license-flip-audit / index.html
getreadystack's picture
Upload index.html with huggingface_hub
cb13d73 verified
Raw History Blame Contribute Delete
41.7 kB
<!doctype html><html lang="en"><meta charset="utf-8">
<meta name="viewport" content="width=device-width,initial-scale=1">
<title>License Flip Audit - BUSL/SSPL/AGPL in your deps</title>
<meta name="description" content="Finds the dependencies whose licence changed under you - Terraform 1.6+ BUSL, Redis 7.4+ SSPL, Bitnami's August 2025 move, Elastic 7.11 - and names the exact version where each flip happened.">
<style>
:root{color-scheme:light dark}
body{margin:0;font:16px/1.6 system-ui,-apple-system,"Segoe UI",sans-serif;
background:#fbfbfa;color:#16161d}
@media(prefers-color-scheme:dark){body{background:#14141a;color:#e8e8ea}}
.wrap{max-width:880px;margin:0 auto;padding:28px 20px 64px}
h1{font-size:1.7rem;line-height:1.25;margin:.2em 0 .3em}
p.sub{margin:0 0 1.4em;opacity:.8}
textarea{width:100%;min-height:230px;font:13px/1.5 ui-monospace,Menlo,Consolas,monospace;
padding:12px;border:1px solid #c9c9d1;border-radius:10px;background:transparent;color:inherit;
box-sizing:border-box}
button{font:600 15px/1 inherit;padding:12px 22px;border:0;border-radius:10px;
background:#1d4ed8;color:#fff;cursor:pointer;margin:12px 0}
button:hover{background:#1a43bd}
table{border-collapse:collapse;width:100%;margin-top:14px;font-size:14px}
th,td{border-bottom:1px solid #d8d8e0;padding:8px 6px;text-align:left;vertical-align:top}
th{font-weight:600;opacity:.75}
td.n{width:64px;font:13px ui-monospace,monospace;opacity:.7}
.ok{padding:14px;border-radius:10px;background:#e8f5ec;color:#14532d;margin-top:14px}
@media(prefers-color-scheme:dark){.ok{background:#15321f;color:#bbf7d0}}
.next{margin-top:30px;padding:18px;border:1px solid #d8d8e0;border-radius:12px}
.next h2{font-size:1.05rem;margin:0 0 .5em}
.cta{margin-top:18px;padding:16px 18px;border:1px solid #1d4ed8;border-radius:12px}
.cta p{margin:0 0 .6em}
.cta a.buy{display:inline-block;font:600 15px/1 inherit;padding:12px 22px;border-radius:10px;background:#1d4ed8;color:#fff;text-decoration:none}
.cta p.terms{margin:.8em 0 0;font-size:13px;opacity:.75}
.next ul{margin:.3em 0 1em 1.1em;padding:0}
</style>
<div class="wrap">
<h1>License Flip Audit - BUSL/SSPL/AGPL in your deps</h1>
<p class="sub">Finds the dependencies whose licence changed under you - Terraform 1.6+ BUSL, Redis 7.4+ SSPL, Bitnami's August 2025 move, Elastic 7.11 - and names the exact version where each flip happened.</p>
<textarea id="src" placeholder="Paste package.json, requirements.txt, go.mod, Dockerfile, docker-compose.yml or pom.xml here"></textarea>
<button id="go">Check my dependencies</button>
<div id="out"></div>
<div class="yj-home-find"><div class="yj-lgbar"><a href="/" class="yj-lg on">EN</a><a href="/de/" class="yj-lg">DE</a><a href="/ja/" class="yj-lg">JA</a><a href="/es/" class="yj-lg">ES</a><a href="/pt/" class="yj-lg">PT</a></div><section class="yj-find"><h2>Find a tool</h2><input id="yjq" type="search" autocomplete="off" placeholder="Type a product name, format or task"><div id="yjr"></div></section><style>.yj-lgbar{position:absolute;top:14px;right:18px;display:flex;gap:6px;z-index:60}.yj-lg{font:600 12px/1 system-ui,sans-serif;padding:6px 9px;border-radius:4px;text-decoration:none;color:#8b96a3;border:1px solid rgba(140,150,165,.28)}.yj-lg:hover{color:#e8eaed;border-color:rgba(160,175,195,.6)}.yj-lg.on{color:#0e1116;background:#cfd6de;border-color:#cfd6de}.yj-find{max-width:760px;margin:34px auto 8px;padding:0 20px}.yj-find h2{font:600 20px/1.3 system-ui,sans-serif;margin:0 0 10px}#yjq{width:100%;box-sizing:border-box;padding:13px 15px;font:400 15.5px system-ui,sans-serif;border:1px solid rgba(140,150,165,.34);border-radius:8px;background:rgba(255,255,255,.04);color:inherit}#yjq:focus{outline:none;border-color:#7FD1C4}#yjr{margin-top:10px;display:flex;flex-direction:column;gap:6px}#yjr a{display:flex;justify-content:space-between;gap:12px;padding:11px 14px;border:1px solid rgba(140,150,165,.22);border-radius:6px;text-decoration:none;font:400 14.5px/1.4 system-ui,sans-serif;color:inherit}#yjr a:hover{border-color:#7FD1C4}#yjr .pr{font:600 13px system-ui,sans-serif;color:#5fbf9a;white-space:nowrap}</style><script>(function(){var q=document.getElementById("yjq"),r=document.getElementById("yjr"),D=null;function load(){if(D)return Promise.resolve(D);return fetch("/search-index.json").then(function(x){return x.json();}).then(function(j){D=j;return j;}).catch(function(){D=[];return D;});}function esc(t){return String(t).replace(/[&<>"]/g,function(c){return {"&":"&amp;","<":"&lt;",">":"&gt;",'"':"&quot;"}[c];});}function run(){var v=q.value.trim().toLowerCase();if(v.length<2){r.innerHTML="";return;}load().then(function(j){var w=v.split(/\s+/),o=[];for(var i=0;i<j.length&&o.length<12;i++){var t=j[i].t.toLowerCase();var ok=true;for(var k=0;k<w.length;k++){if(t.indexOf(w[k])<0){ok=false;break;}}if(ok)o.push(j[i]);}r.innerHTML=o.length?o.map(function(x){return "<a href=\""+esc(x.u)+"\">"+"<span>"+esc(x.t)+"</span>"+(x.p?"<span class=\"pr\">$"+x.p+"</span>":"")+"</a>";}).join(""):"";});}q.addEventListener("input",run);q.addEventListener("focus",load);})();</script></div><div class="cta" id="cta" hidden><p>The free version finishes one open file. The full version covers the repository, and hands you the artefact somebody else asked for.</p>
