — build-time CSS compiler |
| lightningcss-android-arm64 | 1.32.0 | MPL-2.0 | sbom | dc-api, go-invite-op, wmp-js | LightningCSS — build-time CSS compiler |
| lightningcss-android-arm64 | 1.30.2 | MPL-2.0 | sbom | wallet-frontend | LightningCSS — build-time CSS compiler |
| lightningcss-darwin-arm64 | 1.33.0 | MPL-2.0 | sbom | browser-log, wallet-companion | LightningCSS — build-time CSS compiler |
| lightningcss-darwin-arm64 | 1.32.0 | MPL-2.0 | sbom | dc-api, go-invite-op, wmp-js | LightningCSS — build-time CSS compiler |
| lightningcss-darwin-arm64 | 1.30.2 | MPL-2.0 | sbom | wallet-frontend | LightningCSS — build-time CSS compiler |
| lightningcss-darwin-x64 | 1.33.0 | MPL-2.0 | sbom | browser-log, wallet-companion | LightningCSS — build-time CSS compiler |
| lightningcss-darwin-x64 | 1.32.0 | MPL-2.0 | sbom | dc-api, go-invite-op, wmp-js | LightningCSS — build-time CSS compiler |
| lightningcss-darwin-x64 | 1.30.2 | MPL-2.0 | sbom | wallet-frontend | LightningCSS — build-time CSS compiler |
| lightningcss-freebsd-x64 | 1.33.0 | MPL-2.0 | sbom | browser-log, wallet-companion | LightningCSS — build-time CSS compiler |
| lightningcss-freebsd-x64 | 1.32.0 | MPL-2.0 | sbom | dc-api, go-invite-op, wmp-js | LightningCSS — build-time CSS compiler |
| lightningcss-freebsd-x64 | 1.30.2 | MPL-2.0 | sbom | wallet-frontend | LightningCSS — build-time CSS compiler |
| lightningcss-linux-arm-gnueabihf | 1.33.0 | MPL-2.0 | sbom | browser-log, wallet-companion | LightningCSS — build-time CSS compiler |
| lightningcss-linux-arm-gnueabihf | 1.32.0 | MPL-2.0 | sbom | dc-api, go-invite-op, wmp-js | LightningCSS — build-time CSS compiler |
| lightningcss-linux-arm-gnueabihf | 1.30.2 | MPL-2.0 | sbom | wallet-frontend | LightningCSS — build-time CSS compiler |
| lightningcss-linux-arm64-gnu | 1.33.0 | MPL-2.0 | sbom | browser-log, wallet-companion | LightningCSS — build-time CSS compiler |
| lightningcss-linux-arm64-gnu | 1.32.0 | MPL-2.0 | sbom | dc-api, go-invite-op, wmp-js | LightningCSS — build-time CSS compiler |
| lightningcss-linux-arm64-gnu | 1.30.2 | MPL-2.0 | sbom | wallet-frontend | LightningCSS — build-time CSS compiler |
| lightningcss-linux-arm64-musl | 1.33.0 | MPL-2.0 | sbom | browser-log, wallet-companion | LightningCSS — build-time CSS compiler |
| lightningcss-linux-arm64-musl | 1.32.0 | MPL-2.0 | sbom | dc-api, go-invite-op, wmp-js | LightningCSS — build-time CSS compiler |
| lightningcss-linux-arm64-musl | 1.30.2 | MPL-2.0 | sbom | wallet-frontend | LightningCSS — build-time CSS compiler |
| lightningcss-linux-x64-gnu | 1.33.0 | MPL-2.0 | sbom | browser-log, wallet-companion | LightningCSS — build-time CSS compiler |
| lightningcss-linux-x64-gnu | 1.32.0 | MPL-2.0 | sbom | dc-api, go-invite-op, wmp-js | LightningCSS — build-time CSS compiler |
| lightningcss-linux-x64-gnu | 1.30.2 | MPL-2.0 | sbom | wallet-frontend | LightningCSS — build-time CSS compiler |
| lightningcss-linux-x64-musl | 1.33.0 | MPL-2.0 | sbom | browser-log, wallet-companion | LightningCSS — build-time CSS compiler |
| lightningcss-linux-x64-musl | 1.32.0 | MPL-2.0 | sbom | dc-api, go-invite-op, wmp-js | LightningCSS — build-time CSS compiler |
