Dependency maintenance policy
Changes to dependencies are reviewed through the protected pull-request process, including Dependabot updates. An available update is not an instruction to merge it. Keep runtime dependency changes separate from release and documentation work.
Sources and integrity
All third-party locked packages must resolve from https://pypi.org/simple.
Distribution URLs must use HTTPS on files.pythonhosted.org, with SHA-256 hashes
recorded in uv.lock. The only local editable package is Apizr itself at ..
Git dependencies, arbitrary indexes, direct URLs and additional local packages are
rejected by scripts/check_dependency_sources.py in the required dependency job.
A source exception requires an explicit policy change in a reviewed PR; there is
no automatic fallback index.
Export and audit the complete universal lock, including Python/platform variants, for runtime, development, documentation and security tooling. Findings and report collection failures block. Do not silently add ignored advisories. Preserve the reports and review the runtime and validation SBOMs when a graph changes.
Licenses and package selection
Before adding or changing a dependency, review its license and required notices at the selected version, its source, maintenance status, purpose and transitive cost. Record that review in the dependency PR. Preserve license/attribution files required for redistribution. Reject dependencies with no identified license or terms incompatible with the intended GPL-3.0-or-later distribution until a maintainer has resolved the issue and recorded the decision. Do not treat package metadata or an SBOM entry as a legal compatibility determination.
The required dependencies job runs scripts/check_dependency_licenses.py.
Its reviewed baseline covers all 138 third-party versions in the universal
lock, including platform alternatives and all four dependency groups:
policy/dependency-licenses.jsonrecords component expressions, review scope, notes, the exact evidence archive and its license-file hashes.policy/dependency-license-texts.jsonpreserves 196 distinct UTF-8 notice texts from 257 archive paths, including original line endings inside JSON strings.policy/dependency-policy.jsondefines the SPDX allowlist, version-specific exceptions and named-package denials with upstream references.
The gate rejects missing, duplicate, stale or pending reviews; any change to the
locked archive URL/hash set; missing or altered notice texts; unknown or denied
license expressions; unsubstantiated or stale exceptions; and denied package
names (including normalized spelling variants). AND requires every term; OR
permits a licensed choice. A WITH exception is allowed only as an explicitly
listed license/exception pair. Package metadata never grants automatic approval.
The denylist rejects the deprecated sklearn and removed tensorflow-gpu
installation placeholders. Their maintained replacements require ordinary
review; absence from this short denylist is not an approval. Vulnerability and
source checks remain separate, mandatory gates.
Scope and obligations
These decisions admit unmodified dependencies for Apizr's existing uses. Apizr's
wheel and sdist do not embed the dependency packages. The initial review
examined one hash-verified source archive per version, or one locked Windows
wheel for pywin32. Other wheel hashes are bound to the decision, but their
contents were not exhaustively inspected. This is not a file-level legal audit
or a complete inventory of native libraries, Cargo/npm dependencies, OS packages,
nested wheels or tools downloaded outside uv.lock.
| Component | Recorded obligation or limit |
|---|---|
| Python-derived code | Retain the complete historical Python notices, not just a PSF metadata label. |
| MPL packages and certifi data | Preserve notices and applicable source availability obligations; no automatic relicensing is asserted. |
| license-expression data | CC-BY-4.0 attribution; a separate, evidence-backed public-domain declaration for copied algorithm code. |
| Material theme assets | Distinct font/icon licenses and attribution; individual icon/brand restrictions still apply. |
| pywin32 | BSD/MIT/Python/Scintilla notices plus LGPL 2.1 for adodbapi; do not strip these or ignore source/relinking obligations. |
| Native and nested packages | cryptography, pyzmq, cffi, Rust extensions and virtualenv need an exact-content review before binary redistribution. |
The eight exceptions are confined to the named versions and preserved evidence; they do not globally allow these terms for arbitrary packages. Before publishing containers, vendoring dependencies, modifying third-party code or selecting new documentation assets, review the actual contents and meet their notice, source, attribution, font and trademark obligations. This gate alone does not authorize such distributions. The evidence includes unused upstream documentation and test-fixture notices; those are not silently treated as the package's license.
Review an update
- Update the dependency and universal lock in a dedicated PR.
- Collect candidate notices without installing or executing the package:
uv run --locked python scripts/collect_dependency_licenses.py \
--package example --output /tmp/example-license-candidate.json
- Read the archive notices and component terms. Resolve missing/ambiguous
licenses; identify copied code, data, fonts, native components and obligations.
The collector always writes
pendingand never edits approved policy. - Update the corresponding inventory, texts and any narrowly justified policy
exception. The distribution fingerprint is SHA-256 of the sorted URL/hash
set and source, as defined by
distribution_fingerprintin the checker. Remove obsolete entries. Never approve a new version solely by copying its predecessor's expression or by reading PyPI metadata. - Run the source and license checkers, dependency audit and normal PR checks. A protected PR records adoption of the review; this does not assert an independent legal certification or independent human review.
The package build archives policy, inventory, notice texts and their check report alongside the source, lock and SBOMs. The Security artifact also contains the license result and hashes of all inputs. They become part of release evidence.
References: SPDX expression syntax, Apache's GPLv3 compatibility guidance, Mozilla's license policy, sklearn deprecation and tensorflow-gpu removal.