<a href="https://getreadystack.com/api/buy/cl/polar_cl_sFzJiUXy6pSbEx0SFN1aIg7vRguyRc32MpDnb1iCHPe" class="buy">Get the full version - $29</a>
<p class="terms">$29 once · one licence key per person or team seat · One missed flip - the Bitnami one - pushed teams onto a subscription reported at 50,000-72,000 USD a year.</p></div>
<div class="next"><h2>In the full version</h2><ul><li>Scan every manifest in the workspace</li><li>Export the report as CSV, JSON or HTML</li><li>Re-check on every save</li><li>Write the machine-readable CI file</li><li><a href="https://getreadystack.com/api/buy/cl/polar_cl_sFzJiUXy6pSbEx0SFN1aIg7vRguyRc32MpDnb1iCHPe">Get the full version</a></li></ul></div>
</div>
<script>
var RULES=[{"pattern": "hashicorp/terraform:v?(?:1\\.(?:[6-9]|\\d\\d)|[2-9])", "message": "Terraform 1.6+ is BUSL-1.1, not MPL-2.0 (relicensed 2023-08-10; 1.5.7 was the last MPL release). Production use is allowed except in a competing service. OpenTofu is the MPL-2.0 fork.", "sev": "error"}, {"pattern": "hashicorp/vault:v?(?:1\\.(?:1[5-9]|[2-9]\\d)|[2-9])", "message": "Vault 1.15+ is BUSL-1.1 (1.14.1 was the last MPL-2.0 release, 2023-08-10). OpenBao is the MPL-2.0 fork.", "sev": "error"}, {"pattern": "hashicorp/consul:v?(?:1\\.(?:1[7-9]|[2-9]\\d)|[2-9])", "message": "Consul 1.17+ is BUSL-1.1 (1.16.1 was the last MPL-2.0 release, 2023-08-10).", "sev": "error"}, {"pattern": "hashicorp/nomad:v?(?:1\\.(?:[7-9]|\\d\\d)|[2-9])", "message": "Nomad 1.7+ is BUSL-1.1 (1.6.1 was the last MPL-2.0 release, 2023-08-10).", "sev": "error"}, {"pattern": "github\\.com/hashicorp/(?:terraform|vault|consul|nomad|boundary|waypoint|packer|vagrant)(?![\\w-])", "message": "HashiCorp module: every release after 2023-08-10 is BUSL-1.1 (Terraform >=1.6, Vault >=1.15, Consul >=1.17, Nomad >=1.7). Check the version pinned on this line against that boundary.", "sev": "warn"}, {"pattern": "hashicorp/(?:boundary|waypoint|packer|vagrant):", "message": "Boundary, Waypoint, Packer and Vagrant were all relicensed to BUSL-1.1 on 2023-08-10. Only releases cut before that date are MPL-2.0.", "sev": "warn"}, {"pattern": "redis:(?:7\\.[4-9])", "message": "Redis 7.4 through 7.8 is dual RSALv2 / SSPLv1 - source-available, not open source. Redis 7.2.x and earlier are BSD-3-Clause.", "sev": "error"}, {"pattern": "redis:(?:8\\.|9\\.)", "message": "Redis 8.0+ (May 2025) is tri-licensed: AGPLv3 or SSPLv1 or RSALv2. AGPLv3 is OSI-approved but still copyleft - choose one of the three and record which.", "sev": "warn"}, {"pattern": "redis:latest|image:\\s*[\"\\x27]?redis[\"\\x27]?\\s*$", "message": "An unpinned redis tag now pulls Redis 8.x, licensed differently from the 7.2 BSD-3-Clause build. Pin an explicit tag so a docker pull cannot change your licence.", "sev": "warn"}, {"pattern": "elasticsearch:(?:7\\.(?:1[1-9]|[2-9]\\d)|[89]\\.)", "message": "Elasticsearch 7.11+ left Apache-2.0 for SSPL + Elastic License 2.0 (Feb 2021); AGPLv3 was added as a third option from 8.16 (Sept 2024). 7.10.2 was the last Apache-2.0 release.", "sev": "error"}, {"pattern": "kibana:(?:7\\.(?:1[1-9]|[2-9]\\d)|[89]\\.)", "message": "Kibana 7.11+ carries the same change as Elasticsearch: SSPL + Elastic License 2.0 from Feb 2021, AGPLv3 added from 8.16. 7.10.2 was the last Apache-2.0 release.", "sev": "error"}, {"pattern": "docker\\.elastic\\.co/(?:elasticsearch|kibana|logstash)", "message": "Elastic registry image: the 7.11 licence change applies. Confirm the tag on this line is 7.10.x or earlier if your policy requires Apache-2.0.", "sev": "info"}, {"pattern": "(?:docker\\.io/)?bitnami/[a-z0-9._-]+", "message": "Bitnami changed on 2025-08-28: every versioned tag moved to docker.io/bitnamilegacy (no patches, no updates, no support) and docker.io/bitnami keeps only a limited set of hardened latest tags. Move to a maintained source or a paid Bitnami Secure subscription.", "sev": "error"}, {"pattern": "charts\\.bitnami\\.com", "message": "The Bitnami Helm chart index is part of the 2025-08-28 change - charts still point at image tags that were moved to bitnamilegacy. Re-point the image repository before the next deploy.", "sev": "error"}, {"pattern": "image:\\s*[\"\\x27]?(?:docker\\.io/)?