| lightningcss-linux-x64-musl | 1.30.2 | MPL-2.0 | sbom | wallet-frontend | LightningCSS — build-time CSS compiler |
| lightningcss-win32-arm64-msvc | 1.33.0 | MPL-2.0 | sbom | browser-log, wallet-companion | LightningCSS — build-time CSS compiler |
| lightningcss-win32-arm64-msvc | 1.32.0 | MPL-2.0 | sbom | dc-api, go-invite-op, wmp-js | LightningCSS — build-time CSS compiler |
| lightningcss-win32-arm64-msvc | 1.30.2 | MPL-2.0 | sbom | wallet-frontend | LightningCSS — build-time CSS compiler |
| lightningcss-win32-x64-msvc | 1.33.0 | MPL-2.0 | sbom | browser-log, wallet-companion | LightningCSS — build-time CSS compiler |
| lightningcss-win32-x64-msvc | 1.32.0 | MPL-2.0 | sbom | dc-api, go-invite-op, wmp-js | LightningCSS — build-time CSS compiler |
| lightningcss-win32-x64-msvc | 1.30.2 | MPL-2.0 | sbom | wallet-frontend | LightningCSS — build-time CSS compiler |
| org.jetbrains.dokka:analysis-kotlin-descriptors | 2.0.0 | Apache-2.0 AND BSD-2-Clause AND BSD-3-Clause AND Elastic-2.0 AND LicenseRef-scancode-public-domain AND MIT AND bzip2-1.0.6 | sbom | siros-sdk-kotlin | JetBrains libraries — Apache-2.0 |
| org.jetbrains.intellij.deps:trove4j | 1.0.20200330 | LGPL-2.1 | sbom | siros-sdk-kotlin | trove4j — Kotlin compiler internal dependency, build-only |
| web-ext | 10.6.0 | MPL-2.0 | sbom | wallet-companion | web-ext CLI — browser extension build tool |
test-only (22 packages)
| Package | Version | License | Source | Repositories | Reason |
|---|---|---|---|---|---|
| github.com/testcontainers/testcontainers-go | v0.44.0 | MIT | sbom | vc | testcontainers — test dependency |
| github.com/testcontainers/testcontainers-go/modules/mariadb | v0.44.0 | MIT | sbom | vc | testcontainers — test dependency |
| github.com/testcontainers/testcontainers-go/modules/postgres | v0.44.0 | MIT | sbom | vc | testcontainers — test dependency |
| github.com/testcontainers/testcontainers-go/modules/redis | v0.44.0 | MIT | sbom | vc | testcontainers — test dependency |
| io.mockk:mockk | 1.13.13 | Apache-2.0 | sbom | siros-sdk-kotlin | MockK — test dependency |
| io.mockk:mockk-agent | 1.13.13 | Apache-2.0 | sbom | siros-sdk-kotlin | MockK — test dependency |
| io.mockk:mockk-agent-api | 1.13.13 | Apache-2.0 | sbom | siros-sdk-kotlin | MockK — test dependency |
| io.mockk:mockk-agent-api-jvm | 1.13.13 | Apache-2.0 | sbom | siros-sdk-kotlin | MockK — test dependency |
| io.mockk:mockk-agent-jvm | 1.13.13 | Apache-2.0 | sbom | siros-sdk-kotlin | MockK — test dependency |
| io.mockk:mockk-core | 1.13.13 | Apache-2.0 | sbom | siros-sdk-kotlin | MockK — test dependency |
| io.mockk:mockk-core-jvm | 1.13.13 | Apache-2.0 | sbom | siros-sdk-kotlin | MockK — test dependency |
| io.mockk:mockk-dsl | 1.13.13 | Apache-2.0 | sbom | siros-sdk-kotlin | MockK — test dependency |
| io.mockk:mockk-dsl-jvm | 1.13.13 | Apache-2.0 | sbom | siros-sdk-kotlin | MockK — test dependency |
| io.mockk:mockk-jvm | 1.13.13 | Apache-2.0 | sbom | siros-sdk-kotlin | MockK — test dependency |
| junit:junit | 4.13.2 | EPL-1.0 | sbom | siros-sdk-kotlin | |
