diff --git a/.github/workflows/dependency-review.yml b/.github/workflows/dependency-review.yml index 62856f6..54f8203 100644 --- a/.github/workflows/dependency-review.yml +++ b/.github/workflows/dependency-review.yml @@ -50,16 +50,20 @@ jobs: CC0-1.0, EPL-2.0, ISC, - LicenseRef-scancode-public-domain, LicenseRef-scancode-generic-cla, + LicenseRef-scancode-protobuf, + LicenseRef-scancode-public-domain, + LicenseRef-scancode-us-govt-public-domain, MIT, MIT-0, MPL-2.0, + OFL-1.1, PSF-2.0, Python-2.0, Python-2.0.1, Unlicense, WTFPL, + ZPL-2.1, Zlib # npm/@lancedb/lancedb*: Temporary addition due to upstream non-compliance with SPDX @@ -81,6 +85,9 @@ jobs: # npm/bignumber.js: ClearlyDefined error showing inaccurate license # pypi/chardet: LGPL-2.1-or-later -- only approving as a one-off # npm/@img/sharp*: LGPL-3.0-or-later -- only approving as a one-off; for local dev using claude code + # pypi/psycopg2: LGPL-2.0-or-later AND LGPL-3.0-or-later -- only approving as a one-off + # pypi/shapely: LGPL-2.1-only -- only approving as a one-off + # pypi/typing-extensions: License detection is wrong (not GPL) allow-dependencies-licenses: >- pkg:npm/@lancedb/lancedb, pkg:npm/@lancedb/lancedb-darwin-arm64, @@ -107,7 +114,10 @@ jobs: pkg:npm/bignumber.js, pkg:pypi/chardet, pkg:npm/@img/sharp-libvips-linuxmusl-arm64, - pkg:npm/@img/sharp-libvips-linuxmusl-x64 + pkg:npm/@img/sharp-libvips-linuxmusl-x64, + pkg:pypi/psycopg2, + pkg:pypi/shapely, + pkg:pypi/typing-extensions # Known vulnerabilities we're ok with ignoring. # These are generally because they are in an older python kernel