📦 WP-114b — refine(deps): cap mkdocs below the unlicensed major¶
Engineering log · Phase 11 — Rolling, toward v0.5.0
WP-114b — an unlicensed dependency is not one the audit can see¶
Building the site prints a notice from the Material team about the upstream MkDocs 2.0 release. One line of it is a licence fact rather than an opinion about the release: "Currently unlicensed – unsuitable for production use". This project admits permissive licences only, and unlicensed is not a weaker version of permissive — it is stricter than the AGPL the audit bans, because the default with no declared licence is no grant at all.
The audit would not have caught it. scripts/audit_licenses.py matches COPYLEFT_PATTERN — a GPL-family regex — against what each installed distribution declares, and reports only what matches. A distribution that declares nothing matches nothing and passes silently, in the same run that reports the environment clean. The control this project relies on for licence exposure is shaped to catch a forbidden declaration, not an absent one, so the bound has to be a version cap: mkdocs>=1.6,<2, which keeps the resolution from happening rather than detecting it afterwards.
The cap is asserted in scripts/_tests/test_audit_docs_site.py because it is the kind of pin a routine dependency bump lifts without anyone deciding to. The assertion is keyed on the version operator directly after the name, since mkdocs-material shares the prefix and sits two lines away in the same list — without that, a deleted mkdocs pin would move the assertion silently onto its neighbour and keep passing. Resolution after the cap: mkdocs 1.6.1, mkdocs-material 9.7.7, 29 packages. Lift it when 2.x ships a permissive LICENSE, verified from the repository rather than from the notice.