📚 Third-party notices

Kwatch includes code from the third-party packages below. Kwatch does not relicense these packages; each package keeps the license shown in the table. The links point to the license or notice in the exact source revision used by the current go.mod/go.sum dependency graph.

This inventory was generated from the packages reachable by go-licenses and should be regenerated when dependencies change. Package-level entries are listed where a dependency contains a separately licensed fork or subpackage.

Apache-2.0

• github.com/go-logr/logr
• github.com/go-openapi/jsonpointer
• github.com/go-openapi/jsonreference
• github.com/go-openapi/swag and its subpackages
• github.com/google/gnostic-models
• github.com/modern-go/concurrent
• github.com/modern-go/reflect2
• go.yaml.in/yaml/v2
• k8s.io/api
• k8s.io/apimachinery
• k8s.io/client-go
• k8s.io/klog/v2
• k8s.io/kube-openapi
• k8s.io/utils
• sigs.k8s.io/json
• sigs.k8s.io/randfill
• sigs.k8s.io/structured-merge-diff/v6
• sigs.k8s.io/yaml

BSD-3-Clause

• github.com/ProtonMail/go-crypto
• github.com/bwmarrin/discordgo
• github.com/cloudflare/circl
• github.com/google/go-github/v55
• github.com/google/go-querystring
• github.com/google/uuid
• github.com/munnerz/goautoneg
• github.com/pmezard/go-difflib
• github.com/spf13/pflag
• golang.org/x/crypto
• golang.org/x/exp
• golang.org/x/net
• golang.org/x/oauth2
• golang.org/x/sys
• golang.org/x/term
• golang.org/x/text
• golang.org/x/time
• google.golang.org/protobuf
• gopkg.in/evanphx/json-patch.v4
• gopkg.in/inf.v0
• Kubernetes forked Go packages under third_party/forked retain their upstream BSD-3-Clause notices.

BSD-2-Clause

• github.com/gorilla/websocket
• github.com/slack-go/slack

MIT

• github.com/emicklei/go-restful/v3
• github.com/fxamacker/cbor/v2
• github.com/json-iterator/go
• github.com/robfig/cron/v3
• github.com/x448/float16
• go.yaml.in/yaml/v3
• gopkg.in/mail.v2
• gopkg.in/yaml.v3

ISC

• github.com/davecgh/go-spew

Notice handling

The full license text for each dependency is available at its linked source location. When a dependency is upgraded, the release owner must refresh this file and verify any newly introduced license before publishing the release.