(?:library/)?mongo(?:db)?:", "message": "MongoDB Community Server is SSPL-1.0 (since 4.0.3, Oct 2018), not OSI open source; offering it as a service triggers the source-release clause. The MongoDB drivers stay Apache-2.0 - this is about running the server.", "sev": "error"}, {"pattern": "cockroachdb/cockroach", "message": "CockroachDB has not been Apache-2.0 since 19.2: BSL 1.1 from 2019, and the CockroachDB Software License from v24.3 (Nov 2024). Read the tier limits before production use.", "sev": "warn"}, {"pattern": "grafana/(?:grafana|loki|tempo|mimir)", "message": "Grafana moved from Apache-2.0 to AGPLv3 at v8.0 (April 2021); Loki, Tempo and Mimir are AGPLv3 too. Running it is fine - embedding or redistributing is where AGPLv3 bites.", "sev": "warn"}, {"pattern": "minio/minio", "message": "The MinIO server is AGPLv3 (moved from Apache-2.0 in April 2021).", "sev": "warn"}, {"pattern": "getsentry/(?:sentry|snuba|relay)", "message": "Sentry's server code is under the FSL (Functional Source License, Nov 2023; BSL 1.1 before that) - source-available, converting to Apache-2.0 after two years. The client SDKs stay MIT.", "sev": "warn"}, {"pattern": "n8nio/n8n|\"n8n\"\\s*:", "message": "n8n ships under the Sustainable Use License (fair-code), not open source: internal business use is allowed, hosting it for other people is not.", "sev": "warn"}, {"pattern": "\"highcharts[a-z-]*\"\\s*:", "message": "Highcharts is proprietary: free for personal and non-commercial use, paid licence for commercial use. It sits in npm next to MIT chart libraries and is routinely assumed to be one.", "sev": "error"}, {"pattern": "\"(?:@ag-grid-enterprise/[a-z-]+|ag-grid-enterprise|ag-grid-charts-enterprise)\"\\s*:", "message": "ag-grid-enterprise requires a paid AG Grid licence key. Only ag-grid-community is MIT.", "sev": "error"}, {"pattern": "\"@mui/x-[a-z-]*-(?:pro|premium)\"\\s*:", "message": "MUI X Pro and Premium packages are commercial and need a licence key; the non-Pro MUI X packages are MIT.", "sev": "error"}, {"pattern": "\"handsontable\"\\s*:|\"@handsontable/[a-z-]+\"\\s*:", "message": "Handsontable is not MIT: free for non-commercial use, paid licence for commercial use.", "sev": "error"}, {"pattern": "\"tinymce\"\\s*:\\s*\"[\\^~>=v\\s]*(?:[7-9]|[1-9]\\d)\\.", "message": "TinyMCE 7+ (March 2024) is GPL-2.0-or-later or a paid licence; TinyMCE 6 was MIT. GPLv2+ inside a distributed closed-source app is the trap this version bump creates.", "sev": "error"}, {"pattern": "\"@fortawesome/(?:pro-|fontawesome-pro)", "message": "Font Awesome Pro packages require a paid subscription and must not be published in a public repository or a public npm token.", "sev": "error"}, {"pattern": "^\\s*PyQt[56](?![\\w-])", "message": "PyQt is GPL-3.0 or a paid Riverbank commercial licence - a closed-source app that ships PyQt needs the commercial one. PySide (Qt for Python) is LGPL-3.0.", "sev": "error", "flags": "i"}, {"pattern": "^\\s*(?:mysqlclient|mysql-connector-python)(?![\\w-])", "message": "MySQL client libraries are GPL-2.0 with the FOSS Exception, which only covers a listed set of open licences - a closed-source product is not on that list. PyMySQL is MIT.", "sev": "warn", "flags": "i"}, {"pattern": "^\\s*PySimpleGUI(?![\\w-])", "message": "PySimpleGUI 5 was commercial (a 99 USD perpetual licence) from April 2024, then re-released under LGPL-3.0 in 2025 after PySimpleSoft shut down. A copy vendored during 2024 carries the commercial terms, and a policy that still blocks it is out of date.", "sev": "info", "flags": "i"}, {"pattern": "<artifactId>\\s*itext", "message": "iText 5 and 7 are AGPL-3.0 or a paid commercial licence, and AGPL-3.0 is triggered by network use, not only by distribution.", "sev": "error", "flags": "i"}];
function scan(t){var L=String(t).split(/\r?\n/),h=[],i,r,re;
for(i=0;i<L.length;i++){for(var k=0;k<RULES.length;k++){r=RULES[k];
try{re=new RegExp(r.pattern,r.flags||'')}catch(e){continue}
if(re.test(L[i]))h.push({line:i+1,msg:r.message})}}
return h}
document.getElementById('go').onclick=function(){
var t=document.getElementById('src').value,o=document.getElementById('out');
if(!t.trim()){o.innerHTML='';return}
var h=scan(t),c=document.getElementById('cta');
if(c)c.hidden=false;
if(!h.length){o.innerHTML='<div class="ok">Nothing found. Open a manifest (package.json, requirements.txt, go.mod, Dockerfile, docker-compose.yml, pom.xml) and run it again.</div>';return}
var s='<table><tr><th>Line</th><th>Finding</th></tr>';
for(var i=0;i<h.length;i++){s+='<tr><td class="n">'+h[i].line+'</td><td>'+
String(h[i].msg).replace(/&/g,'&amp;').replace(/</g,'&lt;')+'</td></tr>'}
o.innerHTML=s+'</table>'};
</script>
</html>
