Third-party notices¶
This document lists the third-party software and data that LUC Analytics ships or bundles.
The project's own code is licensed under Apache-2.0 (see LICENSE); NOTICE states its provenance.
Each entry below was ground-truth verified against the dependency's own installed license text
(Python: .dist-info METADATA + license files; Web: web/node_modules/<pkg>/LICENSE*).
Python runtime dependencies¶
Versions are pinned from requirements.lock.
| Package | Version | SPDX license | Attribution | Note |
|---|---|---|---|---|
| fastapi | 0.139.0 | MIT | Sebastián Ramírez | |
| uvicorn | 0.50.2 | BSD-3-Clause | Encode OSS Ltd | Declared as uvicorn[standard]. |
| httpx | 0.28.1 | BSD-3-Clause | Encode OSS Ltd | Runtime dep since the basemap router imports it at module level. |
| duckdb | 1.5.4 | MIT | Stichting DuckDB Foundation | |
| pydantic | 2.13.4 | MIT | Pydantic / Samuel Colvin & contributors | |
| PyYAML | 6.0.3 | MIT | Kirill Simonov & PyYAML contributors | |
| xarray | 2026.4.0 | Apache-2.0 | xarray Developers | |
| zarr | 3.2.1 | MIT | Zarr Developers | |
| rioxarray | 0.22.0 | Apache-2.0 | corteva / rioxarray contributors | |
| pyogrio | 0.13.0 | MIT | Brendan C. Ward & pyogrio contributors | |
| shapely | 2.1.2 | BSD-3-Clause | Sean Gillies & Shapely contributors | |
| pyproj | 3.7.2 | MIT | Jeffrey Whitaker & pyproj contributors | |
| fsspec | 2026.6.0 | BSD-3-Clause | fsspec contributors | |
| s3fs | 2026.6.0 | BSD-3-Clause | s3fs contributors | |
| dask | 2026.7.0 | BSD-3-Clause | Anaconda, Inc. & contributors | Declared as dask[array,dataframe]. |
| defusedxml | 0.7.1 | PSF-2.0 | Christian Heimes | |
| et-xmlfile | 2.0.0 | MIT | See AUTHORS in package metadata | |
| openpyxl | 3.1.5 | MIT | openpyxl contributors | |
| pandas | 3.0.3 | BSD-3-Clause | AQR Capital / Lambda Foundry / PyData Dev Team | |
| numpy | 2.5.1 | BSD-3-Clause AND 0BSD AND MIT AND Zlib AND CC0-1.0 | NumPy Developers | Compound License-Expression from installed package metadata. |
| python-ulid | 3.1.0 | MIT | Martin Domke | |
| python-multipart | 0.0.32 | Apache-2.0 | Andrew Dunham / Kludex | |
| cryptography | 49.0.0 | Apache-2.0 OR BSD-3-Clause | pyca/cryptography developers | |
| click | 8.4.2 | BSD-3-Clause | Pallets | |
| zstandard | 0.25.0 | BSD-3-Clause | Gregory Szorc |
Web runtime dependencies¶
Versions are pinned from web/package-lock.json.
| Package | Version | SPDX license | Attribution | Note |
|---|---|---|---|---|
| @tanstack/react-table | 8.21.3 | MIT | Tanner Linsley | |
| fzstd | 0.1.1 | MIT | Arjun Barrett | zstd decoding of the map grid in the browser |
| i18next | 23.16.8 | MIT | i18next / Jan Mühlemann | |
| leaflet | 1.9.4 | BSD-2-Clause | Volodymyr Agafonkin & Leaflet contributors | includes Leaflet's marker images (dist/images/marker-icon.png, marker-icon-2x.png, marker-shadow.png), bundled into the web build and served by the app |
| marked | 18.1.1 | MIT | MarkedJS & Christopher Jeffrey | renders the bundled user guide in the app; its license file also carries the BSD-3-Clause notice of the original Markdown (John Gruber) |
| react | 18.3.1 | MIT | Meta Platforms, Inc. | |
| react-dom | 18.3.1 | MIT | Meta Platforms, Inc. | |
| react-i18next | 15.7.4 | MIT | i18next / Jan Mühlemann | |
| react-router-dom | 6.30.4 | MIT | Remix Software / React Training | |
| jspdf | 3.0.4 | MIT | James Hall & Parallax contributors | PDF report assembly |
| html2canvas | 1.4.1 | MIT | Niklas von Hertzen & contributors | map-panel raster capture |
Python transitive runtime dependencies¶
Installed into the image from requirements.lock as dependencies of the packages above. Licence from each
package's installed metadata or licence file.
