Third-party notices
Every dependency Linen uses, with its licence. Update this file in the same commit that adds, removes
or upgrades a dependency. ./gradlew checkLicenses enforces the allowed list (CLAUDE.md → Licences)
for everything that ships, and writes the resolved table per subproject to
<subproject>/build/reports/licenses/runtime-licenses.md.
Shipped (runtime)
| Dependency | Version | Licence | URL |
|---|---|---|---|
| tools.jackson.core:jackson-databind | 3.2.3 | Apache-2.0 (ships a NOTICE file; keep it) | https://github.com/FasterXML/jackson-databind |
| tools.jackson.core:jackson-core | 3.2.3 | Apache-2.0 (ships a NOTICE file; keep it); bundles code under other licences, see below | https://github.com/FasterXML/jackson-core |
| tools.jackson.dataformat:jackson-dataformat-yaml | 3.2.3 | Apache-2.0 (ships a NOTICE file; keep it) | https://github.com/FasterXML/jackson-dataformats-text |
| com.fasterxml.jackson.core:jackson-annotations | 2.22 | Apache-2.0 (ships a NOTICE file; keep it) | https://github.com/FasterXML/jackson-annotations |
| com.networknt:json-schema-validator | 3.0.8 | Apache-2.0 | https://github.com/networknt/json-schema-validator |
| com.ethlo.time:itu | 1.14.0 | Apache-2.0 | https://github.com/ethlo/itu |
| org.snakeyaml:snakeyaml-engine | 3.0.1 | Apache-2.0 | https://bitbucket.org/snakeyaml/snakeyaml-engine |
| org.slf4j:slf4j-api | 2.0.20 | MIT | https://www.slf4j.org/ |
| org.slf4j:slf4j-simple | 2.0.20 | MIT (ships META-INF/LICENSE.txt) |
https://www.slf4j.org/ |
| info.picocli:picocli | 4.7.7 | Apache-2.0 | https://picocli.info/ |
| org.ow2.asm:asm, asm-tree | 9.10.1 | BSD-3-Clause | https://asm.ow2.io/ |
| com.github.javaparser:javaparser-core | 3.28.2 | Dual LGPL-3.0 OR Apache-2.0; used under Apache-2.0 (recorded override in config/licenses.json) |
https://github.com/javaparser/javaparser |
| org.apache.lucene:lucene-core | 10.5.2 | Apache-2.0 (ships META-INF/NOTICE.txt; keep it: lists bundled BSD/MIT-licensed parts such as the automaton package and the LZ4 port) |
https://lucene.apache.org/ |
| org.apache.lucene:lucene-analysis-common | 10.5.2 | Apache-2.0 (ships META-INF/NOTICE.txt; includes Snowball stemmers, BSD) |
https://lucene.apache.org/ |
| io.modelcontextprotocol.sdk:mcp (+ mcp-core, mcp-json-jackson3) | 2.0.1 | MIT (official MCP Java SDK) | https://github.com/modelcontextprotocol/java-sdk |
| io.projectreactor:reactor-core | 3.7.0 | Apache-2.0 (needed by the MCP SDK) | https://projectreactor.io/ |
| org.reactivestreams:reactive-streams | 1.0.4 | MIT-0 (MIT No Attribution; allowed as MIT family, owner to confirm, see tasks/BACKLOG.md) | https://www.reactive-streams.org/ |
| tools.jackson.dataformat:jackson-dataformat-toml | 3.2.3 | Apache-2.0 (reads linen.toml) | https://github.com/FasterXML/jackson-dataformats-text |
| dev.toonformat:jtoon | 3.0.0 | MIT (TOON for the JSON Linen’s MCP server hands Claude) | https://github.com/toon-format/toon-java |
| org.jspecify:jspecify | 1.0.1 | Apache-2.0 (nullness annotations, with jtoon) | https://github.com/jspecify/jspecify |
| tools.jackson.module:jackson-module-blackbird | 3.2.3 | Apache-2.0 (with jtoon; ships a NOTICE file; keep it) | https://github.com/FasterXML/jackson-modules-base |
| org.gradle:gradle-tooling-api | 9.8.0 | Apache-2.0 (from https://repo.gradle.org/gradle/libs-releases); bundles code under other licences, see below | https://docs.gradle.org/current/userguide/tooling_api.html |
| org.vineflower:vineflower | 1.12.0 | Apache-2.0 (no dependencies). Linen’s decompiler (decompiler/), in Linen Core and inside Linen’s JDT.LS extension bundle (linen-jdtls/, lib/) |
https://github.com/Vineflower/vineflower |
Gradle Wrapper (gradle-wrapper.jar, from Linen’s own gradle/wrapper/) |
9.8.0 | Apache-2.0; Linen Core carries it as a resource and the New Mod wizard copies it into new projects, since Version Packs hold no jars | https://docs.gradle.org/current/userguide/gradle_wrapper.html |
Code bundled inside shipped jars
checkLicenses judges each module by its own POM. Some jars also contain third-party code with
its own licence; those are listed here after reading each jar’s META-INF licence files.