<section data-yj-install="free" style="margin:2rem auto 1rem;max-width:46rem;padding:1.25rem 1.25rem;border:1px solid #cfe3d6;border-radius:12px;background:#f6fbf8;font:16px/1.6 system-ui,-apple-system,Segoe UI,sans-serif"><h2 style="margin:0 0 .4rem;font-size:1.2rem">Install free</h2><p style="margin:0 0 .8rem;color:#41505f">Free for the file open in your editor - no key, no limit. The workspace sweep and the report ask for a key.</p><a href="https://marketplace.visualstudio.com/items?itemName=ReadyStack.license-flip-audit" rel="noopener" data-yj-install-door="mp" onclick="try{navigator.sendBeacon('/api/ev',new Blob([JSON.stringify({t:'install',slug:'license-flip-audit',src:'mp',path:location.pathname})],{type:'application/json'}))}catch(e){}" style="display:inline-block;margin:0 .5rem .5rem 0;padding:.6rem 1rem;border-radius:8px;background:#0f7b3f;color:#fff;text-decoration:none;font-weight:600">VS Code Marketplace</a><a href="https://open-vsx.org/extension/readystack/license-flip-audit" rel="noopener" data-yj-install-door="ovsx" onclick="try{navigator.sendBeacon('/api/ev',new Blob([JSON.stringify({t:'install',slug:'license-flip-audit',src:'ovsx',path:location.pathname})],{type:'application/json'}))}catch(e){}" style="display:inline-block;margin:0 .5rem .5rem 0;padding:.6rem 1rem;border-radius:8px;background:#0f7b3f;color:#fff;text-decoration:none;font-weight:600">Open VSX (Cursor, VSCodium)</a><a href="https://www.npmjs.com/package/@readystack/license-flip-audit" rel="noopener" data-yj-install-door="npm" onclick="try{navigator.sendBeacon('/api/ev',new Blob([JSON.stringify({t:'install',slug:'license-flip-audit',src:'npm',path:location.pathname})],{type:'application/json'}))}catch(e){}" style="display:inline-block;margin:0 .5rem .5rem 0;padding:.6rem 1rem;border-radius:8px;background:#0f7b3f;color:#fff;text-decoration:none;font-weight:600">npm</a><a href="https://www.npmjs.com/package/@readystack/license-flip-audit" rel="noopener" data-yj-install-door="mcp" onclick="try{navigator.sendBeacon('/api/ev',new Blob([JSON.stringify({t:'install',slug:'license-flip-audit',src:'mcp',path:location.pathname})],{type:'application/json'}))}catch(e){}" style="display:inline-block;margin:0 .5rem .5rem 0;padding:.6rem 1rem;border-radius:8px;background:#0f7b3f;color:#fff;text-decoration:none;font-weight:600">MCP server (npx)</a><a href="https://hub.docker.com/r/getreadystack/license-flip-audit" rel="noopener" data-yj-install-door="docker" onclick="try{navigator.sendBeacon('/api/ev',new Blob([JSON.stringify({t:'install',slug:'license-flip-audit',src:'docker',path:location.pathname})],{type:'application/json'}))}catch(e){}" style="display:inline-block;margin:0 .5rem .5rem 0;padding:.6rem 1rem;border-radius:8px;background:#0f7b3f;color:#fff;text-decoration:none;font-weight:600">Docker Hub</a><pre style="margin:.5rem 0 0;padding:.6rem .8rem;background:#f3f5f8;border-radius:8px;font-size:.9rem;overflow:auto">ext install ReadyStack.license-flip-audit
npx @readystack/license-flip-audit &lt;file&gt;
npx @readystack/license-flip-audit --mcp</pre><p style="margin:.6rem 0 0;font-size:.92rem;color:#41505f"><a href="https://getreadystack.com/api/buy/cl/polar_cl_l6iN1uWt0FwWu7tBsczD0jWpP2vxFM54Wdwqb3KPi1G" rel="nofollow" style="color:#0f7b3f;text-decoration:underline">Team? One key for every ReadyStack linter, 5 seats, $149 once</a></p></section>
<section data-yj-alert="rule" style="margin:1rem auto 1.5rem;max-width:46rem;padding:1.1rem 1.25rem;border:1px solid #d9dee6;border-radius:12px;background:#fbfcfd;font:15px/1.55 system-ui,-apple-system,Segoe UI,sans-serif"><b style="font-size:1.05rem">Get the full rule table as a PDF</b><div style="opacity:.78;margin:.35rem 0 .8rem">All 30 rules License Flip Audit - BUSL/SSPL/AGPL in your deps checks, each with its source and date, on printable pages you can hand to your team or auditor. We email it now, and once more only if a rule changes. No newsletter.</div><div style="display:flex;gap:8px;flex-wrap:wrap"><input id="yjae" type="email" placeholder="you@example.com" style="flex:1;min-width:210px;padding:11px 13px;border:1px solid rgba(140,150,165,.34);border-radius:8px;background:#fff;color:inherit"><button id="yjab" style="padding:11px 18px;border-radius:8px;border:0;cursor:pointer;background:#0f7b3f;color:#fff;font:600 15px system-ui,sans-serif">Email me the PDF</button></div><div id="yjao" hidden style="margin-top:.6rem;color:#0f7b3f">Sent. It arrives within the hour - check spam too.</div><script>(function(){var b=document.getElementById("yjab"),e=document.getElementById("yjae");if(!b||!e)return;b.addEventListener("click",function(){var v=e.value.trim();if(!/.+@.+\..+/.test(v))return;try{localStorage.setItem("yj_em","1");}catch(_){}fetch(location.origin+"/api/subscribe",{method:"POST",headers:{"Content-Type":"application/json"},body:JSON.stringify({email:v,slug:"license-flip-audit",lang:"en",source:"rule_table"+((b.closest&&b.closest("section")&&b.closest("section").getAttribute("data-yj-moved"))?"_at_result":"")})}).then(function(r){var o=document.getElementById("yjao");o.hidden=false;if(!r.ok){o.textContent="Could not save - please try again.";}}).catch(function(){var o=document.getElementById("yjao");o.hidden=false;o.textContent="Could not save - please try again.";});});})();</script><script>(function(){var e=document.getElementById("yjae"),s=e&&e.closest?e.closest("section"):null,o=document.getElementById("out");if(!s||!o)return;var d=false;function mv(ev){if(d)return;if(ev&&ev.target&&s.contains(ev.target))return;d=true;var b=o;while(b.parentNode&&b.parentNode!==document.body&&b.parentNode.tagName!=="MAIN"&&b.parentNode.tagName!=="ARTICLE")b=b.parentNode;if(!b.parentNode||b===s||b.contains(s))return;try{b.parentNode.insertBefore(s,b.nextSibling);s.setAttribute("data-yj-moved","1");}catch(_){}}document.addEventListener("input",mv,true);document.addEventListener("change",mv,true);})();</script></section>
