# Software Bill of Materials (SBOM)

> Inventory of third-party dependencies, open-source licenses, and downloadable CycloneDX SBOM for psLens.

---

LLMS index: [llms.txt](/llms.txt)

---

This page documents all third-party software components compiled into the psLens binary or embedded as client assets.

A machine-readable Software Bill of Materials in standard CycloneDX v1.6 format is generated automatically during the build process and is publicly accessible:

<div class="my-4">
  <a class="btn btn-primary" href="/sbom.json" download="pslens-sbom.json">
    Download CycloneDX SBOM (JSON)
  </a>
</div>

---

## Licensing Posture

psLens uses only standard, permissively licensed open-source libraries.

- **Zero copyleft.** There are no GPL, LGPL, AGPL, SSPL, or reciprocal licenses in the application.
- **Permissive licenses only.** All runtime dependencies are licensed under Apache 2.0, MIT, BSD-2-Clause, BSD-3-Clause, or SIL Open Font License (OFL).
- **Safe for enterprise and on-premises deployment.** Deploying or self-hosting psLens does not impose any requirement to disclose proprietary configuration, code, or schema.

---

## Compiled Runtime Dependencies

The following external Go modules are compiled directly into the psLens server binary (`cmd/server`):

|                  Module                   |   License    |                                   Repository                                    |
| ----------------------------------------- | ------------ | ------------------------------------------------------------------------------- |
| `github.com/nats-io/nats-server/v2`       | Apache-2.0   | [nats-io/nats-server](https://github.com/nats-io/nats-server)                   |
| `github.com/nats-io/nats.go`              | Apache-2.0   | [nats-io/nats.go](https://github.com/nats-io/nats.go)                           |
| `github.com/nats-io/jwt/v2`               | Apache-2.0   | [nats-io/jwt](https://github.com/nats-io/jwt)                                   |
| `github.com/nats-io/nkeys`                | Apache-2.0   | [nats-io/nkeys](https://github.com/nats-io/nkeys)                               |
| `github.com/nats-io/nuid`                 | Apache-2.0   | [nats-io/nuid](https://github.com/nats-io/nuid)                                 |
| `github.com/starfederation/datastar-go`   | MIT          | [starfederation/datastar-go](https://github.com/starfederation/datastar-go)     |
| `github.com/a-h/templ`                    | MIT          | [a-h/templ](https://github.com/a-h/templ)                                       |
| `github.com/gorilla/mux`                  | BSD-3-Clause | [gorilla/mux](https://github.com/gorilla/mux)                                   |
| `github.com/yuin/goldmark`                | MIT          | [yuin/goldmark](https://github.com/yuin/goldmark)                               |
| `github.com/alecthomas/chroma/v2`         | MIT          | [alecthomas/chroma](https://github.com/alecthomas/chroma)                       |
| `github.com/coreos/go-oidc/v3`            | Apache-2.0   | [coreos/go-oidc](https://github.com/coreos/go-oidc)                             |
| `github.com/go-jose/go-jose/v4`           | Apache-2.0   | [go-jose/go-jose](https://github.com/go-jose/go-jose)                           |
| `github.com/modelcontextprotocol/go-sdk`  | Apache-2.0   | [modelcontextprotocol/go-sdk](https://github.com/modelcontextprotocol/go-sdk)   |
| `github.com/1password/onepassword-sdk-go` | MIT          | [1password/onepassword-sdk-go](https://github.com/1password/onepassword-sdk-go) |
| `github.com/antchfx/xmlquery`             | MIT          | [antchfx/xmlquery](https://github.com/antchfx/xmlquery)                         |
| `github.com/antchfx/xpath`                | MIT          | [antchfx/xpath](https://github.com/antchfx/xpath)                               |
| `github.com/tetratelabs/wazero`           | Apache-2.0   | [tetratelabs/wazero](https://github.com/tetratelabs/wazero)                     |
| `github.com/tetratelabs/wabin`            | Apache-2.0   | [tetratelabs/wabin](https://github.com/tetratelabs/wabin)                       |
| `github.com/klauspost/compress`           | Apache-2.0   | [klauspost/compress](https://github.com/klauspost/compress)                     |
| `github.com/andybalholm/brotli`           | MIT          | [andybalholm/brotli](https://github.com/andybalholm/brotli)                     |
| `github.com/minio/highwayhash`            | Apache-2.0   | [minio/highwayhash](https://github.com/minio/highwayhash)                       |
| `github.com/dlclark/regexp2/v2`           | MIT          | [dlclark/regexp2](https://github.com/dlclark/regexp2)                           |
| `github.com/gobwas/glob`                  | MIT          | [gobwas/glob](https://github.com/gobwas/glob)                                   |
| `gopkg.in/yaml.v3`                        | MIT          | [go-yaml/yaml](https://github.com/go-yaml/yaml)                                 |
| `google.golang.org/protobuf`              | BSD-3-Clause | [protocolbuffers/protobuf-go](https://github.com/protocolbuffers/protobuf-go)   |
| `golang.org/x/*`                          | BSD-3-Clause | [golang.org/x](https://golang.org/x)                                            |

---

## Embedded Frontend Assets

|        Asset         | Version |   License    |             Purpose             |
| -------------------- | ------- | ------------ | ------------------------------- |
| Bootstrap            | 5.3.x   | MIT          | CSS grid and UI styling         |
| Bootstrap Icons      | 1.11.x  | MIT          | Icon set                        |
| Datastar (client JS) | 1.0.0   | MIT          | SSE-driven UI interactivity     |
| Highlight.js         | 11.10.x | BSD-3-Clause | Client-side syntax highlighting |
| Apache ECharts       | 5.4.x   | Apache-2.0   | Interactive metric charts       |
| Inter Font           | 5.0.x   | SIL OFL 1.1  | Typography                      |

---

## Automated Verification in CI

License compliance and dependency security are validated during the build and release process:

- **License policy enforcement:** `go-licenses check` validates that every compiled package complies with permissive licensing before an image is tagged.
- **CVE vulnerability scanning:** Go's official `govulncheck` audits the dependency graph for known security vulnerabilities on every commit.
- **SBOM publishing:** The CycloneDX SBOM (`/sbom.json`) is re-generated automatically as part of each documentation site build.