From bc5c2f9be09d38ab5333a6c8c6f363745b544720 Mon Sep 17 00:00:00 2001
From: Dinesh Pandiyan <flexdinesh@gmail.com>
Date: Sun, 25 Oct 2026 00:01:29 +1100
Subject: [PATCH] docs: record dependency license audit; mark docs site MIT

---
 docs-website/package.json |  1 +
 docs/release.md           | 22 ++++++++++++++++++++++
 2 files changed, 23 insertions(+)

diff --git a/docs-website/package.json b/docs-website/package.json
index b24afe79..a5eaab10 100644
--- a/docs-website/package.json
+++ b/docs-website/package.json
@@ -1,6 +1,7 @@
 {
   "name": "@diffx/docs",
   "private": true,
+  "license": "MIT",
   "type": "module",
   "scripts": {
     "dev": "vocs dev",
diff --git a/docs/release.md b/docs/release.md
index c84f8c90..a963c829 100644
--- a/docs/release.md
+++ b/docs/release.md
@@ -115,3 +115,25 @@ Stage assets locally before Go builds and tests:
 ```sh
 mise run web:stage
 ```
+
+## Licensing
+
+diffx is MIT licensed. Linked Go modules and runtime npm dependencies use
+permissive licenses (MIT, BSD, ISC, Apache-2.0, 0BSD, BlueOak-1.0.0). The
+JetBrains Mono font is OFL-1.1.
+
+Known exceptions, accepted after the October 2026 dependency audit:
+
+- The embedded web bundle includes every Shiki grammar and theme as lazy
+  chunks. The upstream sources (per `tm-grammars`/`tm-themes` metadata) of grammars
+  `ada`, `nginx`, `org`, `racket` and `ahk2` and theme `aurora-x` are GPL-3.0;
+  `hcl`, `terraform` and `bird2` are MPL-2.0; about 30 grammars, mostly
+  TextMate bundles such as `yaml` and `toml`, declare no detectable license.
+- The docs site's build-only dependency `vocs` pulls `@codesandbox/nodebox`
+  (Sustainable Use License, non-commercial). It is not in the published site or
+  any release artifact.
+- Build and test tooling includes MPL-2.0 (`lightningcss`), CC-BY-4.0
+  (`caniuse-lite`) and Python-2.0 (`argparse`) packages; none are shipped.
+
+Recheck with `pnpm licenses list -r` and the `LICENSE` files of `go list -deps`
+modules when adding dependencies.