<section data-yj-cta="paid" style="margin:3rem auto;max-width:46rem;padding:1.5rem 1.25rem;border:1px solid #d8dee9;border-radius:12px;background:#fbfcfe;font:16px/1.6 system-ui,-apple-system,Segoe UI,sans-serif"><h2 style="margin:0 0 .5rem;font-size:1.25rem">Get the complete version <span class="yj-price">$29</span></h2><p style="margin:.25rem 0 1rem;color:#41505f">This page is the working piece. The full pack has everything below.</p><p style="margin:0 0 1rem;color:#41505f">Finds the dependencies whose licence changed under you - Terraform 1.6+ BUSL, Redis 7.4+ SSPL, Bitnami's August 2025 move, Elastic 7.11 - and names the exact version where each flip happened</p><p style="margin:0 0 1rem;color:#5b6b7c;font-size:.94rem">The Bitnami flip alone pushed teams onto a Bitnami Secure subscription reported at $50,000-$72,000 a year.</p><a href="https://getreadystack.com/api/buy/cl/polar_cl_sFzJiUXy6pSbEx0SFN1aIg7vRguyRc32MpDnb1iCHPe" rel="nofollow" style="display:inline-block;padding:.7rem 1.3rem;border-radius:8px;background:#1b64f2;color:#fff;text-decoration:none;font-weight:600">Buy the full version — $29</a></section>
<!--yj-share-s101--><div style="margin:28px 0 8px;text-align:center"><button id="yjcp" type="button" style="font:inherit;padding:10px 18px;border:1px solid #8884;border-radius:10px;background:transparent;cursor:pointer">Copy link</button><button id="yjimg" type="button" style="font:inherit;padding:10px 18px;margin-left:8px;border:1px solid #8884;border-radius:10px;background:transparent;cursor:pointer">Save result as image</button></div><script>(function(){var b=document.getElementById("yjimg");if(!b)return;b.addEventListener("click",function(){var o=document.getElementById("out");var txt=(o&&(o.innerText||o.textContent)||"").trim();if(!txt){b.textContent="(no result yet)";setTimeout(function(){b.textContent="Save result as image";},1500);return;}var lines=txt.split(String.fromCharCode(10)).filter(function(x){return x.trim();}).slice(0,10);var W=1200,P=56,c=document.createElement("canvas");c.width=W;var lh=38,H=P*2+70+lines.length*lh+60;c.height=H;var x=c.getContext("2d");x.fillStyle="#1a1512";x.fillRect(0,0,W,H);x.fillStyle="#f3e9d2";x.font="600 34px system-ui,Segoe UI,Arial";var t=(document.title||"").split("|")[0].trim();x.fillText(t.slice(0,54),P,P+34);x.font="22px ui-monospace,Menlo,Consolas,monospace";x.fillStyle="#e8dcc4";for(var i=0;i<lines.length;i++){x.fillText(lines[i].slice(0,88),P,P+70+i*lh+22);}x.font="600 22px system-ui,Segoe UI,Arial";x.fillStyle="#c9a227";var d=location.hostname.replace("www.","");x.fillText(d,W-P-x.measureText(d).width,H-P+6);c.toBlob(function(bl){var u=URL.createObjectURL(bl),a=document.createElement("a");a.href=u;a.download=(t||"result").replace(/[^a-z0-9]+/gi,"-").toLowerCase()+"-"+d+".png";document.body.appendChild(a);a.click();setTimeout(function(){URL.revokeObjectURL(u);a.remove();},2000);},"image/png");});})();</script><script>(function(){var b=document.getElementById("yjcp");if(!b)return;var t=b.textContent;b.addEventListener("click",function(){var u=location.href.split("#")[0];function d(){b.textContent="Link copied";setTimeout(function(){b.textContent=t;},1800);}if(navigator.clipboard&&navigator.clipboard.writeText){navigator.clipboard.writeText(u).then(d,function(){prompt("",u);});}else{prompt("",u);}});})();</script><script data-yj="yj-view-beacon">(function(){try{var p=location.pathname;var k='yjv:'+p;if(sessionStorage.getItem(k))return;sessionStorage.setItem(k,'1');fetch('/api/ev',{method:'POST',keepalive:true,headers:{'Content-Type':'application/json'},body:JSON.stringify({path:p,lang:"en",ref:(document.referrer||''),src:(function(){try{return (new URLSearchParams(location.search).get('ref')||'').replace(/[^a-z_]/g,'').slice(0,12)}catch(e){return ''}})()})}).catch(function(){});}catch(e){}})();</script>
<script data-yj="yj-use-beacon">(function(){try{var o=document.getElementById('out');if(!o)return;var p=location.pathname,k='yju:'+p,sent=false;function fire(){if(sent||sessionStorage.getItem(k))return;if(!(o.textContent||'').replace(/\s+/g,'').length)return;sent=true;sessionStorage.setItem(k,'1');fetch('/api/ev',{method:'POST',keepalive:true,headers:{'Content-Type':'application/json'},body:JSON.stringify({path:p,lang:"en",t:'use',src:(function(){try{return (new URLSearchParams(location.search).get('ref')||'').replace(/[^a-z_]/g,'').slice(0,12)}catch(e){return ''}})()})}).catch(function(){});}var mo=new MutationObserver(function(){fire();if(sent)mo.disconnect();});mo.observe(o,{childList:true,characterData:true,subtree:true});}catch(e){}})();</script>
