From 607579182ec59adbd3504ddfc1e27a2c13307ff0 Mon Sep 17 00:00:00 2001 From: Aditya Parikh Date: Mon, 5 Oct 2026 13:20:28 -0400 Subject: [PATCH 1/5] docs: add the IP-clearance license row for the incubator form The "all items depended upon are covered by approved licenses" row of the IP-clearance status document (#216), as a paste-ready XML . It lists the 157 runtime dependencies bundled in the executable JAR with the license the CycloneDX SBOM reports for each, generated once from main @ 93ffdb79. IP clearance is a one-time job, so the row is committed as a file rather than produced by the build. Refs #216 Co-Authored-By: Claude Opus 5.5 (1M context) Signed-off-by: Aditya Parikh --- dev-docs/ip-clearance-licenses.xml | 169 +++++++++++++++++++++++++++++ 1 file changed, 169 insertions(+) create mode 100644 dev-docs/ip-clearance-licenses.xml diff --git a/dev-docs/ip-clearance-licenses.xml b/dev-docs/ip-clearance-licenses.xml new file mode 100644 index 00000000..78949578 --- /dev/null +++ b/dev-docs/ip-clearance-licenses.xml @@ -0,0 +1,169 @@ + + 2026-10-05 + Check and make sure that all items depended upon by the project are + covered by one or more of the following approved licenses: Apache, + BSD, Artistic, MIT/X, MIT/W3C, MPL 1.1, or something with + essentially the same terms. — All runtime dependencies bundled in the + release (derived from the CycloneDX SBOM, as reported there; the full list + is also in META-INF/LICENSE of the executable JAR): +
    +
  • aopalliance:aopalliance — Public Domain
    • +
  • ch.qos.logback:logback-classic — EPL-2.0 / GNU Lesser General Public License
    • +
  • ch.qos.logback:logback-core — EPL-2.0 / GNU Lesser General Public License
    • +
  • com.ethlo.time:itu — Apache-2.0
    • +
  • com.fasterxml.jackson.core:jackson-annotations — Apache-2.0
    • +
  • com.fasterxml.jackson.core:jackson-core — Apache-2.0
    • +
  • com.fasterxml.jackson.core:jackson-databind — Apache-2.0
    • +
  • com.fasterxml.jackson.dataformat:jackson-dataformat-yaml — Apache-2.0
    • +
  • com.fasterxml.jackson.datatype:jackson-datatype-jdk8 — Apache-2.0
    • +
  • com.fasterxml.jackson.datatype:jackson-datatype-jsr310 — Apache-2.0
    • +
  • com.fasterxml.jackson.module:jackson-module-jsonSchema — Apache-2.0
    • +
  • com.fasterxml.jackson.module:jackson-module-parameter-names — Apache-2.0
    • +
  • com.fasterxml:classmate — Apache-2.0
    • +
  • com.github.stephenc.jcip:jcip-annotations — Apache-2.0
    • +
  • com.github.victools:jsonschema-generator — Apache-2.0
    • +
  • com.github.victools:jsonschema-module-jackson — Apache-2.0
    • +
  • com.github.victools:jsonschema-module-swagger-2 — Apache-2.0
    • +
  • com.google.cloud.opentelemetry:detector-resources-support — Apache-2.0
    • +
  • com.knuddels:jtokkit — MIT
    • +
  • com.networknt:json-schema-validator — Apache-2.0
    • +
  • com.nimbusds:nimbus-jose-jwt — Apache-2.0
    • +
  • com.squareup.okhttp3:okhttp — Apache-2.0
    • +
  • com.squareup.okio:okio-jvm — Apache-2.0
    • +
  • io.micrometer:context-propagation — Apache-2.0
    • +
  • io.micrometer:micrometer-commons — Apache-2.0
    • +
  • io.micrometer:micrometer-core — Apache-2.0
    • +
  • io.micrometer:micrometer-jakarta9 — Apache-2.0
    • +
  • io.micrometer:micrometer-observation — Apache-2.0
    • +
  • io.micrometer:micrometer-registry-prometheus — Apache-2.0
    • +
  • io.micrometer:micrometer-tracing — Apache-2.0
    • +
  • io.micrometer:micrometer-tracing-bridge-otel — Apache-2.0
    • +
  • io.modelcontextprotocol.sdk:mcp — MIT
    • +
  • io.modelcontextprotocol.sdk:mcp-core — MIT
    • +
  • io.modelcontextprotocol.sdk:mcp-json-jackson2 — MIT
    • +
  • io.modelcontextprotocol.sdk:mcp-spring-webmvc — MIT
    • +
  • io.opentelemetry.contrib:opentelemetry-aws-resources — Apache-2.0
    • +
  • io.opentelemetry.contrib:opentelemetry-baggage-processor — Apache-2.0
