From ea070e3b71f3fa020ef5e8abeccc701161c24a07 Mon Sep 17 00:00:00 2001 From: Konrad Heimel Date: Sat, 10 Oct 2026 16:15:56 +0200 Subject: [PATCH] :construction_worker: ci(deps): allow cairosvg's LGPL in dependency-review, scoped to the package cairosvg is a docs-site build tool (mkdocs-material[imaging]) and never reaches the kollect binary or image. Dependabot's 2.9.0 -> 2.9.1 bump (#457) tripped the licence allow-list because the action only judges changed dependencies; 2.9.0 was already on main under the same licence. --- .github/workflows/ci.yaml | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/.github/workflows/ci.yaml b/.github/workflows/ci.yaml index c66d49e6..7a38a1e6 100644 --- a/.github/workflows/ci.yaml +++ b/.github/workflows/ci.yaml @@ -217,7 +217,11 @@ jobs: # patent grant that every golang.org/x module ships and go-licenses reads as plain # BSD-3-Clause. Scoped to this one package, not the licence, so a new dependency # under that ref still has to be looked at. - allow-dependencies-licenses: pkg:golang/golang.org/x/net + # Second exception: cairosvg (LGPL-3.0-or-later) is a docs-site build tool only, pulled in + # by docs/requirements-docs.txt for mkdocs-material's image rendering. It never ships in + # the kollect binary or image, so the LGPL does not reach a release artefact. Scoped to + # the package for the same reason as above. + allow-dependencies-licenses: pkg:golang/golang.org/x/net, pkg:pypi/cairosvg verify: name: verify