From cd20e945bd9809745d4d872ae29dd2496b5a9644 Mon Sep 17 00:00:00 2001 From: James Maes Date: Sat, 10 Oct 2026 17:56:28 -0500 Subject: [PATCH] docs(exceptions): propose scoped AppKit tooling license review Record exact-version scope, observed license text, expiry and compensating controls without activating a caller exemption. Refs KofTwentyTwo/AppKit#26 Co-Authored-By: Codex (GPT-6) Signed-off-by: James Maes --- exceptions/register.md | 30 ++++++++++++++++++++++++++++++ 1 file changed, 30 insertions(+) diff --git a/exceptions/register.md b/exceptions/register.md index 0780ddc..661d4d5 100644 --- a/exceptions/register.md +++ b/exceptions/register.md @@ -13,6 +13,7 @@ Open and closed exceptions to the KofTwentyTwo standards. The process is in | [EX-0006](#ex-0006) | Open | K22-CI-16 (tag-only environment secrets) | standards | 2027-04-10; review 2027-01-10 | | [EX-0007](#ex-0007) | Closed | K22-REPO-12 (enrollment) | KofTwentyTwo/standards | Closed 2026-10-10 | | [EX-0008](#ex-0008) | Open | K22-CI-21 (HIGH dependency finding) | Website-Frontend, development-only braces 3.0.3 | 2026-11-10; review 2026-10-17 | +| [EX-0009](#ex-0009) | Proposed | K22-DEP-02 (license allowlist) | AppKit, development-only uri-js 4.4.1 | 2027-04-10; review 2027-01-10 | ## EX-0001 @@ -225,3 +226,32 @@ Open and closed exceptions to the KofTwentyTwo standards. The process is in - **Owner:** James Maes, repository maintainer. - **Review date:** 2026-10-17. Remove the consumer exception and close this entry once the affected dependency is replaced or patched. + +## EX-0009 + +**Proposed: AppKit ESLint's transitive BSD views license** + +- **Status:** Proposed; not effective until this register change is reviewed and merged. +- **Requirement:** `K22-DEP-02`, enforced by the reusable PR license allowlist. +- **Scope:** `KofTwentyTwo/AppKit` repository tooling only, `pkg:npm/uri-js@4.4.1` + from ESLint's Ajv dependency. It is development-only and ships in no AppKit package. +- **Reason:** hosted dependency review reports `BSD-2-Clause AND BSD-2-Clause-Views`, + while npm metadata says `BSD-2-Clause`. The installed 4.4.1 LICENSE matches the + [upstream text](https://github.com/garycourt/uri-js/blob/master/LICENSE), including + the views sentence. [SPDX](https://spdx.org/licenses/BSD-2-Clause-Views.html) + describes this as BSD-2-Clause with the added views-and-conclusions sentence. + Keeping ESLint preserves required checks of repository JavaScript and review code. +- **Risk:** the default automated license policy cannot accept this expression; + a manual decision could miss a license obligation. Source copyright, conditions, + disclaimer and views text must be preserved when redistributing this tool. +- **Compensating controls:** retain the locked dependency and full license; after + approval, exempt only that exact package version from license review. Every other + license, all development/runtime vulnerability checks, package signature verification + and SCA remain enforced. No shipped dependency gains an exemption. +- **Expires:** 2027-04-10, or when this dependency is removed or upgraded, whichever + comes first. Reassess the actual replacement version before extending the scope. +- **Owner:** KofTwentyTwo maintainer. **Review date:** 2027-01-10. +- **Evidence:** [AppKit #26](https://github.com/KofTwentyTwo/AppKit/issues/26) and + [failed dependency gate](https://github.com/KofTwentyTwo/AppKit/actions/runs/38093180805). + +Do not activate a caller exemption while this entry remains proposed. -- 2.54.0