Skip to content

Add license exception for @img/sharp-libvips-linuxmusl-* due to LGPL-3.0-or-later #33

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
reedloden merged 1 commit into from
Jan 27, 2026
Merged

Add license exception for @img/sharp-libvips-linuxmusl-* due to LGPL-3.0-or-later #33

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
5 changes: 4 additions & 1 deletion .github/workflows/dependency-review.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -80,6 +80,7 @@ jobs:
# (https://github.com/clearlydefined/curated-data/pull/32066)
# npm/bignumber.js: ClearlyDefined error showing inaccurate license
# pypi/chardet: LGPL-2.1-or-later -- only approving as a one-off
# npm/@img/sharp*: LGPL-3.0-or-later -- only approving as a one-off; for local dev using claude code
allow-dependencies-licenses: >-
pkg:npm/@lancedb/lancedb,
pkg:npm/@lancedb/lancedb-darwin-arm64,
Expand All @@ -104,7 +105,9 @@ jobs:
pkg:maven/com.google.errorprone/error_prone_annotations,
pkg:npm/canvas,
pkg:npm/bignumber.js,
pkg:pypi/chardet
pkg:pypi/chardet,
pkg:npm/@img/sharp-libvips-linuxmusl-arm64,
pkg:npm/@img/sharp-libvips-linuxmusl-x64
Copy link

@cursor cursor bot Jan 27, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Missing platform variants for sharp license exceptions

Low Severity

The comment at line 83 says npm/@img/sharp* implying all sharp packages need license exceptions, but only two linuxmusl variants are added to allow-dependencies-licenses. The @img/sharp-libvips-* packages exist for multiple platforms (darwin-arm64, darwin-x64, linux-arm64, linux-x64, win32-x64, etc.) that all likely have the same LGPL-3.0-or-later license. The lancedb entry in this same file demonstrates the pattern of listing all platform variants. If the dependency review encounters non-linuxmusl variants in the lockfile, those would fail the license check.

Additional Locations (1)

Fix in Cursor Fix in Web


# Known vulnerabilities we're ok with ignoring.
# These are generally because they are in an older python kernel
Expand Down