From 816791710783256daca8e98c95837877eed8bccd Mon Sep 17 00:00:00 2001 From: Konrad Heimel Date: Fri, 13 Nov 2026 11:01:41 +0100 Subject: [PATCH] :construction_worker: ci: allow the MIT-0 cffi licence in dependency-review cffi 2.1.1 relicensed to MIT-0, which is more permissive than the allowed MIT. It is a cairosvg dependency of the docs-site build and never ships. Scoped to the package like the other exceptions. --- .github/workflows/ci.yaml | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/.github/workflows/ci.yaml b/.github/workflows/ci.yaml index 12a4510f..75ea39b5 100644 --- a/.github/workflows/ci.yaml +++ b/.github/workflows/ci.yaml @@ -232,7 +232,10 @@ jobs: # PATENTS ref as x/net above. certifi (MPL-2.0) is the CA bundle the docs-site build's # requests stack uses; docs only, never shipped. SonarSource/sonarqube-scan-action # (reported LGPL-3.0) is a CI-only action like setup-task. All scoped to the package. - allow-dependencies-licenses: pkg:golang/golang.org/x/net, pkg:golang/golang.org/x/sys, pkg:golang/golang.org/x/tools, pkg:pypi/cairosvg, pkg:pypi/certifi, pkg:githubactions/go-task/setup-task, pkg:githubactions/SonarSource/sonarqube-scan-action + # Added 2026-11-13: cffi 2.1.1 relicensed to MIT-0 (MIT without the attribution clause, + # so more permissive than the allowed MIT). It is a cairosvg dependency in the docs-site + # build; docs only, never shipped. Scoped to the package. + allow-dependencies-licenses: pkg:golang/golang.org/x/net, pkg:golang/golang.org/x/sys, pkg:golang/golang.org/x/tools, pkg:pypi/cairosvg, pkg:pypi/certifi, pkg:pypi/cffi, pkg:githubactions/go-task/setup-task, pkg:githubactions/SonarSource/sonarqube-scan-action verify: name: verify