    • +
  • io.opentelemetry.contrib:opentelemetry-gcp-resources — Apache-2.0
    • +
  • io.opentelemetry.instrumentation:opentelemetry-instrumentation-annotations — Apache-2.0
    • +
  • io.opentelemetry.instrumentation:opentelemetry-instrumentation-annotations-support — Apache-2.0
    • +
  • io.opentelemetry.instrumentation:opentelemetry-instrumentation-api — Apache-2.0
    • +
  • io.opentelemetry.instrumentation:opentelemetry-instrumentation-api-incubator — Apache-2.0
    • +
  • io.opentelemetry.instrumentation:opentelemetry-jdbc — Apache-2.0
    • +
  • io.opentelemetry.instrumentation:opentelemetry-kafka-clients-2.6 — Apache-2.0
    • +
  • io.opentelemetry.instrumentation:opentelemetry-kafka-clients-common — Apache-2.0
    • +
  • io.opentelemetry.instrumentation:opentelemetry-log4j-appender-2.17 — Apache-2.0
    • +
  • io.opentelemetry.instrumentation:opentelemetry-log4j-context-data-2.17-autoconfigure — Apache-2.0
    • +
  • io.opentelemetry.instrumentation:opentelemetry-logback-appender-1.0 — Apache-2.0
    • +
  • io.opentelemetry.instrumentation:opentelemetry-logback-mdc-1.0 — Apache-2.0
    • +
  • io.opentelemetry.instrumentation:opentelemetry-micrometer-1.5 — Apache-2.0
    • +
  • io.opentelemetry.instrumentation:opentelemetry-mongo-3.1 — Apache-2.0
    • +
  • io.opentelemetry.instrumentation:opentelemetry-reactor-3.1 — Apache-2.0
    • +
  • io.opentelemetry.instrumentation:opentelemetry-resources — Apache-2.0
    • +
  • io.opentelemetry.instrumentation:opentelemetry-sdk-autoconfigure-support — Apache-2.0
    • +
  • io.opentelemetry.instrumentation:opentelemetry-spring-boot-autoconfigure — Apache-2.0
    • +
  • io.opentelemetry.instrumentation:opentelemetry-spring-boot-starter — Apache-2.0
    • +
  • io.opentelemetry.instrumentation:opentelemetry-spring-kafka-2.7 — Apache-2.0
    • +
  • io.opentelemetry.instrumentation:opentelemetry-spring-web-3.1 — Apache-2.0
    • +
  • io.opentelemetry.instrumentation:opentelemetry-spring-webflux-5.3 — Apache-2.0
    • +
  • io.opentelemetry.instrumentation:opentelemetry-spring-webmvc-5.3 — Apache-2.0
    • +
  • io.opentelemetry.instrumentation:opentelemetry-spring-webmvc-6.0 — Apache-2.0
    • +
  • io.opentelemetry.semconv:opentelemetry-semconv — Apache-2.0
    • +
  • io.opentelemetry.semconv:opentelemetry-semconv-incubating — Apache-2.0
    • +
  • io.opentelemetry:opentelemetry-api — Apache-2.0
    • +
  • io.opentelemetry:opentelemetry-api-incubator — Apache-2.0
    • +
  • io.opentelemetry:opentelemetry-context — Apache-2.0
    • +
  • io.opentelemetry:opentelemetry-exporter-common — Apache-2.0
    • +
  • io.opentelemetry:opentelemetry-exporter-logging — Apache-2.0
    • +
  • io.opentelemetry:opentelemetry-exporter-otlp — Apache-2.0
    • +
  • io.opentelemetry:opentelemetry-exporter-otlp-common — Apache-2.0
    • +
  • io.opentelemetry:opentelemetry-exporter-sender-okhttp — Apache-2.0
    • +
  • io.opentelemetry:opentelemetry-extension-trace-propagators — Apache-2.0
    • +
  • io.opentelemetry:opentelemetry-sdk — Apache-2.0
    • +
  • io.opentelemetry:opentelemetry-sdk-common — Apache-2.0
    • +
  • io.opentelemetry:opentelemetry-sdk-extension-autoconfigure — Apache-2.0
    • +
  • io.opentelemetry:opentelemetry-sdk-extension-autoconfigure-spi — Apache-2.0
    • +
  • io.opentelemetry:opentelemetry-sdk-extension-incubator — Apache-2.0
    • +
  • io.opentelemetry:opentelemetry-sdk-logs — Apache-2.0
    • +
  • io.opentelemetry:opentelemetry-sdk-metrics — Apache-2.0
    • +
  • io.opentelemetry:opentelemetry-sdk-trace — Apache-2.0
    • +
  • io.projectreactor:reactor-core — Apache-2.0
    • +
  • io.prometheus:prometheus-metrics-config — Apache-2.0
    • +
  • io.prometheus:prometheus-metrics-core — Apache-2.0
    • +
  • io.prometheus:prometheus-metrics-exposition-formats — Apache-2.0
    • +
