OpenClearEverything OpenClear is built from that someone else wrote, with its version, license and what it's for. It comes from the same sources as each release's CycloneDX SBOM (openclear-<version>.cdx.json on the GitHub release), so the two agree. The license texts and copyright notices are in THIRD_PARTY_NOTICES.md, which is also in the image beside LICENSE.
OpenClear itself is licensed under the GNU AGPL 3.0 or later.
In the image: Python packages (104)
Installed from the hashed lock requirements/runtime.txt and nothing else.
| Package | Version | License | Used |
|---|---|---|---|
| aiohappyeyeballs | 2.7.1 | PSF-2.0 | for aiohttp |
| aiohttp | 3.14.5 | Apache-2.0 AND MIT | for aiohttp-retry, twilio |
| aiohttp-retry | 2.9.1 | MIT | for twilio |
| aiosignal | 1.4.0 | Apache-2.0 | for aiohttp |
| alembic | 1.20.1 | MIT | OpenClear |
| annotated-doc | 0.0.5 | MIT | for fastapi |
| annotated-types | 0.8.0 | MIT | for pydantic |
| anyio | 4.15.1 | MIT | for httpx, starlette, watchfiles |
| apscheduler | 3.11.3 | MIT | OpenClear |
| attrs | 26.1.0 | MIT | for aiohttp |
| authlib | 1.9.1 | BSD-3-Clause | OpenClear |
| azure-ai-documentintelligence | 1.0.2 | MIT | OpenClear |
| azure-core | 1.41.0 | MIT | for azure-ai-documentintelligence, azure-identity, azure-storage-blob |
| azure-identity | 1.26.0 | MIT | OpenClear |
| azure-storage-blob | 12.31.0 | MIT | OpenClear |
| bcrypt | 5.0.0 | Apache-2.0 | OpenClear |
| boto3 | 1.43.118 | Apache-2.0 | OpenClear |
| botocore | 1.43.118 | Apache-2.0 | for boto3, s3transfer |
| brotli | 1.2.1 | MIT | for fonttools |
| cbor2 | 6.1.5 | MIT | for webauthn |
| certifi | 2026.10.23 | MPL-2.0 | for httpcore, httpx, requests |
| cffi | 2.1.1 | MIT-0 | for brotlicffi, cryptography, weasyprint |
| charset-normalizer | 3.5.2 | MIT | for requests |
| click | 8.5.0 | BSD-3-Clause | for uvicorn |
| cloudpickle | 3.1.2 | BSD-3-Clause | for joblib |
| cryptography | 50.0.2 | Apache-2.0 OR BSD-3-Clause | OpenClear |
| cssselect2 | 0.10.1 | BSD | for weasyprint |
| dnspython | 2.9.0 | ISC | for email-validator |
| email-validator | 2.3.0 | Unlicense | OpenClear |
| et-xmlfile | 2.0.0 | MIT | for openpyxl |
| fastapi | 0.162.0 | MIT | OpenClear |
| fonttools | 4.67.0 | MIT | for weasyprint |
| frozenlist | 1.8.0 | Apache-2.0 | for aiohttp, aiosignal |
| h11 | 0.16.0 | MIT | for httpcore, uvicorn |
| httpcore | 1.0.9 | BSD-3-Clause | for httpx |
| httptools | 0.9.0 | MIT | for uvicorn |
| httpx | 0.28.1 | BSD-3-Clause | OpenClear |
| idna | 3.20 | BSD-3-Clause | for anyio, email-validator, httpx, requests, yarl |
| isodate | 0.7.2 | BSD | for azure-ai-documentintelligence, azure-storage-blob, python3-saml |
| jinja2 | 3.1.6 | BSD | OpenClear |
| jmespath | 1.1.0 | MIT | for boto3, botocore |
| joblib | 1.6.0 | BSD-3-Clause | OpenClear |
| joserfc | 1.7.7 | BSD-3-Clause | for authlib |
| lxml | 6.1.3 | BSD-3-Clause | for python3-saml, xmlsec |
| mako | 1.4.3 | MIT | for alembic |
| markdown | 3.11.2 | BSD-3-Clause | OpenClear |
| markupsafe | 3.0.4 | BSD-3-Clause | for jinja2, mako |
| msal | 1.39.0 | MIT | for azure-identity, msal-extensions |
| msal-extensions | 1.3.1 | MIT | for azure-identity |
| multidict | 7.2.1 | Apache-2.0 | for aiohttp, yarl |