| Inside | Component | Licence | Note |
|---|---|---|---|
| jackson-core 3.2.3 | FastDoubleParser (Werner Randelshofer) | MIT | META-INF/FastDoubleParser-LICENSE |
| jackson-core 3.2.3 | fast_float port (The fast_float authors) | MIT | META-INF/FastDoubleParser-ThirdParty-LICENSE |
| jackson-core 3.2.3 | Daniel Lemire’s float parsing work | BSL-1.0 (Boost) | META-INF/FastDoubleParser-ThirdParty-LICENSE. Permissive (weaker than MIT, no copyleft), but not on CLAUDE.md’s allowed list: owner decision pending (see tasks/BACKLOG.md). |
| jackson-core 3.2.3 | Schubfach (Raffaello Giulietti) | MIT | META-INF/Schubfach-LICENSE |
| gradle-tooling-api 9.8.0 | Guava (impldep/com/google) |
Apache-2.0 | shaded by Gradle |
| gradle-tooling-api 9.8.0 | Apache Commons IO (impldep/org/apache/commons/io) |
Apache-2.0 | shaded by Gradle |
| gradle-tooling-api 9.8.0 | ASM (impldep/org/objectweb/asm, 3 classes) |
BSD-3-Clause | shaded by Gradle |
| gradle-tooling-api 9.8.0 | JSR-305 annotations (impldep/javax/annotation, 4 classes) |
Apache-2.0 (com.google.code.findbugs:jsr305 POM) | shaded by Gradle |
| gradle-tooling-api 9.8.0 | javax.inject (impldep/javax/inject, 1 class) |
Apache-2.0 | shaded by Gradle |
| gradle-tooling-api 9.8.0 | JSpecify (impldep/org/jspecify) |
Apache-2.0 | shaded by Gradle |
Desktop app (npm, shipped with the app)
The Electron app (app/electron) ships about 630 production npm packages (npm query .prod).
npm run licenses checks every one of them against config/licenses.json on every build. This
table lists the main components and every package whose licence asks for more than keeping its
copyright notice. A complete generated list goes into the installers (task 121).
| Component | Version | Licence | Obligation |
|---|---|---|---|
Eclipse Theia platform packages (@theia/*: the 29 listed in app/electron/package.json and their @theia dependencies, such as @theia/plugin, @theia/ai-core, @theia/ai-mcp) |
1.76.0 | EPL-2.0 OR GPL-2.0-only WITH Classpath-exception-2.0; used under EPL-2.0 | Include the EPL-2.0 text and a link to the source (https://github.com/eclipse-theia/theia/tree/v1.76.0). Linen changes no Theia file; it only adds extensions through Theia’s extension points. Any future change to a Theia file must be published under EPL-2.0 from a separate folder (task 102 rule 6). |
| Electron | 42.8.1 | MIT; bundles Chromium and Node.js, whose notices are in LICENSES.chromium.html |
Ship LICENSE and LICENSES.chromium.html with the installers. |
Monaco editor (@theia/monaco-editor-core) |
1.108.201 | MIT | Keep the notice. |
| React and react-dom | 19.3.0 | MIT | Keep the notice. |
| InversifyJS | 6.2.2 | MIT | Keep the notice. |
| node-pty, keytar, native-keymap (native modules) | 1.2.0-beta.12, 7.9.0, 2.5.0 | MIT | Keep the notices. |
| drivelist (native module) | 12.0.2 | Apache-2.0 | Keep the notice. |
| @vscode/windows-ca-certs (optional, Windows; native) | 0.3.4 | BSD-3-Clause (its package.json says only “BSD”; recorded in npmOverrides) |
Keep the notice. Building it needs Visual Studio’s Spectre-mitigated libraries (CLAUDE.md commands). |
| @vscode/codicons (Theia’s icon font) | 0.0.45 | Icons CC-BY-4.0, code MIT (reviewed exception in config/licenses.json) |
Attribution: “Codicons by Microsoft, licensed under CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/)”. No Microsoft names or logos in Linen’s branding. |
| font-awesome (icon font used by Theia) | 4.7.0 | Font OFL-1.1, CSS MIT (reviewed exception) | Ship the font unchanged with the OFL text; never sell the font on its own. |