  • io.prometheus:prometheus-metrics-exposition-textformats — Apache-2.0
    • +
  • io.prometheus:prometheus-metrics-model — Apache-2.0
    • +
  • io.prometheus:prometheus-metrics-tracer-common — Apache-2.0
    • +
  • io.swagger.core.v3:swagger-annotations-jakarta — Apache-2.0
    • +
  • jakarta.annotation:jakarta.annotation-api — EPL-2.0 / GPL-2.0-with-classpath-exception
    • +
  • jakarta.ws.rs:jakarta.ws.rs-api — EPL-2.0 / GPL-2.0-with-classpath-exception
    • +
  • javax.validation:validation-api — Apache-2.0
    • +
  • org.antlr:ST4 — BSD-4-Clause
    • +
  • org.antlr:antlr-runtime — BSD licence
    • +
  • org.antlr:antlr4-runtime — BSD-3-Clause
    • +
  • org.apache.logging.log4j:log4j-api — Apache-2.0
    • +
  • org.apache.logging.log4j:log4j-to-slf4j — Apache-2.0
    • +
  • org.apache.solr:solr-api — Apache-2.0
    • +
  • org.apache.solr:solr-solrj — Apache-2.0
    • +
  • org.apache.tomcat.embed:tomcat-embed-core — Apache-2.0
    • +
  • org.apache.tomcat.embed:tomcat-embed-el — Apache-2.0
    • +
  • org.apache.tomcat.embed:tomcat-embed-websocket — Apache-2.0
    • +
  • org.aspectj:aspectjweaver — EPL-2.0
    • +
  • org.commonmark:commonmark — BSD-2-Clause
    • +
  • org.commonmark:commonmark-ext-yaml-front-matter — BSD-2-Clause
    • +
  • org.hdrhistogram:HdrHistogram — CC0-1.0 / BSD-2-Clause
    • +
  • org.jetbrains.kotlin:kotlin-stdlib — Apache-2.0
    • +
  • org.jetbrains.kotlin:kotlin-stdlib-jdk7 — Apache-2.0
    • +
  • org.jetbrains.kotlin:kotlin-stdlib-jdk8 — Apache-2.0
    • +
  • org.jetbrains:annotations — Apache-2.0
    • +
  • org.jspecify:jspecify — Apache-2.0
    • +
  • org.latencyutils:LatencyUtils — CC0-1.0
    • +
  • org.reactivestreams:reactive-streams — MIT-0
    • +
  • org.semver4j:semver4j — MIT
    • +
  • org.slf4j:jcl-over-slf4j — Apache-2.0
    • +
  • org.slf4j:jul-to-slf4j — MIT
    • +
  • org.slf4j:slf4j-api — MIT
    • +
  • org.snakeyaml:snakeyaml-engine — Apache-2.0
    • +
  • org.springaicommunity:mcp-annotations — MIT
    • +
  • org.springaicommunity:mcp-server-security — Apache-1.0
    • +
  • org.springframework.ai:spring-ai-autoconfigure-mcp-server-common — Apache-2.0
    • +
  • org.springframework.ai:spring-ai-autoconfigure-mcp-server-webmvc — Apache-2.0
    • +
  • org.springframework.ai:spring-ai-commons — Apache-2.0
    • +
  • org.springframework.ai:spring-ai-mcp — Apache-2.0
    • +
  • org.springframework.ai:spring-ai-mcp-annotations — Apache-2.0
    • +
  • org.springframework.ai:spring-ai-model — Apache-2.0
    • +
  • org.springframework.ai:spring-ai-starter-mcp-server-webmvc — Apache-2.0
    • +
  • org.springframework.ai:spring-ai-template-st — Apache-2.0
    • +
  • org.springframework.boot:spring-boot — Apache-2.0
    • +
  • org.springframework.boot:spring-boot-actuator — Apache-2.0
    • +
  • org.springframework.boot:spring-boot-actuator-autoconfigure — Apache-2.0
    • +
  • org.springframework.boot:spring-boot-autoconfigure — Apache-2.0
    • +
  • org.springframework.boot:spring-boot-starter — Apache-2.0
    • +
  • org.springframework.boot:spring-boot-starter-actuator — Apache-2.0
    • +
  • org.springframework.boot:spring-boot-starter-aop — Apache-2.0
    • +
  • org.springframework.boot:spring-boot-starter-json — Apache-2.0
    • +
  • org.springframework.boot:spring-boot-starter-logging — Apache-2.0
    • +
  • org.springframework.boot:spring-boot-starter-oauth2-resource-server — Apache-2.0
    • +
  • org.springframework.boot:spring-boot-starter-security — Apache-2.0
    • +
  • org.springframework.boot:spring-boot-starter-tomcat — Apache-2.0
    • +
  • org.springframework.boot:spring-boot-starter-web — Apache-2.0
    • +
  • org.springframework.security:spring-security-config — Apache-2.0
    • +
  • org.springframework.security:spring-security-core — Apache-2.0
    • +
  • org.springframework.security:spring-security-crypto — Apache-2.0
