Open Source Software Licenses#
The scanner programs and other software that FutureVuls provides to customers include open source software (OSS). The license terms of each OSS component are available at the links on this page.
Scanner Program (Vuls)#
The vuls scanner program is built from Vuls without modification. Vuls is provided under the GNU General Public License v3.0.
- License: GPL-3.0
- Source code: from the Vuls releases, refer to the tag that matches the version shown by
vuls -v.
trivy-to-vuls and future-vuls, provided for the Trivy integration, are also part of Vuls. Their license and source code are available at the same locations as above.
OSS Included in Vuls v0.41.0 (vuls, trivy-to-vuls, future-vuls)#
| Package | Version | License |
|---|---|---|
| Go standard library | - | BSD-3-Clause |
github.com/Azure/azure-sdk-for-go/sdk/azcore |
v1.23.1 |
MIT |
github.com/Azure/azure-sdk-for-go/sdk/internal |
v1.12.0 |
MIT |
github.com/Azure/azure-sdk-for-go/sdk/storage/azblob |
v1.8.1 |
MIT |
github.com/BurntSushi/toml |
v1.6.0 |
MIT |
github.com/CycloneDX/cyclonedx-go |
v0.12.0 |
Apache-2.0 |
github.com/Ullaakut/nmap/v2 |
v2.2.2 |
MIT |
github.com/agext/levenshtein |
v1.2.3 |
Apache-2.0 |
github.com/alecthomas/chroma |
v0.10.0 |
MIT |
github.com/anchore/go-struct-converter |
v0.1.0 |
Apache-2.0 |
github.com/apache/arrow-go/v18 |
v18.7.0 |
Apache-2.0 |
github.com/apache/arrow-go/v18 |
v18.7.0 |
BSD-3-Clause |
github.com/apparentlymart/go-textseg/v15/textseg |
v15.0.0 |
MIT |
github.com/apparentlymart/go-textseg/v15/textseg |
v15.0.0 |
Unicode-DFS-2016 |
github.com/aquasecurity/go-pep440-version |
v0.0.2-0.20260224065243-f9bba28c51a4 |
Apache-2.0 |
github.com/aquasecurity/go-version/pkg |
v0.0.1 |
Apache-2.0 |
github.com/aquasecurity/iamgo |
v0.0.10 |
MIT |
github.com/aquasecurity/jfather |
v0.0.8 |
MIT |
github.com/aquasecurity/trivy-checks/pkg/compliance |
v1.12.2-0.20251219190323-79d27547baf5 |
MIT |
github.com/aquasecurity/trivy-db/pkg |
v0.0.0-20260813095258-0e0340a01b57 |
Apache-2.0 |
github.com/aquasecurity/trivy/pkg |
v0.74.0 |
Apache-2.0 |
github.com/asaskevich/govalidator |
v0.0.0-20230301143203-a9d515a09cc2 |
MIT |
github.com/aws/aws-sdk-go-v2 |
v1.47.1 |
Apache-2.0 |
github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream |
v1.7.20 |
Apache-2.0 |
github.com/aws/aws-sdk-go-v2/config |
v1.33.6 |
Apache-2.0 |
github.com/aws/aws-sdk-go-v2/credentials |
v1.20.6 |
Apache-2.0 |
github.com/aws/aws-sdk-go-v2/feature/ec2/imds |
v1.20.1 |
Apache-2.0 |
github.com/aws/aws-sdk-go-v2/internal/configsources |
v1.5.4 |
Apache-2.0 |
github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 |
v2.8.4 |
Apache-2.0 |
github.com/aws/aws-sdk-go-v2/internal/sync/singleflight |
v1.47.1 |
BSD-3-Clause |
github.com/aws/aws-sdk-go-v2/internal/v4a |
v1.5.4 |
Apache-2.0 |
github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding |
v1.13.19 |
Apache-2.0 |
github.com/aws/aws-sdk-go-v2/service/internal/checksum |
v1.11.5 |
Apache-2.0 |
github.com/aws/aws-sdk-go-v2/service/internal/presigned-url |
v1.14.4 |
Apache-2.0 |
github.com/aws/aws-sdk-go-v2/service/internal/s3shared |
v1.20.4 |
Apache-2.0 |
github.com/aws/aws-sdk-go-v2/service/s3 |
v1.113.4 |
Apache-2.0 |
github.com/aws/aws-sdk-go-v2/service/signin |
v1.10.1 |
Apache-2.0 |
github.com/aws/aws-sdk-go-v2/service/sso |
v1.38.1 |
Apache-2.0 |
