cncf
[License Exception Request] [Keycloak] [Eclipse Public License v2.0]
For which CNCF project are you requesting exceptions?
Are you an official maintainer of this project?
No
List of components requiring an exception
| Component | Upstream URL | Project Usage URL | License(s) | Purpose |
|---|---|---|---|---|
| expressly | https://github.com/eclipse-ee4j/expressly | https://github.com/keycloak/keycloak/blob/main/quarkus/runtime/pom.xml#L147 | Eclipse Public License - v 2.0 | Default implementation of Jakarta Expression Language 6.0 that is a transitive dependency used for Hibernate Validator |
Are all of the components mandatory dependencies for the project to function as intended?
Yes
If no, please explain
No response
How will the components be included in or with the project's code and distributions?
- [ ] Incorporated code
- [ ] Vendored component
- [ ] Build-time dependency
- [ ] Build and test tooling
- [ ] Install-time dependency
- [x] Required upstream dependencies
- [ ] Other (please describe below)
If any of the above selections don't apply to all of the components listed in the table above, please explain
No response
Which of the following best describes how the components interact with the project's own code?
- [ ] Static linking: e.g., compiled together with project code into a single binary
- [x] Dynamic linking: e.g., compiled into a separate binary, running together with project code in a single address space at run-time
- [ ] Separate process: e.g., separate executable running in a different process space, interacting with project code only via mechanisms such as pipes, sockets, etc.
- [ ] Network interaction only: e.g., logically separated over a network and communicating only via mechanisms such as network API call, exchanging JSON data, etc.
- [ ] Other (please describe below)
If any of the above selections don't apply to all of the components listed in the table above, please explain
No response
Will any of the components be modified?
No
If yes, please specify which components will be modified, and briefly describe the purpose and nature of the modifications.
No response
Will the project be seeking to contribute the modifications back to the upstream project?
None
This will be reviewed at the next CNCF Legal Committee meeting, which will be either mid-December or early January depending on committee members' availability.
@joannalee333 Ahh, thanks for the message! In Keycloak, we have set the new release for Jan 5, 2026 and we do not want to ship the release without the CNCF approval on this license exception. It means, this issue is a blocker for us.
Would it be possible to prioritize it somehow? Or be sure the committee meeting will happen in mid-December?
Thank you very much for your understanding.
Hi @mabartos the Legal Committee will be meeting December 18. If the Legal Committee makes a recommendation, this will then be submitted to the governing board for an email vote.