    • +
  • org.springframework.security:spring-security-oauth2-core — Apache-2.0
    • +
  • org.springframework.security:spring-security-oauth2-jose — Apache-2.0
    • +
  • org.springframework.security:spring-security-oauth2-resource-server — Apache-2.0
    • +
  • org.springframework.security:spring-security-web — Apache-2.0
    • +
  • org.springframework:spring-aop — Apache-2.0
    • +
  • org.springframework:spring-beans — Apache-2.0
    • +
  • org.springframework:spring-context — Apache-2.0
    • +
  • org.springframework:spring-core — Apache-2.0
    • +
  • org.springframework:spring-expression — Apache-2.0
    • +
  • org.springframework:spring-jcl — Apache-2.0
    • +
  • org.springframework:spring-messaging — Apache-2.0
    • +
  • org.springframework:spring-web — Apache-2.0
    • +
  • org.springframework:spring-webmvc — Apache-2.0
    • +
  • org.yaml:snakeyaml — Apache-2.0
    • +
+ + From 33af8dd240676dfe3a508f5b0c842d5f1a789820 Mon Sep 17 00:00:00 2001 From: Aditya Parikh Date: Mon, 5 Oct 2026 13:27:34 -0400 Subject: [PATCH 2/5] docs: list mcp-server-security as Apache-2.0 in the IP-clearance row Its published POM names the license only as "Apache License", with a URL to LICENSE-2.0.txt, which the CycloneDX plugin maps to Apache-1.0. The project is Apache-2.0 (github.com/spring-ai-community/mcp-security). Co-Authored-By: Claude Opus 5.5 (1M context) Signed-off-by: Aditya Parikh --- dev-docs/ip-clearance-licenses.xml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/dev-docs/ip-clearance-licenses.xml b/dev-docs/ip-clearance-licenses.xml index 78949578..e82dee58 100644 --- a/dev-docs/ip-clearance-licenses.xml +++ b/dev-docs/ip-clearance-licenses.xml @@ -125,7 +125,7 @@
  • org.slf4j:slf4j-api — MIT
  • org.snakeyaml:snakeyaml-engine — Apache-2.0
  • org.springaicommunity:mcp-annotations — MIT
    • -
  • org.springaicommunity:mcp-server-security — Apache-1.0
    • +
  • org.springaicommunity:mcp-server-security — Apache-2.0
  • org.springframework.ai:spring-ai-autoconfigure-mcp-server-common — Apache-2.0
  • org.springframework.ai:spring-ai-autoconfigure-mcp-server-webmvc — Apache-2.0
  • org.springframework.ai:spring-ai-commons — Apache-2.0
    • From e810863d81ceb412e63ca5de04134d1ae17d6702 Mon Sep 17 00:00:00 2001 From: Aditya Parikh Date: Mon, 5 Oct 2026 13:34:14 -0400 Subject: [PATCH 3/5] docs: list the ANTLR runtimes as BSD-3-Clause in the IP-clearance row ST4 and antlr-runtime 3 are under the three-clause BSD license (see LICENSE.txt in antlr/stringtemplate4). Their POMs name it only as "The BSD License" / "BSD licence", which the SBOM reports as BSD-4-Clause and as free text. Co-Authored-By: Claude Opus 5.5 (1M context) Signed-off-by: Aditya Parikh --- dev-docs/ip-clearance-licenses.xml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/dev-docs/ip-clearance-licenses.xml b/dev-docs/ip-clearance-licenses.xml index e82dee58..aded626b 100644 --- a/dev-docs/ip-clearance-licenses.xml +++ b/dev-docs/ip-clearance-licenses.xml @@ -98,8 +98,8 @@
  • jakarta.annotation:jakarta.annotation-api — EPL-2.0 / GPL-2.0-with-classpath-exception
  • jakarta.ws.rs:jakarta.ws.rs-api — EPL-2.0 / GPL-2.0-with-classpath-exception
  • javax.validation:validation-api — Apache-2.0
    • -
  • org.antlr:ST4 — BSD-4-Clause
    • -
  • org.antlr:antlr-runtime — BSD licence
    • +
  • org.antlr:ST4 — BSD-3-Clause
    • +
  • org.antlr:antlr-runtime — BSD-3-Clause
  • org.antlr:antlr4-runtime — BSD-3-Clause
  • org.apache.logging.log4j:log4j-api — Apache-2.0
  • org.apache.logging.log4j:log4j-to-slf4j — Apache-2.0