| org.junit.jupiter:junit-jupiter | 5.8.2 | EPL-2.0 | sbom | siros-sdk-kotlin | JUnit — EPL-2.0, test-only |
| org.junit.jupiter:junit-jupiter-api | 5.8.2 | EPL-2.0 | sbom | siros-sdk-kotlin | JUnit — EPL-2.0, test-only |
| org.junit.jupiter:junit-jupiter-engine | 5.8.2 | EPL-2.0 | sbom | siros-sdk-kotlin | JUnit — EPL-2.0, test-only |
| org.junit.jupiter:junit-jupiter-params | 5.8.2 | EPL-2.0 | sbom | siros-sdk-kotlin | JUnit — EPL-2.0, test-only |
| org.junit.platform:junit-platform-commons | 1.8.2 | EPL-2.0 | sbom | siros-sdk-kotlin | JUnit — EPL-2.0, test-only |
| org.junit.platform:junit-platform-engine | 1.8.2 | EPL-2.0 | sbom | siros-sdk-kotlin | JUnit — EPL-2.0, test-only |
| org.junit:junit-bom | 5.8.2 | LicenseRef-bad-non-standard | sbom | siros-sdk-kotlin | JUnit — EPL-2.0, test-only |
ci-only (106 packages)
| Package | Version | License | Source | Repositories | Reason |
|---|---|---|---|---|---|
| SonarSource/sonarqube-scan-action | 8.. | LGPL-3.0 | policy-override | facetec-api, go-r2ps-service, go-tokenauth, go-trust, go-wallet-backend, go-wmp, wmp-js | SonarQube action — CI-only |
| SonarSource/sonarqube-scan-action | 5.. | LGPL-3.0 | policy-override | go-cryptoutil, registry-cli | SonarQube action — CI-only |
| SonarSource/sonarqube-scan-action | 2f77a1ec69fb1d595b06f35ab27e97605bdef703 | LGPL-3.0 | policy-override | go-invite-op, mini-oidc, r2ps-client, siros-sdk-kotlin | SonarQube action — CI-only |
| SonarSource/sonarqube-scan-action | 22918119ff8e1ca75a623e15c8296b6ea4fbe28f | LGPL-3.0 | policy-override | go-spocp, goFF, siros-sdk-swift, siros-wrpac-tool, wallet-companion | SonarQube action — CI-only |
| SonarSource/sonarqube-scan-action | 6.. | LGPL-3.0 | policy-override | siros-verifier-app | SonarQube action — CI-only |
| SonarSource/sonarqube-scan-action | 713881670b6b3676cda39549040e2d88c70d582e | LGPL-3.0 | policy-override | wallet-frontend | SonarQube action — CI-only |
| Swatinem/rust-cache | f0d9c3887740aee45f6153b24b3a6b815192ec16 | Apache-2.0 | policy-override | r2ps-client | Rust cache action — CI-only |
| Swatinem/rust-cache | 2.. | Apache-2.0 | policy-override | r2ps-client | Rust cache action — CI-only |
| actions/attest-build-provenance | 4d101475d8b20a2381f78447822ac1eab6504dd8 | MIT | policy-override | siros-wrpac-tool | GitHub Actions — not in deliverable artifacts |
| actions/cache | 0057852bfaa89a56745cba8c7296529d2fc39830 | MIT | policy-override | vc | GitHub Actions — not in deliverable artifacts |
| actions/cache | 55cc8345863c7cc4c66a329aec7e433d2d1c52a9 | MIT | policy-override | vc | GitHub Actions — not in deliverable artifacts |
| actions/checkout | 7.. | MIT | policy-override | browser-log, dc-api, facetec-api, go-r2ps-service, go-tokenauth, go-trust, go-wallet-backend, go-wmp, siros-sdk-swift, wallet-frontend, wmp-js | GitHub Actions — not in deliverable artifacts |
| actions/checkout | 6.. | MIT | policy-override | dc-api, g119612, go-cryptoutil, go-spocp, goFF, siros-sdk-kotlin, siros-verifier-app, wmp-js | GitHub Actions — not in deliverable artifacts |
