From d23b4b3abfcd5dfdaab5bac4f9c4570b5266ea18 Mon Sep 17 00:00:00 2001 From: Brandon Date: Tue, 22 Sep 2026 06:47:08 -0400 Subject: [PATCH] ci: scope Go patent-license exception --- .github/workflows/dependency-review.yml | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/.github/workflows/dependency-review.yml b/.github/workflows/dependency-review.yml index 4953ebf..35417b0 100644 --- a/.github/workflows/dependency-review.yml +++ b/.github/workflows/dependency-review.yml @@ -30,3 +30,8 @@ jobs: allow-licenses: >- Apache-2.0, MIT, BSD-2-Clause, BSD-3-Clause, ISC, MPL-2.0, 0BSD, Unlicense, CC0-1.0, BlueOak-1.0.0, Python-2.0, PSF-2.0 + # Go's x/net and x/sys modules are BSD-3-Clause and also ship the + # Go project's royalty-free patent grant. Scope the exception to + # these two module PURLs; vulnerability review remains enabled. + allow-dependencies-licenses: >- + pkg:golang/golang.org/x/net, pkg:golang/golang.org/x/sys