| argparse | 2.0.1 | Python-2.0 (reviewed exception) | Keep the PSF licence notice. |
| jackspeak, minimatch 10, minipass, package-json-from-dist, path-scurry | various | BlueOak-1.0.0 (reviewed exceptions) | Keep the notice. |
| @stroncium/procfs, markdown-it-anchor | 1.2.1, 9.2.1 | CC0-1.0, Unlicense (public domain; reviewed exceptions) | None. |
Java runtime for Linen Core (linen-core/runtime: a jlink image of the Eclipse Temurin 21 JDK that builds Linen, 19 modules) |
21 (21.0.11 here) | GPL-2.0-only WITH Classpath-exception-2.0 | Allowed in a closed app (spec: bundled JDK). Ship the image’s legal/ folder, which jlink keeps per module. |
yauzl (unzips JDKs, @linen/project) |
3.4.0 | MIT | Keep the notice. |
tar-fs (unpacks JDKs, @linen/project; also used by Theia at 3.1.3) |
3.1.3 | MIT | Keep the notice. |
smol-toml (reads linen.toml, @linen/project) |
1.9.0 | BSD-3-Clause | Keep the notice. |
Built-in plugins (from Open VSX, shipped with the app)
Downloaded by npm run download:plugins --workspace @linen/app from https://open-vsx.org (never
from Microsoft’s marketplace) into app/electron/plugins/.
| Plugins | Version | Licence | Note |
|---|---|---|---|
| vscode.git, vscode.git-base, vscode.java, vscode.json, vscode.json-language-features, vscode.markdown, vscode.markdown-language-features, vscode.groovy, vscode.xml, vscode.yaml, vscode.ini, vscode.shellscript, vscode.bat, vscode.powershell | 1.95.3 | MIT (LICENSE-vscode.txt, Microsoft Corporation) |
VS Code’s built-in extensions as published on Open VSX by the Eclipse Foundation. Keep the MIT notice. |
| redhat.java (Language Support for Java by Red Hat; the universal build, without an embedded JRE) | 1.57.2026093008 | EPL-2.0; bundles the Eclipse JDT language server (EPL-2.0) and Lombok (MIT) | Keep LICENSE.txt and the bundled notices. Its opt-in telemetry stays off: Theia’s telemetry.telemetryLevel defaults to off, and Linen defaults redhat.telemetry.enabled to false. |
| vscjava.vscode-java-debug (Debugger for Java) | 0.59.0 | MIT (LICENSE.txt, Microsoft Corporation; ThirdPartyNotices.txt) |
Keep the notices. |
Downloaded on the user’s machine (not in the installer)
| Component | Licence | Note |
|---|---|---|
Eclipse Temurin JDKs (17, 21, 25, as projects need), from the Adoptium API (https://api.adoptium.net/v3/assets/latest/{version}/hotspot) and its GitHub release links |
GPL-2.0-only WITH Classpath-exception-2.0 | Downloaded only after the user agrees, checked against Adoptium’s SHA-256, kept in Linen’s data folder (jdks/). Each JDK carries its own legal/ notices. |
Tests only (not shipped)
| Dependency | Version | Licence | URL |
|---|---|---|---|
| org.junit:junit-bom | 5.14.4 | EPL-2.0 | https://junit.org/ |
| org.junit.jupiter:junit-jupiter (+ -api, -engine, -params) | 5.14.4 | EPL-2.0 | https://junit.org/ |
| org.junit.platform:junit-platform-commons, -engine, -launcher | 1.14.4 | EPL-2.0 | https://junit.org/ |
| org.opentest4j:opentest4j | 1.3.0 | Apache-2.0 | https://github.com/ota4j-team/opentest4j |
| org.apiguardian:apiguardian-api | 1.1.2 | Apache-2.0 | https://github.com/apiguardian-team/apiguardian |
Build tools (not shipped)
| Tool | Version | Licence | URL |
|---|---|---|---|
| Gradle (wrapper and build tool) | 9.8.0 | Apache-2.0 | https://gradle.org/ |
| org.gradle.toolchains.foojay-resolver-convention (Gradle plugin) | 1.0.0 | Apache-2.0 | https://github.com/gradle/foojay-toolchains |
org.cyclonedx.bom (Gradle plugin; the release SBOM, ./gradlew cyclonedxBom) |
