AfterTime — third-party components

Last updated 10 September 2026 · applies to AT Informatics software and to atinformatics.com

Draft prepared in good faith for review. Not legal advice. Regenerated 2026-09-10 from each installed package's own metadata, reading the modern License-Expression field (PEP 639) as well as the older classifiers.

132 packages. Every one resolved. None unknown.

Correction to the earlier version of this file. It said "55 packages declare no licence in their metadata". That was wrong. The scan only read the legacy classifier field, and modern wheels declare their licence in License-Expression instead. All 55 do declare a licence. The earlier file also missed the two LGPL packages named below.

The findings that matter

1. One strong-copyleft component, and it is optional

pedalboard (Spotify) — GPL-3.0.

GPLv3 is strong copyleft. If AfterTime were distributed with it, the copyleft terms could reach the whole distributed work.

It is not distributed and not required. Measured 2026-09-10:

it is not in backend/requirements.txt
it is imported lazily, inside functions, never at module load
backend/Tools/auto_master.py provides both apply_plan_pedalboard and apply_plan_scipy
verified: Tools.auto_master imports cleanly with pedalboard blocked
enforced: backend/test_ship_requirements.py fails the suite if pedalboard is ever added to requirements.txt

Rule for the build: never bundle it.

2. Two LGPL components — these are real and must be stated

package	licence	what it does
`soxr`	LGPL-2.1-or-later	high-quality resampling, pulled in by `librosa`
`lameenc`	LGPL-3.0-or-later	MP3 encoding

LGPL is not GPL. It permits use in a product that is not itself LGPL, on one main condition: the user must be able to replace the LGPL library with their own version.

For AfterTime that condition is met by how Python works — both are installed by pip as separate, replaceable shared libraries, and a user can pip install a different build. Do not statically link either into a frozen binary without taking advice, because that is the case where the obligation bites.

soxr arrives as a dependency of librosa, not by direct choice.

3. Weak copyleft, file-level only

certifi (MPL-2.0), tqdm (MPL-2.0 AND MIT). MPL-2.0 is file-level copyleft: it does not reach the rest of the product, but a modified MPL file must stay MPL and be made available. We have not modified them, so there is nothing to do.

tld is tri-licensed MPL-1.1 OR GPL-2.0-only OR LGPL-2.1-or-later — you elect one. Elect MPL-1.1 or LGPL-2.1; do not elect GPL-2.0.

4. Everything else is permissive

licence	packages
MIT (incl. MIT-CMU, MIT variants)	55
BSD (2- and 3-clause)	39
Apache-2.0	19
Python Software Foundation	1
Unlicense (public domain)	1

These need attribution only. This file is that attribution.

Full inventory

package	declared licence
aiohappyeyeballs	Python Software Foundation License
aiohttp	Apache-2.0 AND MIT
aiosignal	Apache Software License
annotated-doc	MIT
annotated-types	MIT
antlr4-python3-runtime	BSD
anyio	MIT
APScheduler	MIT License
attrs	MIT
audioread	MIT
babel	BSD License
beautifulsoup4	MIT License
bottle	MIT License
certifi	Mozilla Public License 2.0 (MPL 2.0)
cffi	MIT-0
charset-normalizer	MIT
click	BSD-3-Clause
cloudpickle	BSD License
courlan	Apache-2.0
cryptography	Apache-2.0 OR BSD-3-Clause
dateparser	BSD-3-Clause
decorator	BSD-2-Clause
demucs	MIT License
distro	Apache Software License
dora_search	MIT License
einops	MIT License
fastapi	MIT
fastuuid	BSD License
filelock	MIT
frozenlist	Apache-2.0
fsspec	BSD-3-Clause
greenlet	MIT AND PSF-2.0
h11	MIT License
hf-xet	Apache-2.0
htmldate	Apache-2.0
httpcore	BSD-3-Clause
httpx	BSD License
httpx-sse	MIT
huggingface_hub	Apache Software License
idna	BSD-3-Clause
importlib_metadata	Apache-2.0
Jinja2	BSD License
jiter	MIT
joblib	BSD-3-Clause
jsonschema	MIT
jsonschema-specifications	MIT
julius	MIT License
jusText	BSD License
lameenc	LGPL-3.0-or-later
lazy-loader	BSD-3-Clause
librosa	ISC License (ISCL)
litellm	MIT
llvmlite	BSD-2-Clause AND Apache-2.0 WITH LLVM-exception
lxml	BSD-3-Clause
lxml_html_clean	BSD-3-Clause
MarkupSafe	BSD-3-Clause
mcp	MIT License
mpmath	BSD License
msgpack	Apache-2.0
mss	MIT License
multidict	Apache License 2.0
narwhals	MIT
networkx	BSD-3-Clause
numba	BSD License
numpy	BSD License
omegaconf	BSD License
openai	Apache Software License
openunmix	MIT License
packaging	Apache-2.0 OR BSD-2-Clause
pedalboard	GNU General Public License v3 (GPLv3)
pillow	MIT-CMU
pip	MIT
platformdirs	MIT
playwright	Apache-2.0
pooch	BSD-3-Clause
propcache	Apache Software License
proxy_tools	MIT License
psutil	BSD-3-Clause
pycparser	BSD-3-Clause
pydantic	MIT
pydantic-settings	MIT
pydantic_core	MIT
pyee	MIT License
PyJWT	MIT
pyloudnorm	MIT
pyobjc-core	MIT
pyobjc-framework-Cocoa	MIT
pyobjc-framework-Quartz	MIT
pyobjc-framework-Security	MIT
pyobjc-framework-UniformTypeIdentifiers	MIT
pyobjc-framework-WebKit	MIT
pypdf	BSD-3-Clause
python-dateutil	BSD License
python-dotenv	BSD-3-Clause
python-multipart	Apache-2.0
pytz	MIT License
pywebview	BSD License
PyYAML	MIT License
referencing	MIT
regex	Apache-2.0 AND CNRI-Python
requests	Apache Software License
retrying	Apache-2.0
rpds-py	MIT
scikit-learn	BSD-3-Clause
scipy	BSD License
setuptools	MIT
six	MIT License
sniffio	MIT License
soundfile	BSD License
soupsieve	MIT
soxr	LGPL-2.1-or-later
sse-starlette	BSD-3-Clause
starlette	BSD-3-Clause
submitit	MIT License
sympy	BSD License
threadpoolctl	BSD License
tiktoken	MIT License Copyright (c) 2022 OpenAI, S
tld	MPL-1.1 OR GPL-2.0-only OR LGPL-2.1-or-later
tokenizers	Apache Software License
torch	BSD-3-Clause
torchaudio	BSD License
tqdm	MPL-2.0 AND MIT
trafilatura	Apache-2.0
treetable	Unlicense license
typing-inspection	MIT
typing_extensions	PSF-2.0
tzlocal	MIT
urllib3	MIT
uvicorn	BSD-3-Clause
websockets	BSD-3-Clause
yarl	Apache-2.0
zipp	MIT

Not Python

REAPER — Cockos Incorporated. Not distributed with AfterTime. You need your own licence.
Audio plugins — each belongs to its maker. AfterTime reads and sets their parameters; it does not include, modify or redistribute any of them.