{"object":"license_matrix","matrix_version":"2026-07-14","spdx_snapshot_version":"3.28.0","spdx_snapshot_generated":"2026-02-20T00:00:00Z","classified_licenses":727,"class_census":{"network-copyleft":16,"permissive":205,"strong-copyleft":21,"unknown":446,"weak-copyleft":39},"copyleft_classes":["permissive","weak-copyleft","strong-copyleft","network-copyleft","proprietary","unknown"],"verdicts":["safe","attribution-required","copyleft-risk","incompatible"],"distributions":["saas","binary","internal"],"distribution_default":"saas","ecosystems":["npm","pypi","go","maven","cargo","nuget"],"explicit_incompatible_pairs":[{"dependency":"gpl-2.0-only","target":"apache-2.0"},{"dependency":"apache-2.0","target":"gpl-2.0-only"},{"dependency":"gpl-3.0-only","target":"gpl-2.0-only"},{"dependency":"gpl-2.0-only","target":"gpl-3.0-only"},{"dependency":"epl-1.0","target":"gpl-2.0-only"},{"dependency":"epl-2.0","target":"gpl-2.0-only"},{"dependency":"cddl-1.0","target":"gpl-2.0-only"}],"linking_exceptions":["Autoconf-exception-3.0","Bison-exception-2.2","Classpath-exception-2.0","Font-exception-2.0","GCC-exception-2.0","GCC-exception-3.1","LLVM-exception","OCaml-LGPL-linking-exception","u-boot-exception-2.0"],"matrix_summary":{"saas":"network-copyleft (AGPL/SSPL) triggers on network use; GPL/LGPL/MPL and permissive do not (no distribution)","binary":"strong copyleft (GPL) contaminates the whole conveyed work; weak copyleft needs isolation; permissive needs attribution","internal":"no distribution and no external users — obligations are dormant"},"sources":[{"id":"deps.dev","host":"api.deps.dev","role":"transitive dependency graph + per-version declared SPDX license","license":"Google Open Source Insights (deps.dev) — open data, keyless.","attribution":"Dependency graph & licenses: deps.dev (Google Open Source Insights)."},{"id":"clearlydefined","host":"api.clearlydefined.io","role":"fallback declared license when deps.dev reports none / NOASSERTION","license":"ClearlyDefined — open, community-curated definitions.","attribution":"Fallback licenses: ClearlyDefined (clearlydefined.io)."},{"id":"spdx","host":"spdx.org","role":"SPDX License List (id -> name / OSI / FSF flags), slim offline snapshot","license":"SPDX License List — CC0-1.0.","attribution":"License identifiers & metadata: SPDX License List (spdx.org)."}],"note":"Transparency into the encoded FSF/OSI copyleft-compatibility matrix + SPDX snapshot the paid /license/* routes fuse against. The moat is the transitive tree + the target-and-distribution-aware verdict, not a license-field resale.","disclaimer":"Automated license-compliance INDICATORS derived from public dependency-graph and license metadata (deps.dev, ClearlyDefined, SPDX) fused with an encoded FSF/OSI compatibility matrix. This is NOT legal advice and NOT a guarantee: declared licenses can be wrong or incomplete, and copyleft/patent obligations depend on how you actually use and distribute the code. Verify against the authoritative license texts and consult a qualified attorney before relying on this for a release, acquisition, or compliance decision."}