| narwhals | 2.27.1 | MIT | for scikit-learn |
| nh3 | 0.3.7 | MIT | OpenClear |
| numpy | 2.5.4 | BSD-3-Clause AND 0BSD AND MIT AND Zlib AND CC0-1.0 | OpenClear |
| openpyxl | 3.1.5 | MIT | OpenClear |
| opentelemetry-api | 1.45.1 | Apache-2.0 | for fastapi |
| packaging | 26.3 | Apache-2.0 OR BSD-2-Clause | for pytesseract |
| pandas | 3.1.0 | BSD-3-Clause | OpenClear |
| pillow | 13.0.0 | MIT-CMU | OpenClear |
| propcache | 0.5.4 | Apache-2.0 | for aiohttp, yarl |
| psycopg | 3.3.6 | LGPL-3.0-only | OpenClear |
| psycopg-binary | 3.3.6 | LGPL-3.0-only | for psycopg |
| pyasn1 | 0.6.5 | BSD-2-Clause | for pyasn1-modules, webauthn |
| pyasn1-modules | 0.4.2 | BSD | for webauthn |
| pycparser | 3.12 | BSD-3-Clause | for cffi |
| pydantic | 2.14.1 | MIT | OpenClear |
| pydantic-core | 2.50.1 | MIT | for pydantic |
| pydantic-settings | 2.16.1 | MIT | OpenClear |
| pydyf | 0.13.0 | BSD | for weasyprint |
| pyjwt | 2.15.1 | MIT | OpenClear |
| pyopenssl | 26.4.0 | Apache-2.0 | for webauthn |
| pyphen | 0.18.1 | GPL-2.0-or-later OR LGPL-2.0-or-later OR MPL-1.1 | for weasyprint |
| pytesseract | 0.3.13 | Apache-2.0 | OpenClear |
| python-dateutil | 2.9.0.post0 | BSD OR Apache-2.0 | for botocore, pandas |
| python-dotenv | 1.2.4 | BSD-3-Clause | for pydantic-settings, uvicorn |
| python-multipart | 0.0.32 | Apache-2.0 | OpenClear |
| python3-saml | 1.16.0 | MIT | OpenClear |
| pyyaml | 6.0.3 | MIT | for uvicorn |
| rapidfuzz | 3.14.6 | MIT | OpenClear |
| redis | 8.1.0 | MIT | OpenClear |
| requests | 2.34.2 | Apache-2.0 | for azure-core, msal, twilio |
| s3transfer | 0.19.3 | Apache-2.0 | for boto3 |
| scikit-learn | 1.9.1 | BSD-3-Clause | OpenClear |
| scipy | 1.18.1 | BSD | for scikit-learn |
| six | 1.17.0 | MIT | for python-dateutil |
| sqlalchemy | 2.1.6 | MIT | OpenClear |
| starlette | 1.10.0 | BSD-3-Clause | for fastapi |
| threadpoolctl | 3.7.0 | BSD-3-Clause | for scikit-learn |
| tinycss2 | 1.5.1 | BSD | for cssselect2, weasyprint |
| tinyhtml5 | 2.1.0 | MIT | for weasyprint |
| twilio | 9.12.0 | MIT | OpenClear |
| typing-extensions | 4.16.0 | PSF-2.0 | for aiohttp, aiosignal, alembic, anyio, azure-ai-documentintelligence, azure-core, azure-identity, azure-storage-blob, fastapi, opentelemetry-api, psycopg, pydantic, pydantic-core, pydantic-settings, pyopenssl, sqlalchemy, starlette, typing-inspection |
| typing-inspection | 0.4.4 | MIT | for fastapi, pydantic, pydantic-settings |
| tzlocal | 5.4.5 | MIT | for apscheduler |
| urllib3 | 2.8.0 | MIT | for botocore, requests |
| uvicorn | 0.54.0 | BSD-3-Clause | OpenClear |
| uvloop | 0.23.0 | MIT | for uvicorn |
| watchfiles | 1.3.0 | MIT | for uvicorn |
| weasyprint | 70.0 | BSD | OpenClear |
| webauthn | 3.0.1 | BSD-3-Clause | OpenClear |
| webencodings | 0.6.1 | BSD | for cssselect2, tinycss2, tinyhtml5 |
| websockets | 17.3 | BSD-3-Clause | for uvicorn |
| xmlsec | 1.3.17 | MIT | for python3-saml |
| yarl | 1.25.1 | Apache-2.0 | for aiohttp |
| zopfli | 0.4.3 | Apache-2.0 | for fonttools |
The lock also names these for other Python versions or platforms; the image (Python 3.13 on Linux) doesn't install them: async-timeout 5.0.1, brotlicffi 1.2.1.0, numpy 2.4.6, scipy 1.17.1, tzdata 2026.5.