    • From 047a465ad75fa36be1081c2914bd293bb6c30227 Mon Sep 17 00:00:00 2001 From: Aditya Parikh Date: Mon, 5 Oct 2026 14:20:26 -0400 Subject: [PATCH 4/5] docs: list only direct dependencies in the IP-clearance rows Transitive dependencies are not part of the check, so the row now lists the project's direct runtime dependencies as declared in build.gradle.kts (14, instead of all 157 bundled jars). Also add the same row for the code base as it was imported, adityamparikh/solr-mcp-server @ cda37f29 (the last commit of that repository and an ancestor of main): its 6 direct runtime dependencies. Refs #216 Co-Authored-By: Claude Opus 5.5 (1M context) Signed-off-by: Aditya Parikh --- .../ip-clearance-licenses-solr-mcp-server.xml | 18 +++ dev-docs/ip-clearance-licenses.xml | 148 +----------------- 2 files changed, 20 insertions(+), 146 deletions(-) create mode 100644 dev-docs/ip-clearance-licenses-solr-mcp-server.xml diff --git a/dev-docs/ip-clearance-licenses-solr-mcp-server.xml b/dev-docs/ip-clearance-licenses-solr-mcp-server.xml new file mode 100644 index 00000000..525e1757 --- /dev/null +++ b/dev-docs/ip-clearance-licenses-solr-mcp-server.xml @@ -0,0 +1,18 @@ + + 2026-10-05 + Check and make sure that all items depended upon by the project are + covered by one or more of the following approved licenses: Apache, + BSD, Artistic, MIT/X, MIT/W3C, MPL 1.1, or something with + essentially the same terms. — The direct runtime dependencies of the imported code base, + adityamparikh/solr-mcp-server @ cda37f29, + as declared in its build.gradle.kts: +
      +
    • org.apache.commons:commons-csv — Apache-2.0
      • +
    • org.apache.solr:solr-solrj — Apache-2.0
      • +
    • org.jspecify:jspecify — Apache-2.0
      • +
    • org.springframework.ai:spring-ai-starter-mcp-server-webmvc — Apache-2.0
      • +
    • org.springframework.boot:spring-boot-starter-actuator — Apache-2.0
      • +
    • org.springframework.boot:spring-boot-starter-web — Apache-2.0
      • +
    + + diff --git a/dev-docs/ip-clearance-licenses.xml b/dev-docs/ip-clearance-licenses.xml index aded626b..f5cc529f 100644 --- a/dev-docs/ip-clearance-licenses.xml +++ b/dev-docs/ip-clearance-licenses.xml @@ -3,167 +3,23 @@ Check and make sure that all items depended upon by the project are covered by one or more of the following approved licenses: Apache, BSD, Artistic, MIT/X, MIT/W3C, MPL 1.1, or something with - essentially the same terms. — All runtime dependencies bundled in the - release (derived from the CycloneDX SBOM, as reported there; the full list - is also in META-INF/LICENSE of the executable JAR): + essentially the same terms. — The project's direct runtime dependencies, as declared + in build.gradle.kts:
      -
    • aopalliance:aopalliance — Public Domain
      • -
    • ch.qos.logback:logback-classic — EPL-2.0 / GNU Lesser General Public License
      • -
    • ch.qos.logback:logback-core — EPL-2.0 / GNU Lesser General Public License
      • -
    • com.ethlo.time:itu — Apache-2.0
      • -
    • com.fasterxml.jackson.core:jackson-annotations — Apache-2.0
      • -
    • com.fasterxml.jackson.core:jackson-core — Apache-2.0
      • -
    • com.fasterxml.jackson.core:jackson-databind — Apache-2.0
      • -
    • com.fasterxml.jackson.dataformat:jackson-dataformat-yaml — Apache-2.0
      • -
    • com.fasterxml.jackson.datatype:jackson-datatype-jdk8 — Apache-2.0
      • -
    • com.fasterxml.jackson.datatype:jackson-datatype-jsr310 — Apache-2.0
      • -
    • com.fasterxml.jackson.module:jackson-module-jsonSchema — Apache-2.0
      • -
    • com.fasterxml.jackson.module:jackson-module-parameter-names — Apache-2.0
      • -
    • com.fasterxml:classmate — Apache-2.0
      • -
    • com.github.stephenc.jcip:jcip-annotations — Apache-2.0
      • -
    • com.github.victools:jsonschema-generator — Apache-2.0
      • -
    • com.github.victools:jsonschema-module-jackson — Apache-2.0
      • -
    • com.github.victools:jsonschema-module-swagger-2 — Apache-2.0
      • -
    • com.google.cloud.opentelemetry:detector-resources-support — Apache-2.0
      • -
    • com.knuddels:jtokkit — MIT
      • -
    • com.networknt:json-schema-validator — Apache-2.0