<section data-yj="yj-facts-v1" style="max-width:920px;margin:48px auto 0;padding:0 20px;font-family:system-ui,sans-serif"><style>.yj-article p{font:400 15.5px/1.7 system-ui,sans-serif;color:#26313b;margin:0 0 12px;max-width:72ch}.yj-article h2,.yj-article h3,.yj-article h4{font:600 17px/1.35 system-ui,sans-serif;color:#1b1f24;margin:22px 0 8px}.yj-article table{border-collapse:collapse;margin:10px 0 16px;font:14px/1.45 system-ui,sans-serif}.yj-article th,.yj-article td{border:1px solid #e2e6ea;padding:6px 10px;text-align:left}.yj-article th{background:#f4f6f8}.yj-article pre{background:#0f1720;color:#e6edf3;padding:12px 14px;border-radius:8px;overflow:auto;font:13px/1.5 ui-monospace,Menlo,monospace}.yj-article code{font:13px ui-monospace,Menlo,monospace;background:#f1f3f5;padding:1px 4px;border-radius:3px}.yj-article pre code{background:none;padding:0}.yj-article ul,.yj-article ol{font:15px/1.6 system-ui,sans-serif;color:#26313b}</style><p style="font:400 13px/1.5 system-ui,sans-serif;color:#6b7680;margin:0 0 14px"><time datetime="2026-09-09">Updated 2026-09-09</time> · ReadyStack</p><script type="application/ld+json">{"@context":"https://schema.org","@type":"WebPage","dateModified":"2026-09-09","author":{"@type":"Organization","name":"ReadyStack"}}</script><h2 style="font:600 21px/1.3 system-ui,sans-serif;margin:0 0 6px;color:#1b1f24">Worked example</h2><p style="font:400 14.5px/1.5 system-ui,sans-serif;margin:0 0 16px;color:#5b6570">Real numbers from this tool, line by line.</p><div class="yj-article"><p><img src="https://getreadystack.com/img/promo/sku22081_result_card.jpg" alt="License Flip Audit - BUSL/SSPL/AGPL in your deps" loading="lazy" style="max-width:100%;border-radius:6px"></p>
<p>Four dependencies in one 40-line docker-compose file had changed licence since the day they were pinned, and the platform engineer at a UK fintech filling in a customer security questionnaire that morning could not see any of them. Nothing in the file looked wrong. Nothing in <code>npm ls</code> or <code>pip list</code> looked wrong. The file said this:</p>
<pre><code>services:
tf: { image: hashicorp/terraform:1.9.0 }
cache: { image: redis:7.4 }
search: { image: elasticsearch:8.15.0 }
db: { image: bitnami/postgresql:16 }</code></pre>
<p>Every one of those four lines carries a licence that is not the licence the internet remembers for it.</p>
<p>Terraform was MPL-2.0 until 1.5.7. From 1.6.0, released on 10 August 2023, it is BUSL-1.1. Redis was BSD-3-Clause through 7.2.x; 7.4 through 7.8 is dual RSALv2/SSPLv1, and Redis 8.0 (May 2025) added AGPLv3 as a third option, so &quot;Redis is open source&quot; is now true, false, or a choice you have to make, depending only on the tag. Elasticsearch left Apache-2.0 at 7.11 in February 2021 and added AGPLv3 at 8.16 in September 2024. And on 28 August 2025 Broadcom moved every versioned Bitnami tag to <code>docker.io/bitnamilegacy</code>, unmaintained, keeping only a limited set of hardened <code>latest</code> tags in <code>bitnami/</code> behind a Bitnami Secure subscription reported at $50,000 to $72,000 a year.</p>
<p>None of that is hidden. All of it is public. It is simply not in the file, and it is not in the tool you would reach for.</p>
<h3>Why the tools you already have do not catch this</h3>
<p><code>license-checker</code>, <code>pip-licenses</code> and the SPDX field in a package manifest all report the licence of the version you installed, as that version declares it. They answer &quot;what is this?&quot; They cannot answer the question a licence flip actually raises, which is &quot;at which version did it change, and is my pin on the safe side of that line?&quot; A container image tag carries no licence metadata at all. And a general-purpose AI assistant is worse than useless here, because a licence flip is exactly the kind of dated fact a model states with total confidence from whatever was true when it was trained: ask one about Terraform&#x27;s licence and you will get MPL-2.0.</p>
<p>The bump itself is usually not a human decision either. Renovate or Dependabot opens the pull request, CI is green, someone approves it, and the licence boundary is crossed by a bot on a Tuesday. The cost lands months later, in a procurement review, a due-diligence checklist, or an acquirer&#x27;s OSS audit.</p>
<h3>What License Flip Audit does</h3>
<p>It is a VS Code extension that reads the manifest you already have open - <code>package.json</code>, <code>requirements.txt</code>, <code>go.mod</code>, a <code>Dockerfile</code>, a compose file, a <code>pom.xml</code> - and checks each line against 30 recorded flips, each with its version boundary and its date:</p>
<pre><code>3: Terraform 1.6+ is BUSL-1.1, not MPL-2.0 (relicensed 2023-08-10;
1.5.7 was the last MPL release)...