| actions/checkout | 4.. | MIT | policy-override | go-cryptoutil, go-invite-op, go-spocp, goFF, goxmldsig, r2ps-client, registry-cli, siros-sdk-kotlin, siros-wrpac-tool, wallet-common, wallet-frontend | GitHub Actions — not in deliverable artifacts |
| actions/checkout | 9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 | MIT | policy-override | go-invite-op, siros-sdk-swift, wallet-frontend | GitHub Actions — not in deliverable artifacts |
| actions/checkout | 8ade135a41bc03ea155e62e844d188df1ea18608 | MIT | policy-override | goxmldsig | GitHub Actions — not in deliverable artifacts |
| actions/checkout | 34e114876b0b11c390a56381ad16ebd13914f8d5 | MIT | policy-override | mini-oidc, r2ps-client, siros-sdk-kotlin | GitHub Actions — not in deliverable artifacts |
| actions/checkout | de0fac2e4500dabe0009e67214ff5f5447ce83dd | MIT | policy-override | registry-cli, siros-wrpac-tool | GitHub Actions — not in deliverable artifacts |
| actions/checkout | 3d3c42e5aac5ba805825da76410c181273ba90b1 | MIT | policy-override | vc, wallet-companion | GitHub Actions — not in deliverable artifacts |
| actions/checkout | 7.0.1 | MIT | policy-override | vc, wallet-companion | GitHub Actions — not in deliverable artifacts |
| actions/checkout | 3.. | MIT | policy-override | wallet-common | GitHub Actions — not in deliverable artifacts |
| actions/checkout | 5.. | MIT | policy-override | wallet-common | GitHub Actions — not in deliverable artifacts |
| actions/dependency-review-action | 5.. | MIT | policy-override | browser-log, facetec-api, g119612, go-r2ps-service, go-tokenauth, go-trust, go-wallet-backend, go-wmp, siros-sdk-kotlin, siros-sdk-swift, siros-verifier-app, wallet-companion, wmp-js | GitHub Actions — not in deliverable artifacts |
| actions/dependency-review-action | 4.. | MIT | policy-override | dc-api, go-cryptoutil, go-spocp, goFF, wallet-common, wallet-frontend | GitHub Actions — not in deliverable artifacts |
| actions/dependency-review-action | a1d282b36b6f3519aa1f3fc636f609c47dddb294 | MIT | policy-override | go-invite-op | GitHub Actions — not in deliverable artifacts |
| actions/dependency-review-action | 4901385134134e04cec5fbe5ddfe3b2c5bd5d976 | MIT | policy-override | mini-oidc | GitHub Actions — not in deliverable artifacts |
| actions/dependency-review-action | 2031cfc080254a8a887f58cffee85186f0e49e48 | MIT | policy-override | registry-cli, siros-wrpac-tool | GitHub Actions — not in deliverable artifacts |
| actions/download-artifact | 8.. | MIT | policy-override | g119612, siros-sdk-swift, vc | GitHub Actions — not in deliverable artifacts |
| actions/download-artifact | 3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c | MIT | policy-override | siros-wrpac-tool | GitHub Actions — not in deliverable artifacts |
| actions/setup-go | 6.. | MIT | policy-override | facetec-api, g119612, go-cryptoutil, go-r2ps-service, go-spocp, go-wmp, goFF | GitHub Actions — not in deliverable artifacts |
| actions/setup-go | 924ae3a1cded613372ab5595356fb5720e22ba16 | MIT | policy-override | go-invite-op | GitHub Actions — not in deliverable artifacts |
