Docs
Third-party notices
Localization OS is built on excellent, openly licensed software. This page lists the dependencies of a standard installation and their licenses, the optional components and their licenses, and the design provenance behind the built-in connectors.
A standard install pulls a locked set of packages. A few optional components add a handful more, only when you turn them on. This page lists the complete standard install, package by package, plus the reference material that shaped how Localization OS's built-in connectors were designed. The same inventory ships with the codebase as a locked requirements file.
Copyleft and weak-copyleft dependencies#
Most of the standard install is permissively licensed: MIT, BSD, Apache-2.0. A small number of dependencies carry copyleft or weak-copyleft terms. They are listed here plainly, license as recorded by the package itself, no editorializing.
| Package | License | Role |
|---|---|---|
| certifi | MPL-2.0 | Certificate authority bundle |
| tqdm | MPL-2.0 AND MIT | Progress display utility |
Every package above is a standard, unmodified release installed from PyPI. The standard install carries no GPL-family code: no GPL, LGPL or AGPL dependency. The two MPL entries are file-level weak copyleft, unmodified, and impose nothing on the product. Two optional integrations bring an LGPL driver only when you install their extra: the PostgreSQL driver (psycopg, via requirements-postgres.txt) and the LDAP client (ldap3, via requirements-ldap.txt). A default install runs on SQLite with local authentication and includes neither. A test in the codebase scans the locked dependency tree's license metadata on every change and fails on any GPL-family license, so this statement is enforced, not asserted.
Standard installation dependencies#
Every package in a standard Localization OS install, sorted alphabetically, with the license each package records for itself. The PDF stack is pypdfium2 (parsing and rendering) and typst (generating translated PDFs).
| Package | Version | License |
|---|---|---|
| alembic | 1.20.0 | MIT |
| annotated-doc | 0.0.5 | MIT |
| annotated-types | 0.8.0 | MIT |
| anthropic | 1.11.0 | MIT |
| anyio | 4.15.1 | MIT |
| argon2-cffi | 25.1.0 | MIT |
| argon2-cffi-bindings | 26.1.0 | MIT |
| attrs | 26.1.0 | MIT |
| babel | 2.18.0 | BSD-3-Clause |
| certifi | 2026.7.22 | MPL-2.0 |
| cffi | 2.1.1 | MIT-0 |
| charset-normalizer | 3.5.1 | MIT |
| click | 8.5.0 | BSD-3-Clause |
| colorama | 0.4.6 | BSD-3-Clause |
| cryptography | 50.0.1 | Apache-2.0 OR BSD-3-Clause |
| distro | 1.9.0 | Apache-2.0 |
| docstring_parser | 0.18.0 | MIT |
| et_xmlfile | 2.0.0 | MIT |
| fastapi | 0.142.2 | MIT |
| fluent.syntax | 0.19.0 | Apache-2.0 |
| google-auth | 2.57.1 | Apache-2.0 |
| google-genai | 2.28.0 | Apache-2.0 |
| greenlet | 3.5.5 | MIT AND PSF-2.0 |
| h11 | 0.16.0 | MIT |
| httpcore | 1.0.9 | BSD-3-Clause |
| httpcore2 | 2.13.1 | BSD-3-Clause |
| httptools | 0.8.0 | MIT |
| httpx | 0.28.1 | BSD-3-Clause |
| httpx2 | 2.13.1 | BSD-3-Clause |
| idna | 3.20 | BSD-3-Clause |
| itsdangerous | 2.2.0 | BSD-3-Clause |
| Jinja2 | 3.1.6 | BSD-3-Clause |
| jiter | 0.16.0 | MIT |
| jsonschema | 4.26.0 | MIT |
| jsonschema-specifications | 2025.9.1 | MIT |
| lxml | 6.1.3 | BSD-3-Clause |
| Mako | 1.4.1 | MIT |
| MarkupSafe | 3.0.3 | BSD-3-Clause |
| mcp | 2.3.0 | MIT |
| mcp-types | 2.3.0 | MIT |
| numpy | 2.4.6 | BSD-3-Clause AND 0BSD AND MIT AND Zlib AND CC0-1.0 |
| openai | 2.54.0 | Apache-2.0 |
| openpyxl | 3.1.5 | MIT |
| opentelemetry-api | 1.45.0 | Apache-2.0 |
| packaging | 26.3 | Apache-2.0 OR BSD-2-Clause |
| pillow | 12.3.0 | MIT-CMU |
| portalocker | 4.3.0 | BSD-3-Clause |
| pyasn1 | 0.6.4 | BSD-2-Clause |
| pyasn1_modules | 0.4.2 | BSD-3-Clause |
| pycparser | 3.0 | BSD-3-Clause |
| pydantic | 2.13.5 | MIT |
| pydantic_core | 2.46.5 | MIT |
| PyJWT | 2.15.1 | MIT |
| pypdfium2 | 5.14.0 | BSD-3-Clause OR Apache-2.0 |
| python-docx | 1.2.0 | MIT |
| python-dotenv | 1.2.4 | BSD-3-Clause |
| python-multipart | 0.0.32 | Apache-2.0 |
| pywin32 (Windows only) | 312 | PSF-2.0 |
| PyYAML | 6.0.3 | MIT |
| RapidFuzz | 3.14.5 | MIT |
| referencing | 0.37.0 | MIT |
| regex | 2026.9.29 | Apache-2.0 AND CNRI-Python |