4: Redis 7.4 through 7.8 is dual RSALv2 / SSPLv1 - source-available,
not open source. Redis 7.2.x and earlier are BSD-3-Clause.</code></pre>
<p>Pin <code>hashicorp/terraform:1.5.7</code> and the file is clean. Change one digit and it is not. That is the whole product: the boundary, not the vibe.</p>
<p>The free version finishes one open file completely - every line, all 30 rules, no truncated count, no watermark, no trial. The paid version changes scope, not depth: every manifest in the workspace at once, an exportable CSV/JSON/HTML report for the security questionnaire, a re-check on every save so a bot bump is caught in your working tree, and a JSON file CI can fail a pull request on. $29 once, 7-day full refund.</p>
<p>There is also a free web version - paste a manifest, get the same findings from the same rule set, no install.</p></div><h2 style="font:600 19px/1.3 system-ui,sans-serif;margin:30px 0 10px;color:#1b1f24">15 seconds — what it actually does</h2><video controls muted playsinline preload="none" poster="/img/promo/sku22081_result_card.jpg" style="width:100%;max-width:360px;border-radius:10px;display:block;margin:0 auto"><source src="/media/sku22081_short.mp4" type="video/mp4"></video><h2 style="font:600 21px/1.3 system-ui,sans-serif;margin:34px 0 6px;color:#1b1f24">Questions people ask</h2><details style="border-bottom:1px solid #e6e9ed;padding:10px 0"><summary style="cursor:pointer;font:600 15px/1.4 system-ui,sans-serif;color:#1b1f24">What does License Flip Audit actually do?</summary><p style="margin:8px 0 2px;font:400 14.5px/1.6 system-ui,sans-serif;color:#33404b">It reads a dependency manifest you have open in VS Code - package.json, requirements.txt, go.mod, a Dockerfile, a compose file or a pom.xml - and checks every line against 30 recorded licence changes. For each hit it names the licence the package carries now, the exact version where the change happened, and the date. Pin terraform 1.5.7 and the file is clean; 1.6.0 reports BUSL-1.1.</p></details><details style="border-bottom:1px solid #e6e9ed;padding:10px 0"><summary style="cursor:pointer;font:600 15px/1.4 system-ui,sans-serif;color:#1b1f24">Who is it for?</summary><p style="margin:8px 0 2px;font:400 14.5px/1.6 system-ui,sans-serif;color:#33404b">Platform, backend and front-end engineers who ship a commercial product and have to answer the open-source section of a customer security review, a due-diligence questionnaire or an acquirer&#x27;s audit. It is aimed particularly at teams running Renovate or Dependabot, where a bot opens the version bump that crosses a licence boundary and CI passes it without comment.</p></details><details style="border-bottom:1px solid #e6e9ed;padding:10px 0"><summary style="cursor:pointer;font:600 15px/1.4 system-ui,sans-serif;color:#1b1f24">Why will license-checker or pip-licenses not tell me this?</summary><p style="margin:8px 0 2px;font:400 14.5px/1.6 system-ui,sans-serif;color:#33404b">Those tools report the licence that the version you installed declares about itself. They answer what a package is, not at which version it became that. A licence flip is a boundary between two versions, and the boundary is what decides whether your pin is safe. Container image tags carry no licence metadata at all, so they are invisible to those tools.</p></details><details style="border-bottom:1px solid #e6e9ed;padding:10px 0"><summary style="cursor:pointer;font:600 15px/1.4 system-ui,sans-serif;color:#1b1f24">What is free and what needs the paid version?</summary><p style="margin:8px 0 2px;font:400 14.5px/1.6 system-ui,sans-serif;color:#33404b">The free version finishes one file completely: every line of the manifest you have open, all 30 rules, full findings, no watermark, no trial and no truncated count. There is also a free web version that runs the same rule set in a browser. Paying changes scope, not depth: the whole workspace, exportable CSV, JSON or HTML reports, re-check on save, and a CI file.</p></details><details style="border-bottom:1px solid #e6e9ed;padding:10px 0"><summary style="cursor:pointer;font:600 15px/1.4 system-ui,sans-serif;color:#1b1f24">What does missing one of these flips cost?</summary><p style="margin:8px 0 2px;font:400 14.5px/1.6 system-ui,sans-serif;color:#33404b">One example is measurable. On 28 August 2025 Broadcom moved every versioned Bitnami image tag to an unmaintained legacy repository and kept hardened tags behind a Bitnami Secure subscription reported at 50,000 to 72,000 US dollars a year. The others surface as a stalled procurement review or a remediation sprint. The extension is 29 dollars once,.</p></details><details style="border-bottom:1px solid #e6e9ed;padding:10px 0"><summary style="cursor:pointer;font:600 15px/1.4 system-ui,sans-serif;color:#1b1f24">Why not just ask ChatGPT or another AI chat?</summary><p style="margin:8px 0 2px;font:400 14.5px/1.6 system-ui,sans-serif;color:#33404b">A general AI chat answers from training data with a cutoff date, cannot read your repository and names no rule version. License Flip Audit - BUSL/SSPL/AGPL in your deps checks the file you open against 30 rules from a rule set dated 2026-09-20, and points at the exact line. For a filing, an audit or a client you need that dated result on your own files.</p></details><script type="application/ld+json" data-yj="yj-faq-ld">{"@context": "https://schema.org", "@type": "FAQPage", "mainEntity": [{"@type": "Question", "name": "What does License Flip Audit actually do?", "acceptedAnswer": {"@type": "Answer", "text": "It reads a dependency manifest you have open in VS Code - package.json, requirements.txt, go.mod, a Dockerfile, a compose file or a pom.xml - and checks every line against 30 recorded licence changes. For each hit it names the licence the package carries now, the exact version where the change happened, and the date. Pin terraform 1.5.7 and the file is clean; 1.6.0 reports BUSL-1.1."