Spaces:
Build error
Third-Party Notices
BharatGraph is licensed under the MIT License (see LICENSE). This project
depends on a number of third-party open-source packages and, for the
optional PDF-export feature, a set of native system libraries. Their
licenses are listed below.
This file resolves two items flagged by the industry-grade repository audit
(August 2026): Finding Lic-1 (fake-useragent's license, previously
unverified) and Finding D-7 (no NOTICE/attribution file existed anywhere
in the repository, required before any installer bundling these
dependencies directly ships).
Scope note: this file is a licensing inventory, current as of the
audit date above. It establishes what's bundled and under what terms --
it does not by itself complete every packaging-time compliance step (in
particular, the LGPL "user can relink" requirement discussed under Pango,
Cairo, and GDK-Pixbuf below is a distribution-mechanism decision, not a
paperwork one, and needs to be revisited once an actual Windows installer
pipeline is chosen -- see PHASE_ROADMAP.md's desktop-migration track).
Direct Python dependencies (requirements.txt)
Verified individually via each package's own PyPI metadata, official
repository, or (for fake-useragent) its pyproject.toml directly, not
assumed from memory.
| Package | License | Copyleft? | Note |
|---|---|---|---|
| requests | Apache-2.0 | No | |
| beautifulsoup4 | MIT | No | |
| feedparser | BSD-2-Clause | No | |
| lxml | BSD-3-Clause | No | |
| fake-useragent | Apache-2.0 | No | Resolved (Lic-1): confirmed via the project's own pyproject.toml (license = "Apache-2.0"), corroborated independently by conda-forge's feedstock metadata. The audit's automated PyPI/GitHub metadata check returned empty at the time -- the SPDX license identifier was added to the package's own pyproject.toml relatively recently (see its "Add SPDX license identifier" changelog entry), which explains the earlier miss. |
| pandas | BSD-3-Clause | No | |
| numpy | BSD-3-Clause | No | |
| scipy | BSD-3-Clause | No | |
| neo4j (driver) | Apache-2.0 | No | |
| networkx | BSD-3-Clause | No | |
| fastapi | MIT | No | |
| uvicorn | BSD-3-Clause | No | |
| python-dotenv | BSD-3-Clause | No | |
| jinja2 | BSD-3-Clause | No | |
| spacy | MIT | No | Ships a separately-licensed model -- see below |
| sentence-transformers | Apache-2.0 | No | Ships separately-licensed models -- see below |
| weasyprint | BSD-3-Clause | No, but see below | The Python package itself is BSD-3-Clause; its native rendering dependencies are not -- see the dedicated section below |
| pdfplumber | MIT | No | |
| loguru | MIT | No | |
| schedule | MIT | No |
Bundled AI models
Following the model_selector tiering fix (Findings R-2/R-3/R-4), each of
these tasks can now load any of its three tier variants depending on the
detected hardware profile, not just one fixed model -- all three variants
per task are listed below, not just the one previously hardcoded.
| Model | Used by | Tier | License |
|---|---|---|---|
xx_ent_wiki_sm |
ai/nlp_extractor.py (NER) |
low | MIT, per its own model card / spacy-models release metadata |
en_core_web_sm |
ai/nlp_extractor.py (NER) |
medium (and the guaranteed fallback on low/high if the tier-specific model isn't installed) | MIT, matching the spaCy models project's stated license |
en_core_web_trf |
ai/nlp_extractor.py (NER) |
high | MIT, per its own model card / spacy-models release metadata |
paraphrase-MiniLM-L3-v2 |
ai/shadow_draft_detector.py, processing/entity_resolver_v2.py (embeddings) |
low | Apache-2.0, per its model card |
all-MiniLM-L6-v2 |
ai/shadow_draft_detector.py, processing/entity_resolver_v2.py (embeddings) |
medium | Apache-2.0, per its model card |
paraphrase-multilingual-MiniLM-L12-v2 |
ai/shadow_draft_detector.py, processing/entity_resolver_v2.py (embeddings) |
high | Apache-2.0, per its model card |
None of the six introduces a copyleft obligation.