| requests | 2.34.2 | Apache-2.0 |
| rpds-py | 2026.6.3 | MIT |
| sacrebleu | 2.6.0 | Apache-2.0 |
| segno | 1.6.6 | BSD-3-Clause |
| sniffio | 1.3.1 | MIT OR Apache-2.0 |
| socksio | 1.0.0 | MIT |
| SQLAlchemy | 2.0.52 | MIT |
| sqlmodel | 0.0.44 | MIT |
| sse-starlette | 3.0.3 | BSD-3-Clause |
| starlette | 1.7.0 | BSD-3-Clause |
| tabulate | 0.10.0 | MIT |
| tenacity | 9.1.4 | Apache-2.0 |
| tqdm | 4.70.0 | MPL-2.0 AND MIT |
| truststore | 0.10.4 | MIT |
| typing-inspection | 0.4.4 | MIT |
| typing_extensions | 4.16.0 | PSF-2.0 |
| typst | 0.15.0 | Apache-2.0 |
| urllib3 | 2.8.0 | MIT |
| uvicorn | 0.54.0 | BSD-3-Clause |
| uvloop (not on Windows) | 0.22.1 | MIT OR Apache-2.0 |
| watchfiles | 1.2.0 | MIT |
| websockets | 14.2 | BSD-3-Clause |
Optional components#
A handful of features are opt-in and bring their own dependencies, only installed when you turn the feature on.
| Optional feature | Package | License |
|---|---|---|
| PostgreSQL backend | psycopg, psycopg-binary | LGPL-3.0-only |
| LDAP / Active Directory sign-in | ldap3 | LGPL-3.0 |
| S3-compatible storage | boto3 | Apache-2.0 |
| Metrics | prometheus_client | Apache-2.0 AND BSD-2-Clause |
| Local OCR | rapidocr | Apache-2.0 |
| Local OCR | onnxruntime | MIT |
| PII detection | presidio-analyzer | MIT |
| PII detection | spacy | MIT |
| PII detection | en_core_web_lg (spaCy language model) | MIT |
| PII detection | en_core_web_sm (spaCy language model) | MIT |
| SAML single sign-on | python3-saml | MIT |
| SAML single sign-on | xmlsec | MIT |
| At-rest database encryption | sqlcipher3 | MIT |
On the last row: the sqlcipher3 Python binding itself is MIT-licensed. SQLCipher, the encryption engine it binds to, is licensed separately by its publisher; that license is not restated here, see the publisher's own terms.
Connector design provenance#
Several of Localization OS's built-in connectors were designed by studying MIT-licensed reference connectors published by Blackbird at the bb-io GitHub organization. In every case the approach was reference-and-reimplement: the design, meaning endpoint coverage, auth flow, pagination, and localization strategy, was understood from the reference implementation and then written fresh. No code or assets were copied from any bb-io repository, and known defects in the references (such as echoing whole upstream error bodies or building queries by string concatenation) were deliberately not carried over. Attribution is given below with respect to the original authors.
- Strapi: reference at github.com/bb-io/Strapi
- Contentful: reference at github.com/bb-io/Contentful
- Shopify: reference at github.com/bb-io/Shopify
- HubSpot: reference at github.com/bb-io/Hubspot
- WordPress: reference at github.com/bb-io/Wordpress
- Akeneo: reference at github.com/bb-io/Akeneo
- Drupal: reference at github.com/bb-io/Drupal
- Sitecore: reference at github.com/bb-io/SitecoreGraphQl
- GitHub: reference at github.com/bb-io/Github
The Plytix connector consulted the API notes in Supplyline/plytix-mcp (MIT, (c) 2025 Eric Pittman) for facts about endpoint paths and payload shapes only; no code was copied.
Bundled material#
- TBX-Basic v3 conformance files. The TBX core RELAX NG schema and the TBX-Basic DCA Schematron from the LTAC-Global repositories are vendored unmodified for strict glossary validation and never fetched at runtime. The upstream repositories carry no license file, so their license is recorded as unverified.
- driver.js 1.8.0 (MIT, (c) Kamran Ahmed), vendored unmodified for the optional onboarding spotlight.
- Public Sans and JetBrains Mono (SIL Open Font License 1.1), subset and served by the app itself, with their license files beside them.
- Common-password list derived from SecLists by Daniel Miessler (MIT), normalized for the password policy's common-password rule.
- Haiku catalog format. The .catkeys reader was written from the MIT-licensed Haiku Locale Kit sources ((c) 2009 Adrien Destugues); one small fingerprint calculation was reimplemented, and no code was copied.
The licenses of every package listed on this page are available from their respective projects. Questions about this page: brent@patoislabs.com.