      • -
    • com.nimbusds:nimbus-jose-jwt — Apache-2.0
      • -
    • com.squareup.okhttp3:okhttp — Apache-2.0
      • -
    • com.squareup.okio:okio-jvm — Apache-2.0
      • -
    • io.micrometer:context-propagation — Apache-2.0
      • -
    • io.micrometer:micrometer-commons — Apache-2.0
      • -
    • io.micrometer:micrometer-core — Apache-2.0
      • -
    • io.micrometer:micrometer-jakarta9 — Apache-2.0
      • -
    • io.micrometer:micrometer-observation — Apache-2.0
    • io.micrometer:micrometer-registry-prometheus — Apache-2.0
      • -
    • io.micrometer:micrometer-tracing — Apache-2.0
    • io.micrometer:micrometer-tracing-bridge-otel — Apache-2.0
      • -
    • io.modelcontextprotocol.sdk:mcp — MIT
      • -
    • io.modelcontextprotocol.sdk:mcp-core — MIT
      • -
    • io.modelcontextprotocol.sdk:mcp-json-jackson2 — MIT
      • -
    • io.modelcontextprotocol.sdk:mcp-spring-webmvc — MIT
      • -
    • io.opentelemetry.contrib:opentelemetry-aws-resources — Apache-2.0
      • -
    • io.opentelemetry.contrib:opentelemetry-baggage-processor — Apache-2.0
      • -
    • io.opentelemetry.contrib:opentelemetry-gcp-resources — Apache-2.0
      • -
    • io.opentelemetry.instrumentation:opentelemetry-instrumentation-annotations — Apache-2.0
      • -
    • io.opentelemetry.instrumentation:opentelemetry-instrumentation-annotations-support — Apache-2.0
      • -
    • io.opentelemetry.instrumentation:opentelemetry-instrumentation-api — Apache-2.0
      • -
    • io.opentelemetry.instrumentation:opentelemetry-instrumentation-api-incubator — Apache-2.0
      • -
    • io.opentelemetry.instrumentation:opentelemetry-jdbc — Apache-2.0
      • -
    • io.opentelemetry.instrumentation:opentelemetry-kafka-clients-2.6 — Apache-2.0
      • -
    • io.opentelemetry.instrumentation:opentelemetry-kafka-clients-common — Apache-2.0
      • -
    • io.opentelemetry.instrumentation:opentelemetry-log4j-appender-2.17 — Apache-2.0
      • -
    • io.opentelemetry.instrumentation:opentelemetry-log4j-context-data-2.17-autoconfigure — Apache-2.0
      • -
    • io.opentelemetry.instrumentation:opentelemetry-logback-appender-1.0 — Apache-2.0
      • -
    • io.opentelemetry.instrumentation:opentelemetry-logback-mdc-1.0 — Apache-2.0
      • -
    • io.opentelemetry.instrumentation:opentelemetry-micrometer-1.5 — Apache-2.0
      • -
    • io.opentelemetry.instrumentation:opentelemetry-mongo-3.1 — Apache-2.0
      • -
    • io.opentelemetry.instrumentation:opentelemetry-reactor-3.1 — Apache-2.0
      • -
    • io.opentelemetry.instrumentation:opentelemetry-resources — Apache-2.0
      • -
    • io.opentelemetry.instrumentation:opentelemetry-sdk-autoconfigure-support — Apache-2.0
      • -
    • io.opentelemetry.instrumentation:opentelemetry-spring-boot-autoconfigure — Apache-2.0
    • io.opentelemetry.instrumentation:opentelemetry-spring-boot-starter — Apache-2.0
      • -
    • io.opentelemetry.instrumentation:opentelemetry-spring-kafka-2.7 — Apache-2.0
      • -
    • io.opentelemetry.instrumentation:opentelemetry-spring-web-3.1 — Apache-2.0
      • -
    • io.opentelemetry.instrumentation:opentelemetry-spring-webflux-5.3 — Apache-2.0
      • -
    • io.opentelemetry.instrumentation:opentelemetry-spring-webmvc-5.3 — Apache-2.0
      • -
    • io.opentelemetry.instrumentation:opentelemetry-spring-webmvc-6.0 — Apache-2.0
      • -
    • io.opentelemetry.semconv:opentelemetry-semconv — Apache-2.0
      • -
    • io.opentelemetry.semconv:opentelemetry-semconv-incubating — Apache-2.0
      • -
    • io.opentelemetry:opentelemetry-api — Apache-2.0
      • -
    • io.opentelemetry:opentelemetry-api-incubator — Apache-2.0
      • -
    • io.opentelemetry:opentelemetry-context — Apache-2.0
      • -
    • io.opentelemetry:opentelemetry-exporter-common — Apache-2.0
      • -
    • io.opentelemetry:opentelemetry-exporter-logging — Apache-2.0
