# Third-party notices

shithub depends on the open-source software listed below. Each
entry includes the module path, the license SPDX identifier as
detected by go-licenses, and a link upstream. The full license
texts are bundled with each Go module under your `$GOPATH/pkg/mod/`
checkout when you build from source; this file is the index, not
the corpus.

This file is generated by `scripts/gen-third-party-notices.sh`
from the active `go.mod`. Do not edit by hand; re-run the script
when bumping dependencies and commit the result in the same PR.

CI verifies that the committed file is byte-identical to a fresh
generation.

## Modules

| Module | License | Source |
|---|---|---|
| `github.com/alecthomas/chroma/v2` | MIT | [link](https://github.com/alecthomas/chroma) |
| `github.com/bluekeyes/go-gitdiff` | MIT | [link](https://github.com/bluekeyes/go-gitdiff) |
| `github.com/boombuler/barcode` | MIT | [link](https://github.com/boombuler/barcode) |
| `github.com/BurntSushi/toml` | MIT | [link](https://github.com/BurntSushi/toml) |
| `github.com/getsentry/sentry-go` | MIT | [link](https://github.com/getsentry/sentry-go) |
| `github.com/go-chi/chi/v5` | MIT | [link](https://github.com/go-chi/chi) |
| `github.com/jackc/pgx/v5` | MIT | [link](https://github.com/jackc/pgx) |
| `github.com/justinas/nosurf` | MIT | [link](https://github.com/justinas/nosurf) |
| `github.com/microcosm-cc/bluemonday` | BSD-3-Clause | [link](https://github.com/microcosm-cc/bluemonday) |
| `github.com/minio/minio-go/v7` | Apache-2.0 | [link](https://github.com/minio/minio-go) |
| `github.com/pquerna/otp` | Apache-2.0 | [link](https://github.com/pquerna/otp) |
| `github.com/pressly/goose/v3` | MIT | [link](https://github.com/pressly/goose) |
| `github.com/prometheus/client_golang` | Apache-2.0 | [link](https://github.com/prometheus/client_golang) |
| `github.com/spf13/cobra` | Apache-2.0 | [link](https://github.com/spf13/cobra) |
| `github.com/yuin/goldmark` | MIT | [link](https://github.com/yuin/goldmark) |
| `go.opentelemetry.io/otel` | Apache-2.0 | [link](https://github.com/open-telemetry/opentelemetry-go) |
| `go.opentelemetry.io/otel/exporters/otlp/otlptrace` | Apache-2.0 | [link](https://github.com/open-telemetry/opentelemetry-go) |
| `go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp` | Apache-2.0 | [link](https://github.com/open-telemetry/opentelemetry-go) |
| `go.opentelemetry.io/otel/sdk` | Apache-2.0 | [link](https://github.com/open-telemetry/opentelemetry-go) |
| `go.opentelemetry.io/otel/trace` | Apache-2.0 | [link](https://github.com/open-telemetry/opentelemetry-go) |
| `golang.org/x/crypto` | BSD-3-Clause | [link](https://cs.opensource.google/go/x/crypto) |
| `golang.org/x/image` | BSD-3-Clause | [link](https://cs.opensource.google/go/x/image) |
| `golang.org/x/sync` | BSD-3-Clause | [link](https://cs.opensource.google/go/x/sync) |

## Notes

- Modules under `golang.org/x/...` are subject to the
  [Go BSD-style license](https://go.dev/LICENSE) unless noted
  otherwise.
- The Go standard library and toolchain are licensed under the
  [Go BSD-style license](https://go.dev/LICENSE) and are not
  enumerated here.
- A small number of dependencies expose multiple licenses in
  their repository (e.g., a base license plus an alternate for
  bundled vendor code). go-licenses reports the one applying to
  the imported package; full license materials are in each
  module's distribution.
- Indirect (transitive) dependencies are subject to their own
  licenses. Run `go mod graph` for the full dependency tree;
  `go-licenses csv ./...` enumerates licenses for everything
  imported by build, not just the direct `require` block.