| actions/setup-go | 7.. | MIT | policy-override | go-tokenauth, go-trust, go-wallet-backend, vc | GitHub Actions — not in deliverable artifacts |
| actions/setup-go | 5.. | MIT | policy-override | goxmldsig, registry-cli, siros-wrpac-tool | GitHub Actions — not in deliverable artifacts |
| actions/setup-go | 40f1582b2485089dde7abd97c1529aa768e1baff | MIT | policy-override | mini-oidc | GitHub Actions — not in deliverable artifacts |
| actions/setup-go | 4a3601121dd01d1626a1e23e37211e3254c1c06c | MIT | policy-override | registry-cli, siros-wrpac-tool | GitHub Actions — not in deliverable artifacts |
| actions/setup-java | 4.. | MIT | policy-override | siros-sdk-kotlin, siros-verifier-app | GitHub Actions — not in deliverable artifacts |
| actions/setup-node | 7.. | MIT | policy-override | browser-log, vc, wallet-companion | GitHub Actions — not in deliverable artifacts |
| actions/setup-node | 4.. | MIT | policy-override | dc-api, wallet-common, wallet-frontend | GitHub Actions — not in deliverable artifacts |
| actions/setup-node | 6.. | MIT | policy-override | dc-api, wmp-js | GitHub Actions — not in deliverable artifacts |
| actions/upload-artifact | 7.. | MIT | policy-override | g119612, siros-sdk-swift, vc | GitHub Actions — not in deliverable artifacts |
| actions/upload-artifact | 5d5d22a31266ced268874388b861e4b58bb5c2f3 | MIT | policy-override | goxmldsig | GitHub Actions — not in deliverable artifacts |
| actions/upload-artifact | 4.. | MIT | policy-override | siros-sdk-kotlin, siros-verifier-app | GitHub Actions — not in deliverable artifacts |
| actions/upload-artifact | 043fb46d1a93c77aae656e7c1c64a875d1fc6a0a | MIT | policy-override | siros-wrpac-tool | GitHub Actions — not in deliverable artifacts |
| codecov/codecov-action | 7.. | MIT | policy-override | facetec-api, go-r2ps-service, go-tokenauth, go-trust, go-wallet-backend, go-wmp, siros-sdk-swift | Codecov actions — CI-only |
| codecov/codecov-action | fb8b3582c8e4def4969c97caa2f19720cb33a72f | MIT | policy-override | go-invite-op, mini-oidc | Codecov actions — CI-only |
| codecov/codecov-action | 6.. | MIT | policy-override | go-spocp, goFF | Codecov actions — CI-only |
| codecov/codecov-action | 57e3a136b779b570ffcdbf80b3bdc90e7fab3de2 | MIT | policy-override | registry-cli, siros-wrpac-tool | Codecov actions — CI-only |
| codecov/codecov-action | 5.. | MIT | policy-override | siros-sdk-kotlin, siros-verifier-app | Codecov actions — CI-only |
| docker/build-push-action | 53b7df96c91f9c12dcc8a07bcb9ccacbed38856a | Apache-2.0 | policy-override | mini-oidc, vc | Docker actions — CI-only |
| docker/build-push-action | 5.. | Apache-2.0 | policy-override | wallet-frontend | Docker actions — CI-only |
| docker/login-action | c94ce9fb468520275223c153574b00df6fe4bcc9 | Apache-2.0 | policy-override | mini-oidc | Docker actions — CI-only |
| docker/login-action | dbcb813823bdd20940b903addbd779551569679f | Apache-2.0 | policy-override | vc | Docker actions — CI-only |
| docker/login-action | 65b78e6e13532edd9afa3aa52ac7964289d1a9c1 | Apache-2.0 | policy-override | wallet-frontend | Docker actions — CI-only |
