docs(issues): add dependency license review specification - #2109
Merged
josecelano merged 2 commits intoAug 28, 2026
Conversation
josecelano
force-pushed
the
269-review-dependency-licenses
branch
from
August 28, 2026 11:33
a06e5a1 to
1489b56
Compare
There was a problem hiding this comment.
Pull request overview
This PR adds the source-of-truth issue specification and a preliminary technical assessment for a recurring dependency-license review process (Issue #269), documenting scope, evidence expectations, and initial high-risk findings without making legal compatibility conclusions.
Changes:
- Adds an issue-spec folder for #269 defining scope, decisions, acceptance criteria, and verification plan for a manual-first, twice-yearly license review.
- Adds a preliminary assessment artifact capturing current evidence sources, inventory commands, and notable license/metadata findings (including the direct
bloomGPL-2.0 dependency requiring qualified review). - Updates the project spellchecker dictionary to include
webpkifor the new documentation content.
Reviewed changes
Copilot reviewed 3 out of 3 changed files in this pull request and generated 1 comment.
| File | Description |
|---|---|
| project-words.txt | Adds webpki to the project word list to keep spellcheck clean for the new license-review docs. |
| docs/issues/open/269-review-dependency-licenses/ISSUE.md | Introduces the issue specification describing the intended manual dependency-license review process and tracking plan. |
| docs/issues/open/269-review-dependency-licenses/preliminary-assessment.md | Adds the preliminary, evidence-scoped technical triage and initial inventory notes for the dependency-license review. |
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
Member
Author
|
ACK 8f55c72 |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Adds the source-of-truth specification and preliminary technical assessment for the dependency-license review.
The preliminary assessment inventories the current resolved Cargo graph, records the evidence limits, and identifies the direct
bloomGPL-2.0 dependency as requiring qualified legal review. It does not make a legal compatibility conclusion.The approved specification establishes a manual-first, twice-yearly review process and defers any automated license-enforcement policy to a separate future issue.
Related to #269.