}}, {"@type": "Question", "name": "Who is it for?", "acceptedAnswer": {"@type": "Answer", "text": "Platform, backend and front-end engineers who ship a commercial product and have to answer the open-source section of a customer security review, a due-diligence questionnaire or an acquirer's audit. It is aimed particularly at teams running Renovate or Dependabot, where a bot opens the version bump that crosses a licence boundary and CI passes it without comment."}}, {"@type": "Question", "name": "Why will license-checker or pip-licenses not tell me this?", "acceptedAnswer": {"@type": "Answer", "text": "Those tools report the licence that the version you installed declares about itself. They answer what a package is, not at which version it became that. A licence flip is a boundary between two versions, and the boundary is what decides whether your pin is safe. Container image tags carry no licence metadata at all, so they are invisible to those tools."}}, {"@type": "Question", "name": "What is free and what needs the paid version?", "acceptedAnswer": {"@type": "Answer", "text": "The free version finishes one file completely: every line of the manifest you have open, all 30 rules, full findings, no watermark, no trial and no truncated count. There is also a free web version that runs the same rule set in a browser. Paying changes scope, not depth: the whole workspace, exportable CSV, JSON or HTML reports, re-check on save, and a CI file."}}, {"@type": "Question", "name": "What does missing one of these flips cost?", "acceptedAnswer": {"@type": "Answer", "text": "One example is measurable. On 28 August 2025 Broadcom moved every versioned Bitnami image tag to an unmaintained legacy repository and kept hardened tags behind a Bitnami Secure subscription reported at 50,000 to 72,000 US dollars a year. The others surface as a stalled procurement review or a remediation sprint. The extension is 29 dollars once,."}}, {"@type": "Question", "name": "Why not just ask ChatGPT or another AI chat?", "acceptedAnswer": {"@type": "Answer", "text": "A general AI chat answers from training data with a cutoff date, cannot read your repository and names no rule version. License Flip Audit - BUSL/SSPL/AGPL in your deps checks the file you open against 30 rules from a rule set dated 2026-09-20, and points at the exact line. For a filing, an audit or a client you need that dated result on your own files."}}]}</script><div id="yj-ask" style="margin:36px 0 0;padding:18px 18px 16px;border:1px solid #e2e6ea;border-radius:10px;background:#fbfbfc"><h2 style="font:600 19px/1.3 system-ui,sans-serif;margin:0 0 4px;color:#1b1f24">Ask about this tool</h2><p style="font:400 13.5px/1.5 system-ui,sans-serif;margin:0 0 12px;color:#5b6570">One question, answered by the person who built it. Your email only if you want the answer sent.</p><form onsubmit="return yjAsk(event)" style="display:grid;gap:8px"><textarea name="question" required minlength="10" maxlength="2000" rows="3" placeholder="Your question" style="font:14px/1.5 system-ui,sans-serif;padding:10px;border:1px solid #cfd6dd;border-radius:6px"></textarea><div style="display:flex;gap:8px;flex-wrap:wrap"><input type="email" name="email" placeholder="Email (optional)" style="flex:1;min-width:200px;font:14px system-ui,sans-serif;padding:9px 10px;border:1px solid #cfd6dd;border-radius:6px"><button type="submit" style="font:600 14px system-ui,sans-serif;padding:9px 18px;border:0;border-radius:6px;background:#1b1f24;color:#fff;cursor:pointer">Send</button></div><p id="yj-ask-msg" style="font:13px system-ui,sans-serif;margin:2px 0 0;color:#0a6238;min-height:1em"></p></form><script>function yjAsk(e){e.preventDefault();var f=e.target,m=document.getElementById("yj-ask-msg");m.style.color="#0a6238";fetch(location.origin+"/api/ask",{method:"POST",headers:{"Content-Type":"application/json"},body:JSON.stringify({sku:22081,slug:"license-flip-audit",lang:"en",question:f.question.value,email:f.email.value,page:location.pathname})}).then(function(r){if(!r.ok)throw 0;m.textContent="Thanks \u2014 noted. Answers land on this page and, if you left an email, in your inbox.";f.question.value="";}).catch(function(){m.style.color="#a8551f";m.textContent="Could not send. Please try again in a minute.";});return false;}</script></div></section><section class="yj-related" style="max-width:920px;margin:56px auto 40px;padding:0 20px"><h2 style="font:600 21px/1.3 system-ui,sans-serif;margin:0 0 6px;color:#1b1f24">Same job, next tool</h2><p style="font:400 14.5px/1.5 system-ui,sans-serif;margin:0 0 20px;color:#5b6570">Free in the browser. The full version is a one-time licence.</p><div style="display:grid;grid-template-columns:repeat(auto-fill,minmax(250px,1fr));gap:14px"><a class="yj-rel-c" href="https://getreadystack.com/tools/huggingface-model-license-matrix"><span class="yj-rel-t">Hugging Face Model Licence Matrix — all 70 model-card `license:` identifiers ×</span><span class="yj-rel-p">$4.99</span></a><a class="yj-rel-c" href="https://getreadystack.com/tools/firestore-rules-guard"><span class="yj-rel-t">Firestore Rules Guard</span><span class="yj-rel-p">$29</span></a><a class="yj-rel-c" href="https://getreadystack.com/tools/us-trademark-renewal-clock-2026"><span class="yj-rel-t">US Trademark Renewal Clock 2026 - Section 8/9 window, grace date and exact USP</span><span class="yj-rel-p">$60</span></a><a class="yj-rel-c" href="https://getreadystack.com/tools/ai-model-license-lint"><span class="yj-rel-t">AI Model License Lint</span><span class="yj-rel-p">$29</span></a><a class="yj-rel-c" href="https://getreadystack.com/tools/csaf-advisory-check-cra-2026"><span class="yj-rel-t">CSAF Advisory Check for CRA 2026</span><span class="yj-rel-p">$29</span></a><a class="yj-rel-c" href="https://getreadystack.com/tools/cloud-cost-landmine-lint"><span class="yj-rel-t">Cloud Cost Landmine Lint for Terraform, CloudFormation and Kubernetes</span><span class="yj-rel-p">$29</span></a></div><style>.yj-rel-c{display:flex;flex-direction:column;gap:8px;padding:15px 16px;border:1px solid #e2e6ea;border-radius:6px;text-decoration:none;background:#fff}.yj-rel-c:hover{border-color:#b9c2cb;background:#fafbfc}.yj-rel-t{font:500 14.5px/1.42 system-ui,sans-serif;color:#1b1f24}.yj-rel-p{font:600 13px system-ui,sans-serif;color:#0a6238}</style></section>