Open-source components
In plain words: eMailPlane's own software is proprietary. To do its job it runs a number of well-known open-source programs, such as the mail server and the virus scanner. Each one runs unmodified, in its own container, and keeps its own licence. This page lists them, the exact version we use, and where to get the source code for that version.
Today the installer downloads each of these programs from its publisher, not from us, and builds eMailPlane's own parts on your server.
On your server
| Program | Version | Licence | Source code |
|---|---|---|---|
| BuildKit (rootless) | v0.33.0 | Apache-2.0 | https://github.com/moby/buildkit/tree/v0.33.0 |
| Caddy | v2.10.2 | Apache-2.0 | https://github.com/caddyserver/caddy/tree/v2.10.2 |
| ClamAV | 1.4.6 | GPL-2.0-only | https://github.com/Cisco-Talos/clamav/tree/clamav-1.4.6 |
| Debian 12 (bookworm-slim) | bookworm-20260824-slim | Various (Debian packages) | https://snapshot.debian.org/archive/debian/20260824T000000Z/ |
| Go toolchain (golang:1.25-alpine, build stage) | 1.25.14 | BSD-3-Clause | https://github.com/golang/go/tree/go1.25.14 |
| NATS server | 2.14.4 | Apache-2.0 | https://github.com/nats-io/nats-server/tree/v2.14.4 |
| Node.js (node:22-alpine base image) | 22.23.2 | MIT | https://github.com/nodejs/node/tree/v22.23.2 |
| PostgreSQL | 17.10 | PostgreSQL | https://github.com/postgres/postgres/tree/REL_17_10 |
| Python (python:3.12-slim base image) | 3.12.14 | PSF-2.0 | https://github.com/python/cpython/tree/v3.12.14 |
| Stalwart mail server | v0.16.16 | AGPL-3.0-only | https://github.com/stalwartlabs/stalwart/tree/v0.16.16 |
| Docker CLI (static binary) | 29.7.2 | Apache-2.0 | https://github.com/docker/cli/tree/v29.7.2 |
| Stalwart command-line tool | v1.0.12 | AGPL-3.0-only | https://github.com/stalwartlabs/cli/tree/v1.0.12 |
| cryptography (Python package) | 50.0.1 | Apache-2.0 OR BSD-3-Clause | https://github.com/pyca/cryptography/tree/50.0.1 |
| psycopg (Python package) | 3.2.3 | LGPL-3.0-only | https://github.com/psycopg/psycopg/tree/3.2.3 |
| pytest (Python package) | 8.3.3 | MIT | https://github.com/pytest-dev/pytest/tree/8.3.3 |
| PyYAML (Python package) | 6.0.2 | MIT | https://github.com/yaml/pyyaml/tree/6.0.2 |
| github.com/emersion/go-msgauth (Go module, in the edge agent) | v0.7.0 | MIT | https://github.com/emersion/go-msgauth/tree/v0.7.0 |
| github.com/emersion/go-sasl (Go module, in the edge agent) | v0.0.0-20241020182733-b788ff22d5a6 | MIT | https://github.com/emersion/go-sasl/tree/b788ff22d5a6 |
| github.com/emersion/go-smtp (Go module, in the edge agent) | v0.25.0 | MIT | https://github.com/emersion/go-smtp/tree/v0.25.0 |
| github.com/hashicorp/yamux (Go module, in the edge agent) | v0.1.2 | MPL-2.0 | https://github.com/hashicorp/yamux/tree/v0.1.2 |
| golang.org/x/crypto (Go module, in the edge agent) | v0.31.0 | BSD-3-Clause | https://github.com/golang/crypto/tree/v0.31.0 |
Notes on licences:
- Debian 12 (bookworm-slim): Each package keeps its own licence, recorded in /usr/share/doc/*/copyright inside the image.
- Go toolchain (golang:1.25-alpine, build stage): Build stage only; the Go standard library is compiled into the edge agent and edge server binaries.
- Node.js (node:22-alpine base image): Node.js bundles third-party code under its own licences, listed in its LICENSE file; the image's Alpine Linux packages keep their own licences.
- Python (python:3.12-slim base image): The image's Debian packages keep their own licences (several are GPL).
- Stalwart command-line tool: Upstream is dual-licensed AGPL-3.0 or the Stalwart Enterprise License v2; used under AGPL-3.0-only.
- Stalwart mail server: Upstream is dual-licensed AGPL-3.0 or the Stalwart Enterprise License v2; we use it under AGPL-3.0-only and hold no enterprise licence.
Libraries inside our apps
These JavaScript packages are installed, exactly at the versions pinned in our lockfiles, inside eMailPlane's own images on your server.