github.com/aws/aws-sdk-go-v2/service/ssooidc |
v1.43.1 |
Apache-2.0 |
github.com/aws/aws-sdk-go-v2/service/sts |
v1.51.1 |
Apache-2.0 |
github.com/aws/smithy-go |
v1.28.1 |
Apache-2.0 |
github.com/aws/smithy-go/internal/sync/singleflight |
v1.28.1 |
BSD-3-Clause |
github.com/bmatcuk/doublestar/v4 |
v4.10.0 |
MIT |
github.com/c-robinson/iplib |
v1.0.8 |
MIT |
github.com/cenkalti/backoff |
v2.2.1 |
MIT |
github.com/cespare/xxhash/v2 |
v2.3.0 |
MIT |
github.com/clipperhouse/displaywidth |
v0.10.0 |
MIT |
github.com/clipperhouse/uax29/v2/graphemes |
v2.7.0 |
MIT |
github.com/davecgh/go-spew/spew |
v1.1.2-0.20180830191138-d8f796af33cc |
ISC |
github.com/dlclark/regexp2 |
v1.11.0 |
MIT |
github.com/emersion/go-sasl |
v0.0.0-20241020182733-b788ff22d5a6 |
MIT |
github.com/emersion/go-smtp |
v0.25.0 |
MIT |
github.com/fatih/color |
v1.19.0 |
MIT |
github.com/goccy/go-json |
v0.10.6 |
MIT |
github.com/google/flatbuffers/go |
v25.12.19 |
Apache-2.0 |
github.com/google/go-containerregistry/pkg |
v0.22.1 |
Apache-2.0 |
github.com/google/licenseclassifier/v2 |
v2.0.0 |
Apache-2.0 |
github.com/google/subcommands |
v1.2.0 |
Apache-2.0 |
github.com/google/uuid |
v1.6.0 |
BSD-3-Clause |
github.com/gorilla/websocket |
v1.5.4-0.20250319132907-e064f32e3674 |
BSD-2-Clause |
github.com/gosuri/uitable |
v0.0.4 |
MIT |
github.com/gosuri/uitable/util/wordwrap |
v0.0.4 |
MIT |
github.com/hashicorp/errwrap |
v1.1.0 |
MPL-2.0 |
github.com/hashicorp/go-multierror |
v1.1.1 |
MPL-2.0 |
github.com/hashicorp/go-uuid |
v1.0.4 |
MPL-2.0 |
github.com/hashicorp/hcl/v2 |
v2.24.0 |
MPL-2.0 |
github.com/k0kubun/pp |
v3.0.1 |
MIT |
github.com/klauspost/compress |
v1.20.0 |
MIT |
github.com/klauspost/compress |
v1.20.0 |
Apache-2.0 |
github.com/klauspost/compress |
v1.20.0 |
BSD-3-Clause |
github.com/klauspost/compress/internal/snapref |
v1.20.0 |
BSD-3-Clause |
github.com/klauspost/compress/zstd/internal/xxhash |
v1.20.0 |
MIT |
github.com/klauspost/cpuid/v2 |
v2.4.0 |
MIT |
github.com/knqyf263/go-cpe |
v0.0.0-20230627041855-cb0794d06872 |
MIT |
github.com/knqyf263/go-deb-version |
v0.0.0-20241115132648-6f4aee6ccd23 |
MIT |
github.com/knqyf263/go-rpm-version |
v0.0.0-20260811110310-1815e1f1b790 |
MIT |
github.com/kotakanbe/go-pingscanner |
v0.1.1-0.20250508035118-693281234a8e |
Apache-2.0 |
github.com/kotakanbe/logrus-prefixed-formatter |
v0.0.0-20180123152602-928f7356cb96 |
MIT |
github.com/mattn/go-colorable |
v0.1.15 |
MIT |
github.com/mattn/go-isatty |
v0.0.24 |
MIT |
github.com/mattn/go-runewidth |
v0.0.24 |
MIT |
github.com/mattn/go-shellwords |
v1.0.14 |
MIT |
github.com/mgutz/ansi |
v0.0.0-20200706080929-d51e80ef957d |
MIT |
github.com/mitchellh/go-homedir |
v1.1.0 |
MIT |
github.com/mitchellh/go-wordwrap |
v1.0.1 |
MIT |
github.com/mitchellh/hashstructure/v2 |
v2.0.2 |
MIT |
github.com/moul/http2curl |
v1.0.0 |
MIT |
github.com/nlopes/slack |
v0.6.0 |
BSD-2-Clause |
github.com/oklog/ulid/v2 |
v2.1.1 |
Apache-2.0 |
github.com/olekukonko/cat |
v0.0.0-20250911104152-50322a0618f6 |
MIT |
github.com/olekukonko/errors |
v1.2.0 |
MIT |
github.com/olekukonko/ll |
v0.1.6 |
MIT |
github.com/olekukonko/tablewriter |
v1.1.5 |
MIT |
github.com/opencontainers/go-digest |
v1.0.0 |
Apache-2.0 |
github.com/package-url/packageurl-go |
v0.1.7 |
MIT |
github.com/parnurzeal/gorequest |
v0.3.0 |
MIT |
github.com/pierrec/lz4/v4 |
v4.1.28 |
BSD-3-Clause |
github.com/pkg/errors |