      • -
    • io.opentelemetry:opentelemetry-exporter-otlp — Apache-2.0
      • -
    • io.opentelemetry:opentelemetry-exporter-otlp-common — Apache-2.0
      • -
    • io.opentelemetry:opentelemetry-exporter-sender-okhttp — Apache-2.0
      • -
    • io.opentelemetry:opentelemetry-extension-trace-propagators — Apache-2.0
      • -
    • io.opentelemetry:opentelemetry-sdk — Apache-2.0
      • -
    • io.opentelemetry:opentelemetry-sdk-common — Apache-2.0
      • -
    • io.opentelemetry:opentelemetry-sdk-extension-autoconfigure — Apache-2.0
      • -
    • io.opentelemetry:opentelemetry-sdk-extension-autoconfigure-spi — Apache-2.0
      • -
    • io.opentelemetry:opentelemetry-sdk-extension-incubator — Apache-2.0
      • -
    • io.opentelemetry:opentelemetry-sdk-logs — Apache-2.0
      • -
    • io.opentelemetry:opentelemetry-sdk-metrics — Apache-2.0
      • -
    • io.opentelemetry:opentelemetry-sdk-trace — Apache-2.0
      • -
    • io.projectreactor:reactor-core — Apache-2.0
      • -
    • io.prometheus:prometheus-metrics-config — Apache-2.0
      • -
    • io.prometheus:prometheus-metrics-core — Apache-2.0
      • -
    • io.prometheus:prometheus-metrics-exposition-formats — Apache-2.0
      • -
    • io.prometheus:prometheus-metrics-exposition-textformats — Apache-2.0
      • -
    • io.prometheus:prometheus-metrics-model — Apache-2.0
      • -
    • io.prometheus:prometheus-metrics-tracer-common — Apache-2.0
      • -
    • io.swagger.core.v3:swagger-annotations-jakarta — Apache-2.0
      • -
    • jakarta.annotation:jakarta.annotation-api — EPL-2.0 / GPL-2.0-with-classpath-exception
      • -
    • jakarta.ws.rs:jakarta.ws.rs-api — EPL-2.0 / GPL-2.0-with-classpath-exception
      • -
    • javax.validation:validation-api — Apache-2.0
      • -
    • org.antlr:ST4 — BSD-3-Clause
      • -
    • org.antlr:antlr-runtime — BSD-3-Clause
      • -
    • org.antlr:antlr4-runtime — BSD-3-Clause
      • -
    • org.apache.logging.log4j:log4j-api — Apache-2.0
      • -
    • org.apache.logging.log4j:log4j-to-slf4j — Apache-2.0
      • -
    • org.apache.solr:solr-api — Apache-2.0
    • org.apache.solr:solr-solrj — Apache-2.0
      • -
    • org.apache.tomcat.embed:tomcat-embed-core — Apache-2.0
      • -
    • org.apache.tomcat.embed:tomcat-embed-el — Apache-2.0
      • -
    • org.apache.tomcat.embed:tomcat-embed-websocket — Apache-2.0
      • -
    • org.aspectj:aspectjweaver — EPL-2.0
    • org.commonmark:commonmark — BSD-2-Clause
    • org.commonmark:commonmark-ext-yaml-front-matter — BSD-2-Clause
      • -
    • org.hdrhistogram:HdrHistogram — CC0-1.0 / BSD-2-Clause
      • -
    • org.jetbrains.kotlin:kotlin-stdlib — Apache-2.0
      • -
    • org.jetbrains.kotlin:kotlin-stdlib-jdk7 — Apache-2.0
      • -
    • org.jetbrains.kotlin:kotlin-stdlib-jdk8 — Apache-2.0
      • -
    • org.jetbrains:annotations — Apache-2.0
    • org.jspecify:jspecify — Apache-2.0
      • -
    • org.latencyutils:LatencyUtils — CC0-1.0
      • -
    • org.reactivestreams:reactive-streams — MIT-0
      • -
    • org.semver4j:semver4j — MIT
      • -
    • org.slf4j:jcl-over-slf4j — Apache-2.0
      • -
    • org.slf4j:jul-to-slf4j — MIT
      • -
    • org.slf4j:slf4j-api — MIT
      • -
    • org.snakeyaml:snakeyaml-engine — Apache-2.0
      • -
    • org.springaicommunity:mcp-annotations — MIT
    • org.springaicommunity:mcp-server-security — Apache-2.0
      • -
    • org.springframework.ai:spring-ai-autoconfigure-mcp-server-common — Apache-2.0
      • -
    • org.springframework.ai:spring-ai-autoconfigure-mcp-server-webmvc — Apache-2.0
      • -
    • org.springframework.ai:spring-ai-commons — Apache-2.0
      • -
    • org.springframework.ai:spring-ai-mcp — Apache-2.0
      • -
    • org.springframework.ai:spring-ai-mcp-annotations — Apache-2.0
      • -
    • org.springframework.ai:spring-ai-model — Apache-2.0