3.5.1 | Apache-2.0 | https://github.com/CycloneDX/cyclonedx-gradle-plugin |
| typescript (npm) | 5.9.3 | Apache-2.0 | https://www.typescriptlang.org/ |
| eslint (npm) | 10.12.0 | MIT | https://eslint.org/ |
| @eslint/js (npm) | 10.0.1 | MIT | https://eslint.org/ |
| typescript-eslint (npm) | 8.71.0 | MIT | https://typescript-eslint.io/ |
| @types/node (npm) | 24.19.1 | MIT | https://github.com/DefinitelyTyped/DefinitelyTyped |
| @types/react (npm) | 19.3.0 | MIT | https://github.com/DefinitelyTyped/DefinitelyTyped |
| @types/yauzl, @types/tar-fs (npm) | 3.4.0, 2.0.4 | MIT | https://github.com/DefinitelyTyped/DefinitelyTyped |
@theia/cli (npm; theia build, theia rebuild:electron, theia download:plugins; brings esbuild, MIT) |
1.76.0 | EPL-2.0 OR GPL-2.0-only WITH Classpath-exception-2.0; used under EPL-2.0 | https://github.com/eclipse-theia/theia |
Node.js (runs the TypeScript tools; .ts tools run through its built-in type stripping) |
24 | MIT | https://nodejs.org/ |
CI only (GitHub Actions, not shipped)
| Action | Version | Licence | URL |
|---|---|---|---|
| actions/checkout | v7 | MIT | https://github.com/actions/checkout |
| actions/setup-java | v6 | MIT | https://github.com/actions/setup-java |
| actions/setup-node | v7 | MIT | https://github.com/actions/setup-node |
| gradle/actions/wrapper-validation | v6 | MIT (the repository’s proprietary gradle-actions-caching component is not used) |
https://github.com/gradle/actions/blob/main/DISTRIBUTION.md |
| actions/upload-artifact, actions/download-artifact | v7 | MIT | https://github.com/actions/upload-artifact |
| google/osv-scanner-action (reusable workflows, OSV-Scanner v2.7.0; their SARIF upload through github/codeql-action, MIT, is off) | v2.7.0 | Apache-2.0 | https://github.com/google/osv-scanner-action |
Project templates (shipped inside Version Packs)
| Template | Source | Licence | Obligation |
|---|---|---|---|
templates/fabric-1.20.1/ |
Generated by @fabricmc/cli 0.1.466 (FabricMC, https://github.com/FabricMC/fabricmc.net) |
MIT | Keep FabricMC’s copyright notice with shipped template files. The template’s own LICENSE (CC0-1.0) is the default licence for the user’s mod, not Linen’s. |
templates/neoforge-1.21.1/ |
NeoForgeMDKs/MDK-1.21.1-ModDevGradle @ 7819b902 (NeoForged project) | MIT (TEMPLATE_LICENSE.txt) |
Keep TEMPLATE_LICENSE.txt with the template. |
Mojang’s official mappings (used by both templates through Loom and ModDevGradle) may be used for development but not redistributed “complete and unmodified” (licence printed by Loom). They are downloaded on the user’s machine by the loader toolchains and never shipped by Linen.
Official documentation (fetched on the user’s machine, not shipped in Phase 0)
Each pack’s recipe downloads its loader’s documentation at a pinned commit into the pack’s local part and indexes it there. Search results always carry the source page URL.
| Source | Commit | Licence | May Linen ship it? |
|---|---|---|---|
NeoForge Documentation, https://github.com/neoforged/Documentation (versioned_docs/version-1.21.1) |
89528c36e4eb34d46b1de346c045172ce8ca9fde |
MIT | Yes, with the MIT notice (shipped: true); Phase 0 still builds it locally |
Fabric Documentation, https://github.com/FabricMC/fabric-docs (versions/1.20.4/develop, plus imported reference/1.20.4 example code) |
f17bf08e377fc572169fee8df71bbef95628ed2d |
CC-BY-NC-SA-4.0 | No: non-commercial licence (shipped: false); fetched and indexed on the user’s machine only. Needs the lawyer review on the pre-launch checklist |