v0.9.1 |
BSD-2-Clause |
github.com/rifflock/lfshook |
v0.0.0-20180920164130-b9218ef580f5 |
MIT |
github.com/rust-secure-code/go-rustaudit |
v0.0.0-20250226111315-e20ec32e963c |
MIT |
github.com/saintfish/chardet |
v0.0.0-20230101081208-5e3ef4b5456d |
MIT |
github.com/samber/lo |
v1.53.0 |
MIT |
github.com/samber/oops |
v1.18.1 |
MIT |
github.com/sergi/go-diff/diffmatchpatch |
v1.4.0 |
MIT |
github.com/sirupsen/logrus |
v1.10.2 |
MIT |
github.com/spdx/tools-golang |
v0.5.7 |
Apache-2.0 |
github.com/spdx/tools-golang |
v0.5.7 |
GPL-2.0 |
github.com/spf13/cobra |
v1.10.2 |
Apache-2.0 |
github.com/spf13/pflag |
v1.0.10 |
BSD-3-Clause |
github.com/zclconf/go-cty/cty |
v1.19.0 |
MIT |
github.com/zeebo/xxh3 |
v1.1.0 |
BSD-2-Clause |
go.etcd.io/bbolt |
v1.5.0 |
MIT |
go.opentelemetry.io/otel |
v1.45.0 |
Apache-2.0 |
go.opentelemetry.io/otel |
v1.45.0 |
BSD-3-Clause |
go.opentelemetry.io/otel/trace |
v1.45.0 |
Apache-2.0 |
go.opentelemetry.io/otel/trace |
v1.45.0 |
BSD-3-Clause |
golang.org/x/crypto/ssh/terminal |
v0.55.0 |
BSD-3-Clause |
golang.org/x/exp/constraints |
v0.0.0-20260813180055-c1d0aacb2297 |
BSD-3-Clause |
golang.org/x/mod |
v0.41.0 |
BSD-3-Clause |
golang.org/x/net |
v0.58.0 |
BSD-3-Clause |
golang.org/x/sync/errgroup |
v0.23.0 |
BSD-3-Clause |
golang.org/x/sys |
v0.48.0 |
BSD-3-Clause |
golang.org/x/term |
v0.46.0 |
BSD-3-Clause |
golang.org/x/text |
v0.42.0 |
BSD-3-Clause |
golang.org/x/xerrors |
v0.0.0-20240903120638-7835f813f4da |
BSD-3-Clause |
gopkg.in/yaml.v3 |
v3.0.1 |
MIT |
k8s.io/utils/clock |
v0.0.0-20260319190234-28399d86e0b5 |
Apache-2.0 |
github.com/spdx/tools-golang is licensed under your choice of Apache-2.0 or GPL-2.0-or-later. The table above shows GPL-2.0, and the dual licensing can be confirmed at the link.
Trivy#
Trivy, provided for the Trivy integration, is the official release bundled without modification. Trivy is provided under the Apache License 2.0.
- License: Apache-2.0
- Attribution notices: NOTICE
- Source code: from the Trivy releases, refer to the tag that matches the version shown by
trivy --version.
C/C++ Library Identification Tool#
The OSS components included in futurevuls-cpp-fingerprint, used for C/C++ Library Identification, are as follows.
| Package | Version | License |
|---|---|---|
| Go standard library | - | BSD-3-Clause |
Reachability Analysis Program#
The OSS components included in the reachability analysis program vuls-reach are as follows.
| Package | Version | License |
|---|---|---|
| Go standard library | - | BSD-3-Clause |
github.com/dustin/go-humanize |
v1.0.1 |
MIT |
github.com/glebarez/go-sqlite |
v1.22.0 |
BSD-3-Clause |
github.com/google/uuid |
v1.5.0 |
BSD-3-Clause |
github.com/mattn/go-isatty |
v0.0.20 |
MIT |
github.com/remyoudompheng/bigfft |
v0.0.0-20230129092748-24d4a6f8daec |
BSD-3-Clause |
golang.org/x/mod/semver |
v0.38.0 |
BSD-3-Clause |
golang.org/x/sync/errgroup |
v0.22.0 |
BSD-3-Clause |
golang.org/x/sys/unix |
v0.47.0 |
BSD-3-Clause |
golang.org/x/telemetry |
v0.0.0-20260708182218-49f421fb7959 |
BSD-3-Clause |
golang.org/x/tools |
v0.48.0 |
BSD-3-Clause |
golang.org/x/vuln |
v1.6.0 |
BSD-3-Clause |
modernc.org/libc |
v1.37.6 |
BSD-3-Clause |
modernc.org/libc/honnef.co/go/netdb |
v1.37.6 |
MIT |
modernc.org/mathutil |
v1.6.0 |
BSD-3-Clause |
modernc.org/memory |
v1.7.2 |
BSD-3-Clause |
modernc.org/sqlite/lib |
v1.28.0 |
BSD-3-Clause |