| docker/metadata-action | dc802804100637a589fabce1cb79ff13a1411302 | Apache-2.0 | policy-override | mini-oidc, vc | Docker actions — CI-only |
| docker/metadata-action | 5.. | Apache-2.0 | policy-override | wallet-frontend | Docker actions — CI-only |
| docker/setup-buildx-action | bb05f3f5519dd87d3ba754cc423b652a5edd6d2c | Apache-2.0 | policy-override | mini-oidc | Docker actions — CI-only |
| docker/setup-buildx-action | 37fe631027851001ddb9b187196cc803df7f5f0e | Apache-2.0 | policy-override | vc | Docker actions — CI-only |
| docker/setup-buildx-action | ba31df4664624f17e1b1ef1c9c85ed1ca9463a6d | Apache-2.0 | policy-override | wallet-frontend | Docker actions — CI-only |
| docker/setup-qemu-action | 96fe6ef7f33517b61c61be40b68a1882f3264fb8 | Apache-2.0 | policy-override | vc | Docker actions — CI-only |
| dtolnay/rust-toolchain | 4cda84d5c5c54efe2404f9d843567869ab1699d4 | MIT | policy-override | r2ps-client | Rust toolchain action — CI-only |
| dtolnay/rust-toolchain | stable | MIT | policy-override | r2ps-client | Rust toolchain action — CI-only |
| dtolnay/rust-toolchain | 4360b52568e2003a75bf9bc1d59f33a8e3fc893c | MIT | policy-override | vc | Rust toolchain action — CI-only |
| editorconfig-checker/action-editorconfig-checker | 2.. | MIT | policy-override | wallet-common | EditorConfig action — CI-only |
| editorconfig-checker/action-editorconfig-checker | 3.0.0 | MIT | policy-override | wallet-frontend | EditorConfig action — CI-only |
| github/codeql-action/analyze | 4.. | MIT | policy-override | browser-log, dc-api, facetec-api, g119612, go-cryptoutil, go-r2ps-service, go-spocp, go-tokenauth, go-trust, go-wallet-backend, go-wmp, goFF, siros-sdk-swift, siros-verifier-app, wallet-companion, wmp-js | GitHub official actions — CI-only |
| github/codeql-action/analyze | 54f647b7e1bb85c95cddabcd46b0c578ec92bc1a | MIT | policy-override | go-invite-op | GitHub official actions — CI-only |
| github/codeql-action/analyze | 02c5e83432fe5497fd85b873b6c9f16a8578e1d9 | MIT | policy-override | mini-oidc | GitHub official actions — CI-only |
| github/codeql-action/analyze | 95e58e9a2cdfd71adc6e0353d5c52f41a045d225 | MIT | policy-override | registry-cli, siros-wrpac-tool | GitHub official actions — CI-only |
| github/codeql-action/analyze | 3.. | MIT | policy-override | siros-sdk-kotlin, wallet-common, wallet-frontend | GitHub official actions — CI-only |
| github/codeql-action/autobuild | 4.. | MIT | policy-override | browser-log, dc-api, facetec-api, g119612, go-cryptoutil, go-r2ps-service, go-spocp, go-tokenauth, go-trust, go-wallet-backend, go-wmp, goFF, siros-sdk-swift, wallet-companion, wmp-js | GitHub official actions — CI-only |
| github/codeql-action/autobuild | 54f647b7e1bb85c95cddabcd46b0c578ec92bc1a | MIT | policy-override | go-invite-op | GitHub official actions — CI-only |
| github/codeql-action/autobuild | f205ea1c3313d32999d8d6a48b4f6530d4437b38 | MIT | policy-override | mini-oidc | GitHub official actions — CI-only |
| github/codeql-action/autobuild | 95e58e9a2cdfd71adc6e0353d5c52f41a045d225 | MIT | policy-override | registry-cli, siros-wrpac-tool | GitHub official actions — CI-only |