Frontend JavaScript dependencies (vendored files)
| File | Package / version | License | Source | Note |
|---|---|---|---|---|
frontend/js/vendor/d3.min.js |
d3 7.9.0 |
ISC (Copyright 2010-2023 Mike Bostock) | https://registry.npmjs.org/d3/-/d3-7.9.0.tgz, dist/d3.min.js |
Resolves Finding N-2/F-14: previously loaded from cdnjs.cloudflare.com with no working offline fallback (window._d3Failed was set on load failure but never read anywhere). Vendored locally instead -- same exact version as the CDN reference it replaces, so no API-compatibility change. SHA-256 of the vendored file: f2094bbf6141b359722c4fe454eb6c4b0f0e42cc10cc7af921fc158fceb86539. ISC is a permissive license functionally equivalent to MIT/BSD-2-Clause -- requires only that the copyright/permission notice (above) be preserved; this file's own header comment already carries it (// https://d3js.org v7.9.0 Copyright 2010-2023 Mike Bostock). No copyleft obligation. |
WeasyPrint's native rendering stack (only relevant if PDF export is bundled into a distributable installer)
WeasyPrint (the Python package) depends on native C libraries it does not
itself provide. In the current Docker-based web deployment, these are
installed via apt-get at container-build time -- dynamically linking
against system-provided libraries this way does not trigger the
source-availability obligations that statically bundling them into a
distributed installer would. That distinction is why this section
exists: it becomes a live compliance question the moment a desktop
installer vendors these libraries directly, per PHASE_ROADMAP.md's
D2/D3 packaging phases.
Licenses below verified individually against each project's own
authoritative source (its repository's COPYING file or, where the
project publishes one, its official license page) -- not assumed to be
uniform across the group, which turns out to matter: HarfBuzz is not
LGPL, despite being part of the same rendering pipeline as three libraries
that are.
| Library | License | Verified via | LGPL relink obligation applies? |
|---|---|---|---|
| Pango | LGPL v2.1 (or later) | Pango's own COPYING file (GNOME/pango repository) |
Yes |
| Cairo | LGPL v2.1 or MPL v1.1 (dual-licensed, redistributor's choice) | Cairo's own licensing documentation | Yes, if the LGPL branch is chosen (or MPL's equivalent terms if that branch is chosen instead) |
| GDK-Pixbuf | LGPL-2.1-or-later | Package metadata (matches upstream GTK project licensing) | Yes |
| HarfBuzz | MIT ("Old MIT" license) -- not LGPL | HarfBuzz's own COPYING file (harfbuzz/harfbuzz repository) |
No -- MIT only requires the license text and copyright notice to be included, not a relink mechanism |
What the LGPL relink obligation actually means for a bundled installer:
for Pango, Cairo (if the LGPL option is used), and GDK-Pixbuf specifically,
the LGPL requires that an end user be able to replace or relink the
LGPL-licensed component with a modified version of their own -- typically
satisfied for a Windows installer by shipping these as separate, replaceable
.dll files rather than statically linking them into a single monolithic
executable, plus including the LGPL license text and a notice of which
files it covers (this file, updated at packaging time, can serve as that
notice). This has not been implemented or verified against any actual
installer build -- no Windows/PyInstaller build has been executed in this
project as of this writing (see PHASE_ROADMAP.md) -- and needs a real
compliance pass once a specific installer pipeline exists, not just this
inventory.
Sources checked, not assumed
Every license above was verified against the dependency's own
authoritative metadata or source repository at the time this file was
written (August 2026). Licenses for actively-maintained open-source
packages can change between major versions; if any dependency in
requirements.txt is upgraded to a new major version, re-verify its
license before assuming this file still applies unchanged.