atgc vendors third-party code without the notices its licences require. vendor/jacquard-oauth is a modified copy of the MPL-2.0 jacquard-oauth crate and carried no licence text. The lexicons and vendor/tangled-lexicon come from Tangled's MIT-licensed core repo and carried none either.
This adds the full MPL-2.0 text to vendor/jacquard-oauth/LICENSE, with a README note naming the upstream and pointing at the modified source in this repository, and Tangled's MIT text to lexicons/LICENSE-tangled and vendor/tangled-lexicon/LICENSE. vendor/tangled-lexicon now declares license = "MIT", the vendoring scripts still leave both notices in place, and cargo deny passes.
🤖 Generated with Claude Code