| github/codeql-action/autobuild | 3.. | MIT | policy-override | wallet-common, wallet-frontend | GitHub official actions — CI-only |
| github/codeql-action/init | 4.. | MIT | policy-override | browser-log, dc-api, facetec-api, g119612, go-cryptoutil, go-r2ps-service, go-spocp, go-tokenauth, go-trust, go-wallet-backend, go-wmp, goFF, siros-sdk-swift, siros-verifier-app, wallet-companion, wmp-js | GitHub official actions — CI-only |
| github/codeql-action/init | 54f647b7e1bb85c95cddabcd46b0c578ec92bc1a | MIT | policy-override | go-invite-op | GitHub official actions — CI-only |
| github/codeql-action/init | f205ea1c3313d32999d8d6a48b4f6530d4437b38 | MIT | policy-override | mini-oidc | GitHub official actions — CI-only |
| github/codeql-action/init | 95e58e9a2cdfd71adc6e0353d5c52f41a045d225 | MIT | policy-override | registry-cli, siros-wrpac-tool | GitHub official actions — CI-only |
| github/codeql-action/init | 3.. | MIT | policy-override | siros-sdk-kotlin, wallet-common, wallet-frontend | GitHub official actions — CI-only |
| github/codeql-action/upload-sarif | 4.. | MIT | policy-override | dc-api, facetec-api, g119612, go-cryptoutil, go-invite-op, go-r2ps-service, go-spocp, go-tokenauth, go-trust, go-wallet-backend, go-wmp, goFF, r2ps-client, registry-cli, siros-sdk-kotlin, siros-sdk-swift, siros-verifier-app, siros-wrpac-tool, wallet-companion, wmp-js | GitHub official actions — CI-only |
| github/codeql-action/upload-sarif | 60168efe1c415ce0f5521ea06d5c2062adbeed1b | MIT | policy-override | goxmldsig | GitHub official actions — CI-only |
| github/codeql-action/upload-sarif | f205ea1c3313d32999d8d6a48b4f6530d4437b38 | MIT | policy-override | mini-oidc | GitHub official actions — CI-only |
| github/codeql-action/upload-sarif | cdf488f595d80d6e07e03d4674febd5ab45fa938 | MIT | policy-override | vc | GitHub official actions — CI-only |
| golang/govulncheck-action | 1.. | BSD-3-Clause | policy-override | go-spocp, go-trust, goFF, registry-cli, siros-wrpac-tool | Go actions — CI-only |
| golangci/golangci-lint-action | 9.. | MIT | policy-override | facetec-api, go-cryptoutil, go-r2ps-service, go-spocp, go-tokenauth, go-trust, go-wallet-backend, goFF | GolangCI actions — CI-only |
| golangci/golangci-lint-action | ba0d7d2ec06a0ea1cb5fa41b2e4a3ab91d21278a | MIT | policy-override | go-invite-op, mini-oidc | GolangCI actions — CI-only |
| golangci/golangci-lint-action | 1e7e51e771db61008b38414a730f564565cf7c20 | MIT | policy-override | registry-cli, siros-wrpac-tool | GolangCI actions — CI-only |
| gradle/actions/setup-gradle | 4.. | Apache-2.0 | policy-override | siros-sdk-kotlin | Gradle actions — CI-only |
| ossf/scorecard-action | 4eaacf0543bb3f2c246792bd56e8cdeffafb205a | Apache-2.0 | policy-override | dc-api, facetec-api, g119612, go-r2ps-service, go-wmp, wmp-js | OSSF actions — CI-only |
| ossf/scorecard-action | 62b2cac7ed8198b15735ed49ab1e5cf35480ba46 | Apache-2.0 | policy-override | go-cryptoutil, go-invite-op, go-spocp, goFF, r2ps-client, registry-cli, siros-sdk-kotlin, siros-wrpac-tool | OSSF actions — CI-only |