| Package | Version | Licence | Note |
|---|---|---|---|
| affine | 2.4.0 | BSD | |
| aiobotocore | 3.7.0 | Apache-2.0 | |
| aiohappyeyeballs | 2.7.1 | PSF-2.0 | |
| aiohttp | 3.14.1 | Apache-2.0 AND MIT | |
| aioitertools | 0.13.0 | MIT | |
| aiosignal | 1.4.0 | Apache-2.0 | |
| annotated-doc | 0.0.4 | MIT | |
| annotated-types | 0.7.0 | MIT | |
| anyio | 4.14.1 | MIT | |
| attrs | 26.1.0 | MIT | |
| botocore | 1.43.0 | Apache-2.0 | |
| certifi | 2026.6.17 | MPL-2.0 | MPL-2.0 (file-level copyleft); shipped unmodified. |
| cffi | 2.1.0 | MIT-0 | |
| cligj | 0.7.2 | BSD | |
| cloudpickle | 3.1.2 | BSD | |
| donfig | 0.8.1.post1 | MIT | |
| frozenlist | 1.8.0 | Apache-2.0 | |
| google-crc32c | 1.8.0 | Apache-2.0 | Licence from the package's LICENSE file (metadata field empty). |
| h11 | 0.16.0 | MIT | |
| httpcore | 1.0.9 | BSD-3-Clause | |
| httptools | 0.8.0 | MIT | |
| idna | 3.18 | BSD-3-Clause | |
| jmespath | 1.1.0 | MIT | |
| locket | 1.0.0 | BSD | |
| multidict | 6.7.1 | Apache-2.0 | |
| numcodecs | 0.16.5 | MIT | |
| packaging | 26.2 | Apache-2.0 OR BSD-2-Clause | |
| partd | 1.4.2 | BSD | |
| propcache | 0.5.2 | Apache-2.0 | |
| pyarrow | 24.0.0 | Apache-2.0 | |
| pycparser | 3.0 | BSD-3-Clause | |
| pydantic_core | 2.46.4 | MIT | |
| pyparsing | 3.3.2 | MIT | |
| python-dateutil | 2.9.0.post0 | Apache-2.0 OR BSD-3-Clause | |
| python-dotenv | 1.2.2 | BSD-3-Clause | |
| rasterio | 1.5.0 | BSD-3-Clause | |
| six | 1.17.0 | MIT | |
| starlette | 1.3.1 | BSD-3-Clause | |
| toolz | 1.1.0 | BSD-3-Clause | |
| typing-inspection | 0.4.2 | MIT | |
| typing_extensions | 4.16.0 | PSF-2.0 | |
| urllib3 | 2.7.0 | MIT | |
| uvloop | 0.22.1 | Apache-2.0 OR MIT | |
| watchfiles | 1.2.0 | MIT | |
| websockets | 16.0 | BSD-3-Clause | |
| wrapt | 2.2.2 | BSD-2-Clause | |
| yarl | 1.24.2 | Apache-2.0 |
Native libraries bundled inside the wheels of pyogrio, rasterio, shapely and pyproj (GDAL, GEOS,
PROJ, libcurl, HDF5, libtiff, sqlite and others) keep their own licences; each wheel ships them in its
*.dist-info/licenses/ folder. GEOS is LGPL-2.1, used as an unmodified, dynamically linked library.
Web transitive runtime dependencies¶
Bundled into the built UI from web/package-lock.json (development-only packages excluded).
| Package | Version | Licence | Note |
|---|---|---|---|
| @babel/runtime | 7.29.7 | MIT | |
| @remix-run/router | 1.23.3 | MIT | |
| @tanstack/table-core | 8.21.3 | MIT | |
| @types/pako | 2.0.4 | MIT | |
| @types/raf | 3.4.3 | MIT | |
| @types/trusted-types | 2.0.7 | MIT | |
| base64-arraybuffer | 1.0.2 | MIT | |
| canvg | 3.0.11 | MIT | |
| core-js | 3.50.0 | MIT | |
| css-line-break | 2.1.0 | MIT | |
| dompurify | 3.4.14 | (MPL-2.0 OR Apache-2.0) | Used under Apache-2.0 (dual-licensed MPL-2.0 OR Apache-2.0). |
| fast-png | 6.4.0 | MIT | |
| fflate | 0.8.3 | MIT | |
| html-parse-stringify | 3.1.0 | MIT | |
| iobuffer | 5.4.0 | MIT | |
| js-tokens | 4.0.0 | MIT | |
| loose-envify | 1.4.0 | MIT | |
| pako | 2.2.0 | (MIT AND Zlib) | |
| performance-now | 2.1.0 | MIT | |
| raf | 3.4.1 | MIT | |
| react-router | 6.30.4 | MIT | |
| regenerator-runtime | 0.13.11 | MIT | |
| rgbcolor | 1.0.1 | MIT OR SEE LICENSE IN FEEL-FREE.md | MIT. |
| scheduler | 0.23.2 | MIT | |
| stackblur-canvas | 2.7.0 | MIT | |
| svg-pathdata | 6.0.3 | MIT | |
| text-segmentation | 1.0.3 | MIT | |
| utrie | 1.0.2 | MIT | |
| void-elements | 3.1.0 | MIT |
Bundled assets¶
| Asset | Path | Licence |
|---|---|---|
| Inter typeface (variable, latin subset) | web/src/styles/fonts/inter/InterVariable-latin.woff2 |
SIL Open Font License 1.1 (web/src/styles/fonts/inter/OFL.txt) |
| Natural Earth 1:10m Land (simplified) | app/ingest/assets/ne_10m_land.geojson |
Public domain |
WRI GNW Self-Hosted Monitoring files (hash_zarr.py, post2020-manifest.json) |
third_party/gnw-self-hosted-monitoring/ |
Apache-2.0 (WRI's LICENSE in that folder) |
Map bindings provenance: see docs/clean-room-map-bindings.md.