In the web pages: vendored files
Served from src/openclear/static/, checked against their SHA-256 in requirements/vendored.json.
| Component | Kind | Version | License | Used for |
|---|---|---|---|---|
| mermaid | JavaScript | 11.16.0 | MIT | Diagrams in the documentation pages |
| svg-pan-zoom | JavaScript | 3.6.2 | BSD-2-Clause | Panning and zooming those diagrams |
| Material Symbols (Outlined) | Icons | 2026-10-20 | Apache-2.0 | Every icon in the interface, combined into one sprite by scripts/fetch_material_icons.py (unversioned upstream; the version is the day they were fetched) |
In the image: the operating system
The base image and the system packages the image adds. Each Debian package's own copyright file is in the image at /usr/share/doc/<package>/copyright; each release's image SBOM lists every package in it.
| Package | License | Used for |
|---|---|---|
| python:3.13-slim | PSF-2.0 (Python); Debian packages under their own licenses | The base image: Debian and CPython |
| tesseract-ocr | Apache-2.0 | Reading check images on the server (OCR) |
| libpango-1.0-0 | LGPL-2.1-or-later | Text layout for PDF export (WeasyPrint) |
| libpangocairo-1.0-0 | LGPL-2.1-or-later | Text layout for PDF export (WeasyPrint) |
| libcairo2 | LGPL-2.1-only OR MPL-1.1 | Drawing for PDF export (WeasyPrint) |
| libgdk-pixbuf-2.0-0 | LGPL-2.1-or-later | Images in PDF export (WeasyPrint) |
| libpq5 | PostgreSQL | Connecting to Postgres (psycopg) |
In the SDKs
Each SDK is licensed Apache-2.0. Runtime packages are installed with an SDK; development ones only build and test it.
| SDK | Package | Version | License | Kind |
|---|---|---|---|---|
| Python | httpx | >=0.27 | BSD-3-Clause | Runtime |
| TypeScript | @types/node | 26.6.5 | MIT | Development |
| TypeScript | @typescript/typescript- |
7.0.2 | Apache-2.0 | Development |
| TypeScript | typescript | 7.0.2 | Apache-2.0 | Development |
| TypeScript | undici-types | 8.9.0 | MIT | Development |
| Embed (TypeScript) | @types/node | 26.6.5 | MIT | Development |
| Embed (TypeScript) | @typescript/typescript- |
7.0.2 | Apache-2.0 | Development |
| Embed (TypeScript) | typescript | 7.0.2 | Apache-2.0 | Development |
| Embed (TypeScript) | undici-types | 8.9.0 | MIT | Development |
| .NET | Microsoft.NET.Test.Sdk | 18.11.0 | MIT | Development |
| .NET | xunit | 2.9.3 | Apache-2.0 | Development |
| .NET | xunit.runner.visualstudio | 4.0.1 | Apache-2.0 | Development |
Used only for development and tests (80)
In requirements/dev.txt and not in the image: the test suite, the browser checks, linting the docs and building the docs site.