| ossf/scorecard-action | 2d1146689b8cda280b9bc96326124645441f03bc | Apache-2.0 | policy-override | go-tokenauth, go-trust, go-wallet-backend, mini-oidc, siros-sdk-swift, wallet-companion | OSSF actions — CI-only |
| ossf/scorecard-action | 0864cf19026789058feabb7e87baa5f140aac736 | Apache-2.0 | policy-override | goxmldsig | OSSF actions — CI-only |
| ossf/scorecard-action | 2.4.3 | Apache-2.0 | policy-override | siros-verifier-app | OSSF actions — CI-only |
| peter-evans/repository-dispatch | 3.. | MIT | policy-override | wallet-frontend | peter-evans actions — CI-only |
| pnpm/action-setup | 6.. | MIT | policy-override | browser-log, wallet-companion | pnpm actions — CI-only |
| sirosfoundation/.github/.github/workflows/docker-build-push.yml | main | BSD-2-Clause | policy-override | facetec-api, go-r2ps-service, go-spocp, go-trust, go-wallet-backend, goFF, registry-cli, siros-wrpac-tool | SIROS Foundation reusable workflows/actions |
| sirosfoundation/.github/.github/workflows/docker-build-push.yml | 8b079d7f8fa866a3406d1f414e740cc51b8f35f1 | BSD-2-Clause | policy-override | go-invite-op | SIROS Foundation reusable workflows/actions |
| sirosfoundation/.github/.github/workflows/sbom.yml | 03160e376dbdeb9f2c904e7a9f45499b2f67e8fa | BSD-2-Clause | policy-override | browser-log, facetec-api, g119612, go-cryptoutil, go-r2ps-service, go-spocp, go-tokenauth, go-trust, go-wallet-backend, go-wmp, goFF, siros-sdk-kotlin, siros-sdk-swift, wallet-common, wallet-companion, wallet-frontend, wmp-js | SIROS Foundation reusable workflows/actions |
| sirosfoundation/.github/.github/workflows/sbom.yml | main | BSD-2-Clause | policy-override | go-invite-op, registry-cli, siros-verifier-app, siros-wrpac-tool | SIROS Foundation reusable workflows/actions |
| sirosfoundation/.github/actions/transifex-pull | feat/transifex-workflows | BSD-2-Clause | policy-override | siros-sdk-kotlin, siros-sdk-swift | SIROS Foundation reusable workflows/actions |
| sirosfoundation/.github/actions/transifex-push | feat/transifex-workflows | BSD-2-Clause | policy-override | siros-sdk-kotlin, siros-sdk-swift | SIROS Foundation reusable workflows/actions |
| sirosfoundation/mtcvctm | 1.. | BSD-2-Clause | policy-override | vc | SIROS Foundation reusable workflows/actions |
| sirosfoundation/siros-conformance/.github/actions/trigger-conformance | main | BSD-2-Clause | policy-override | go-trust, go-wallet-backend | SIROS Foundation reusable workflows/actions |
| softprops/action-gh-release | 3.. | MIT | policy-override | go-spocp, siros-sdk-swift, vc | Release actions — CI-only |
| softprops/action-gh-release | 2.. | MIT | policy-override | siros-sdk-kotlin | Release actions — CI-only |
| vladopajic/go-test-coverage | 2.. | MIT | policy-override | g119612, go-cryptoutil | go-test-coverage action — CI-only |
documentation (2 packages)
| Package | Version | License | Source | Repositories | Reason |
|---|---|---|---|---|---|
| caniuse-lite | 1.0.30001700 | CC-BY-4.0 | sbom | wallet-frontend | |
| github.com/opencontainers/go-digest | v1.0.0 | Apache-2.0 AND CC-BY-SA-4.0 | sbom | vc |
Last updated: 2026-09-10T06:47:21Z
License policy: sirosfoundation/compliance