    • org.springframework.ai:spring-ai-starter-mcp-server-webmvc — Apache-2.0
      • -
    • org.springframework.ai:spring-ai-template-st — Apache-2.0
      • -
    • org.springframework.boot:spring-boot — Apache-2.0
      • -
    • org.springframework.boot:spring-boot-actuator — Apache-2.0
      • -
    • org.springframework.boot:spring-boot-actuator-autoconfigure — Apache-2.0
      • -
    • org.springframework.boot:spring-boot-autoconfigure — Apache-2.0
      • -
    • org.springframework.boot:spring-boot-starter — Apache-2.0
    • org.springframework.boot:spring-boot-starter-actuator — Apache-2.0
    • org.springframework.boot:spring-boot-starter-aop — Apache-2.0
      • -
    • org.springframework.boot:spring-boot-starter-json — Apache-2.0
      • -
    • org.springframework.boot:spring-boot-starter-logging — Apache-2.0
    • org.springframework.boot:spring-boot-starter-oauth2-resource-server — Apache-2.0
    • org.springframework.boot:spring-boot-starter-security — Apache-2.0
      • -
    • org.springframework.boot:spring-boot-starter-tomcat — Apache-2.0
    • org.springframework.boot:spring-boot-starter-web — Apache-2.0
      • -
    • org.springframework.security:spring-security-config — Apache-2.0
      • -
    • org.springframework.security:spring-security-core — Apache-2.0
      • -
    • org.springframework.security:spring-security-crypto — Apache-2.0
      • -
    • org.springframework.security:spring-security-oauth2-core — Apache-2.0
      • -
    • org.springframework.security:spring-security-oauth2-jose — Apache-2.0
      • -
    • org.springframework.security:spring-security-oauth2-resource-server — Apache-2.0
      • -
    • org.springframework.security:spring-security-web — Apache-2.0
      • -
    • org.springframework:spring-aop — Apache-2.0
      • -
    • org.springframework:spring-beans — Apache-2.0
      • -
    • org.springframework:spring-context — Apache-2.0
      • -
    • org.springframework:spring-core — Apache-2.0
      • -
    • org.springframework:spring-expression — Apache-2.0
      • -
    • org.springframework:spring-jcl — Apache-2.0
      • -
    • org.springframework:spring-messaging — Apache-2.0
      • -
    • org.springframework:spring-web — Apache-2.0
      • -
    • org.springframework:spring-webmvc — Apache-2.0
      • -
    • org.yaml:snakeyaml — Apache-2.0
    From 4a96d5e85ff87baf6df05805c8a4740e700d7ae0 Mon Sep 17 00:00:00 2001 From: Aditya Parikh Date: Mon, 5 Oct 2026 14:25:05 -0400 Subject: [PATCH 5/5] docs: close the IP-clearance rows with the license-category statement Match the accepted Solr Orbit row, which ends by stating the ASF license categories of the listed dependencies. Co-Authored-By: Claude Opus 5.5 (1M context) Signed-off-by: Aditya Parikh --- dev-docs/ip-clearance-licenses-solr-mcp-server.xml | 2 ++ dev-docs/ip-clearance-licenses.xml | 2 ++ 2 files changed, 4 insertions(+) diff --git a/dev-docs/ip-clearance-licenses-solr-mcp-server.xml b/dev-docs/ip-clearance-licenses-solr-mcp-server.xml index 525e1757..94d5b463 100644 --- a/dev-docs/ip-clearance-licenses-solr-mcp-server.xml +++ b/dev-docs/ip-clearance-licenses-solr-mcp-server.xml @@ -14,5 +14,7 @@
  • org.springframework.boot:spring-boot-starter-actuator — Apache-2.0
  • org.springframework.boot:spring-boot-starter-web — Apache-2.0
    • + All licenses are Category A (Apache-2.0), compatible with the Apache + License per ASF policy. diff --git a/dev-docs/ip-clearance-licenses.xml b/dev-docs/ip-clearance-licenses.xml index f5cc529f..cefdeacd 100644 --- a/dev-docs/ip-clearance-licenses.xml +++ b/dev-docs/ip-clearance-licenses.xml @@ -21,5 +21,7 @@
  • org.springframework.boot:spring-boot-starter-security — Apache-2.0
  • org.springframework.boot:spring-boot-starter-web — Apache-2.0
    • + All licenses are Category A (Apache-2.0, BSD-2-Clause), compatible with + the Apache License per ASF policy.