[License Exception Request] Prometheus / BlueOak-1.0.0

[roidelapluie]

For which CNCF project are you requesting exceptions?

Prometheus

Are you an official maintainer of this project?

Yes

List of components requiring an exception

Component	Upstream URL	Project Usage URL	License(s)	Purpose
lru-cache (v11, currently 11.5.1)	https://github.com/isaacs/node-lru-cache	https://github.com/prometheus/prometheus/blob/main/web/ui/module/codemirror-promql/package.json	BlueOak-1.0.0	In-memory LRU cache used by the codemirror-promql module to cache PromQL autocomplete metadata (metric names, label names/values) in the web UI query editor, so the UI does not re-fetch metadata on every keystroke.

Distribution and integration model

• CNCF-Distributed: The CNCF project will distribute the dependency or the resulting combined artifacts to users.
• User-Fetched Dependency: The CNCF project code will cause the user's system to automatically retrieve the dependency from an upstream source at build, install, or runtime.
• System Component: The CNCF project expects that the dependency will either already be present on the user's system or will be installed independently by the user.
• Not Distributed + Not Needed by End User (Internal Project Tooling): ALL of the following are true:

Please explain

lru-cache is a direct dependency of the @prometheus-io/codemirror-promql package,
which provides PromQL autocompletion in the Prometheus web UI. The web UI is
compiled and the resulting JavaScript bundle (including lru-cache) is embedded
into the Prometheus server binary via Go's embed, so the library is distributed
to users as part of the released artifacts.

The library was originally ISC-licensed when first introduced (Prometheus 2.30,
Aug 2021, via #9188). Upstream relicensed it to BlueOak-1.0.0 in v11.2.3, and the
BlueOak-licensed version first shipped in Prometheus v3.10.0 (lru-cache 11.2.5).

Modification status

• Modified Upstream: The CNCF project will patch, alter, or otherwise modify the source code of the dependency and contribute upstream.
• Modified Downstream: The CNCF project will patch, alter, or otherwise modify the source code of the dependency and maintain a downstream fork or local copy.
• Unmodified: The CNCF project will use the dependency exactly as provided by the upstream maintainers without any changes to its source code.

Please explain

Prometheus uses lru-cache exactly as published on the npm registry. The library
is pulled in as a normal npm dependency of the @prometheus-io/codemirror-promql
module and its source is not patched, forked, or altered in any way.

Structural separation

• Separated Component: The dependency's code will either be (a) kept in a distinct directory or module clearly separated from CNCF project code, or (b) retrieved at build/installation time from a third-party repository and never stored in the CNCF project repository.
• Intermingled Code: The dependency's code will be "mixed in" with CNCF source files, copied into existing project files, or will otherwise lose its distinct directory/module boundary.

Please explain

lru-cache is a standalone third-party npm package. It is declared as a dependency
in web/ui/module/codemirror-promql/package.json and resolved into node_modules at
build time; it is not vendored into or copied alongside Prometheus source files.
Its code retains its own module boundary and is only bundled (as a discrete module)
into the compiled UI assets during the build.

Communication mechanism

• Static Linking: The dependency and the CNCF project code will be combined into a single binary or similar type of artifact during the build process.
• Dynamic Linking: The CNCF project code will interact with the dependency by loading it into the shared address space (memory) at run-time. This includes traditional shared objects compiled into a separate binary, as well as runtime module loading in interpreted or JIT-compiled languages.
• Separate Process: The dependency and the CNCF project code will run as distinct executables and communicate via Inter-Process Communication (e.g., pipes, sockets, or shared files)
• Network Interaction: The dependency and the CNCF project code will be logically and physically separated by a network boundary, with the CNCF project's code acting as a client or consumer of the remote service and interacting with the dependency exclusively via standardized network protocols.

Please explain

lru-cache is bundled by the UI build (Vite/esbuild): its source is inlined into the
compiled JavaScript bundle, which is then embedded into the Prometheus server binary
via Go's embed. The library is therefore combined with Prometheus code into a single
distributed artifact at build time rather than loaded as a separate module at runtime.

Data exchange

• Tightly Coupled: The upstream dependency and CNCF project code will exchange complex internal data structures such as shared pointers, class instances, or private memory offsets that require extensive knowledge of the other component's internal memory layout.
• Arms-Length Only: The communication between the dependency and the CNCF project code will be limited to standard serialized data (e.g., JSON, XML, or Protobuf) where data is "flattened" for transport and neither component accesses the other's internal memory structures.

Please explain

As an in-process library, the Prometheus UI code calls lru-cache's API directly and
passes in-memory JavaScript objects (cache keys and cached values) by reference. This
is normal in-language library usage rather than serialized arms-length data exchange.

Please explain

lru-cache relicensed upstream from ISC to BlueOak-1.0.0 in v11.2.3. The BlueOak-licensed
version first shipped in Prometheus v3.10.0 (released 2026-02-24, lru-cache 11.2.5);
current main pins 11.5.1. The library has been a Prometheus UI dependency (under ISC)
since v2.30 (Aug 2021, #9188). BlueOak-1.0.0 is an OSI-approved permissive license.

[github-actions]

Automated Triage Summary

Project: Prometheus
Components Requested: 1

---

This issue will be reviewed by the CNCF staff and Legal Committee. See process documentation.

[github-actions]

Automated Triage Summary

Project: Prometheus
Components Requested: 1

---

This issue will be reviewed by the CNCF staff and Legal Committee. See process documentation.

[github-actions]

Automated Triage Summary

Project: Prometheus
Components Requested: 1

---

This issue will be reviewed by the CNCF staff and Legal Committee. See process documentation.