| Package | Version | License |
|---|---|---|
| arrow | 1.4.0 | Apache-2.0 |
| babel | 2.18.0 | BSD-3-Clause |
| backrefs | 8.1 | MIT |
| bandit | 1.9.4 | Apache-2.0 |
| boolean-py | 5.0 | BSD-2-Clause |
| cachecontrol | 0.14.4 | Apache-2.0 |
| chardet | 7.7.0 | 0BSD |
| colorama | 0.4.6 | BSD |
| coverage | 7.17.0 | Apache-2.0 |
| cyclonedx-bom | 7.5.0 | Apache-2.0 |
| cyclonedx-python-lib | 11.12.0 | Apache-2.0 |
| defusedxml | 0.7.1 | PSF-2.0 |
| execnet | 2.1.2 | MIT |
| factory-boy | 3.3.3 | MIT |
| faker | 40.43.0 | MIT |
| fakeredis | 2.40.0 | BSD-3-Clause |
| filelock | 4.2.4 | MIT |
| fqdn | 1.6.0 | MPL-2.0 |
| ghp-import | 2.1.0 | Apache-2.0 |
| greenlet | 3.5.6 | MIT AND PSF-2.0 |
| iniconfig | 2.3.1 | MIT |
| isoduration | 20.11.0 | ISC |
| jschema-to-python | 1.2.3 | MIT |
| jsonpickle | 4.1.4 | BSD-3-Clause |
| jsonpointer | 3.5 | BSD-3-Clause |
| jsonschema | 4.26.0 | MIT |
| jsonschema-specifications | 2025.9.1 | MIT |
| lark | 1.3.1 | MIT |
| license-expression | 30.4.4 | Apache-2.0 |
| lupa | 2.8 | MIT style |
| markdown-it-py | 4.2.0 | MIT |
| mdurl | 0.1.2 | MIT |
| mergedeep | 1.3.4 | MIT |
| mkdocs | 1.6.1 | BSD-2-Clause |
| mkdocs-get-deps | 0.2.2 | MIT |
| mkdocs-material | 9.8.0 | MIT |
| mkdocs-material-extensions | 1.3.1 | MIT |
| moto | 5.2.4 | Apache-2.0 |
| msgpack | 1.2.3 | Apache-2.0 |
| packageurl-python | 0.17.6 | MIT |
| paginate | 0.5.7 | MIT |
| pathspec | 1.1.1 | MPL-2.0 |
| pbr | 7.1.3 | Apache-2.0 |
| pip | 26.2.2 | MIT |
| pip-api | 0.0.35 | Apache-2.0 |
| pip-audit | 2.10.1 | Apache-2.0 |
| pip-requirements-parser | 32.0.1 | MIT |
| platformdirs | 4.13.5 | MIT |
| playwright | 1.64.1 | Apache-2.0 |
| pluggy | 1.7.0 | MIT |
| py-partiql-parser | 0.6.3 | MIT |
| py-serializable | 2.1.0 | Apache-2.0 |
| pyee | 14.0.0 | MIT |
| pygments | 2.21.0 | BSD-2-Clause |
| pymdown-extensions | 12.3 | MIT |
| pyparsing | 3.3.3 | MIT |
| pytest | 9.1.1 | MIT |
| pytest-cov | 7.1.0 | MIT |
| pytest-xdist | 3.8.0 | MIT |
| pytm | 1.4.0 | MIT |
| pyyaml-env-tag | 1.1 | MIT |
| referencing | 0.37.0 | MIT |
| responses | 0.26.3 | Apache-2.0 |
| rfc3339-validator | 0.1.4 | MIT |
| rfc3986-validator | 0.1.1 | MIT |
| rfc3987-syntax | 1.1.0 | MIT |
| rich | 15.0.0 | MIT |
| rpds-py | 2026.9.1 | MIT |
| sarif-om | 1.0.4 | MIT |
| setuptools | 84.2.1 | MIT |
| sortedcontainers | 2.4.0 | Apache-2.0 |
| stevedore | 5.9.1 | Apache-2.0 |
| tomli | 2.5.0 | MIT |
| tomli-w | 1.2.0 | MIT |
| uri-template | 1.3.0 | MIT |
| uv | 0.13.5 | MIT OR Apache-2.0 |
| watchdog | 6.0.0 | Apache-2.0 |
| webcolors | 25.10.0 | BSD-3-Clause |
| werkzeug | 3.1.9 | BSD-3-Clause |
| xmltodict | 1.0.4 | MIT |
Built from docs/compliance/third-party.md in the OpenClear repository. Last changed October 31, 2026.