Software Bill of Materials (SBOM)

Inventory of third-party dependencies, open-source licenses, and downloadable CycloneDX SBOM for psLens.
Categories:

This page documents all third-party software components compiled into the psLens binary or embedded as client assets.

A machine-readable Software Bill of Materials in standard CycloneDX v1.6 format is generated automatically during the build process and is publicly accessible:

Download CycloneDX SBOM (JSON)

Licensing Posture

psLens uses only standard, permissively licensed open-source libraries.

  • Zero copyleft. There are no GPL, LGPL, AGPL, SSPL, or reciprocal licenses in the application.
  • Permissive licenses only. All runtime dependencies are licensed under Apache 2.0, MIT, BSD-2-Clause, BSD-3-Clause, or SIL Open Font License (OFL).
  • Safe for enterprise and on-premises deployment. Deploying or self-hosting psLens does not impose any requirement to disclose proprietary configuration, code, or schema.

Compiled Runtime Dependencies

The following external Go modules are compiled directly into the psLens server binary (cmd/server):

ModuleLicenseRepository
github.com/nats-io/nats-server/v2Apache-2.0nats-io/nats-server
github.com/nats-io/nats.goApache-2.0nats-io/nats.go
github.com/nats-io/jwt/v2Apache-2.0nats-io/jwt
github.com/nats-io/nkeysApache-2.0nats-io/nkeys
github.com/nats-io/nuidApache-2.0nats-io/nuid
github.com/starfederation/datastar-goMITstarfederation/datastar-go
github.com/a-h/templMITa-h/templ
github.com/gorilla/muxBSD-3-Clausegorilla/mux
github.com/yuin/goldmarkMITyuin/goldmark
github.com/alecthomas/chroma/v2MITalecthomas/chroma
github.com/coreos/go-oidc/v3Apache-2.0coreos/go-oidc
github.com/go-jose/go-jose/v4Apache-2.0go-jose/go-jose
github.com/modelcontextprotocol/go-sdkApache-2.0modelcontextprotocol/go-sdk
github.com/1password/onepassword-sdk-goMIT1password/onepassword-sdk-go
github.com/antchfx/xmlqueryMITantchfx/xmlquery
github.com/antchfx/xpathMITantchfx/xpath
github.com/tetratelabs/wazeroApache-2.0tetratelabs/wazero
github.com/tetratelabs/wabinApache-2.0tetratelabs/wabin
github.com/klauspost/compressApache-2.0klauspost/compress
github.com/andybalholm/brotliMITandybalholm/brotli
github.com/minio/highwayhashApache-2.0minio/highwayhash
github.com/dlclark/regexp2/v2MITdlclark/regexp2
github.com/gobwas/globMITgobwas/glob
gopkg.in/yaml.v3MITgo-yaml/yaml
google.golang.org/protobufBSD-3-Clauseprotocolbuffers/protobuf-go
golang.org/x/*BSD-3-Clausegolang.org/x

Embedded Frontend Assets

AssetVersionLicensePurpose
Bootstrap5.3.xMITCSS grid and UI styling
Bootstrap Icons1.11.xMITIcon set
Datastar (client JS)1.0.0MITSSE-driven UI interactivity
Highlight.js11.10.xBSD-3-ClauseClient-side syntax highlighting
Apache ECharts5.4.xApache-2.0Interactive metric charts
Inter Font5.0.xSIL OFL 1.1Typography

Automated Verification in CI

License compliance and dependency security are validated during the build and release process:

  • License policy enforcement: go-licenses check validates that every compiled package complies with permissive licensing before an image is tagged.
  • CVE vulnerability scanning: Go’s official govulncheck audits the dependency graph for known security vulnerabilities on every commit.
  • SBOM publishing: The CycloneDX SBOM (/sbom.json) is re-generated automatically as part of each documentation site build.