- @emnapi/runtime 1.11.3 (MIT)
- @hono/node-server 2.1.1 (MIT)
- @img/colour 1.1.0 (MIT)
- @img/sharp-darwin-arm64 0.35.3 (Apache-2.0)
- @img/sharp-darwin-x64 0.35.3 (Apache-2.0)
- @img/sharp-freebsd-wasm32 0.35.3 (Apache-2.0)
- @img/sharp-libvips-darwin-arm64 1.3.2 (LGPL-3.0-or-later)
- @img/sharp-libvips-darwin-x64 1.3.2 (LGPL-3.0-or-later)
- @img/sharp-libvips-linux-arm 1.3.2 (LGPL-3.0-or-later)
- @img/sharp-libvips-linux-arm64 1.3.2 (LGPL-3.0-or-later)
- @img/sharp-libvips-linux-ppc64 1.3.2 (LGPL-3.0-or-later)
- @img/sharp-libvips-linux-riscv64 1.3.2 (LGPL-3.0-or-later)
- @img/sharp-libvips-linux-s390x 1.3.2 (LGPL-3.0-or-later)
- @img/sharp-libvips-linux-x64 1.3.2 (LGPL-3.0-or-later)
- @img/sharp-libvips-linuxmusl-arm64 1.3.2 (LGPL-3.0-or-later)
- @img/sharp-libvips-linuxmusl-x64 1.3.2 (LGPL-3.0-or-later)
- @img/sharp-linux-arm 0.35.3 (Apache-2.0)
- @img/sharp-linux-arm64 0.35.3 (Apache-2.0)
- @img/sharp-linux-ppc64 0.35.3 (Apache-2.0)
- @img/sharp-linux-riscv64 0.35.3 (Apache-2.0)
- @img/sharp-linux-s390x 0.35.3 (Apache-2.0)
- @img/sharp-linux-x64 0.35.3 (Apache-2.0)
- @img/sharp-linuxmusl-arm64 0.35.3 (Apache-2.0)
- @img/sharp-linuxmusl-x64 0.35.3 (Apache-2.0)
- @img/sharp-wasm32 0.35.3 (Apache-2.0 AND LGPL-3.0-or-later AND MIT)
- @img/sharp-webcontainers-wasm32 0.35.3 (Apache-2.0)
- @img/sharp-win32-arm64 0.35.3 (Apache-2.0 AND LGPL-3.0-or-later)
- @img/sharp-win32-ia32 0.35.3 (Apache-2.0 AND LGPL-3.0-or-later)
- @img/sharp-win32-x64 0.35.3 (Apache-2.0 AND LGPL-3.0-or-later)
- @modelcontextprotocol/sdk 1.30.0 (MIT)
- @nats-io/jetstream 3.4.0 (Apache-2.0)
- @nats-io/nats-core 3.4.0 (Apache-2.0)
- @nats-io/nkeys 2.0.3 (Apache-2.0)
- @nats-io/nuid 3.0.0 (Apache-2.0)
- @nats-io/transport-node 3.4.0 (Apache-2.0)
- @next/env 16.3.0 (MIT)
- @next/swc-darwin-arm64 16.3.0 (MIT)
- @next/swc-darwin-x64 16.3.0 (MIT)
- @next/swc-linux-arm64-gnu 16.3.0 (MIT)
- @next/swc-linux-arm64-musl 16.3.0 (MIT)
- @next/swc-linux-x64-gnu 16.3.0 (MIT)
- @next/swc-linux-x64-musl 16.3.0 (MIT)
- @next/swc-win32-arm64-msvc 16.3.0 (MIT)
- @next/swc-win32-x64-msvc 16.3.0 (MIT)
- @swc/helpers 0.5.15 (Apache-2.0)
- accepts 2.0.0 (MIT)
- ajv 8.20.0 (MIT)
- ajv-formats 3.0.1 (MIT)
- baseline-browser-mapping 2.11.18 (Apache-2.0)
- body-parser 2.3.0 (MIT)
- bytes 3.1.2 (MIT)
- call-bind-apply-helpers 1.0.2 (MIT)
- call-bound 1.0.4 (MIT)
- caniuse-lite 1.0.30001809 (CC-BY-4.0)
- client-only 0.0.1 (MIT)
- content-disposition 1.1.0 (MIT)
- content-type 1.0.5 (MIT)
- content-type 2.1.0 (MIT)
- cookie 0.7.2 (MIT)
- cookie-signature 1.2.2 (MIT)
- cors 2.8.6 (MIT)
- cross-spawn 7.0.6 (MIT)
- debug 4.4.3 (MIT)
- depd 2.0.0 (MIT)
- dunder-proto 1.0.1 (MIT)
- ee-first 1.1.1 (MIT)
- encodeurl 2.0.0 (MIT)
- es-define-property 1.0.1 (MIT)
- es-errors 1.3.0 (MIT)
- es-object-atoms 1.1.2 (MIT)
- escape-html 1.0.3 (MIT)
- etag 1.8.1 (MIT)
- eventsource 3.0.7 (MIT)
- eventsource-parser 3.1.1 (MIT)
- express 5.2.1 (MIT)
- express-rate-limit 8.7.0 (MIT)
- fast-deep-equal 3.1.3 (MIT)
- fast-uri 3.1.7 (BSD-3-Clause)
- finalhandler 2.1.1 (MIT)
- forwarded 0.2.0 (MIT)
- fresh 2.0.0 (MIT)
- function-bind 1.1.2 (MIT)
- get-intrinsic 1.3.0 (MIT)
- get-proto 1.0.1 (MIT)
- gopd 1.2.0 (MIT)
- has-symbols 1.1.0 (MIT)
- hasown 2.0.4 (MIT)
- hono 4.13.5 (MIT)
- http-errors 2.0.1 (MIT)
- iconv-lite 0.7.3 (MIT)
- inherits 2.0.4 (ISC)
- ip-address 10.7.0 (MIT)
- ipaddr.js 1.9.1 (MIT)
- is-promise 4.0.0 (MIT)
- isexe 2.0.0 (ISC)
- jose 6.2.11 (MIT)
- json-schema-traverse 1.0.0 (MIT)
- json-schema-typed 8.0.2 (BSD-2-Clause)
- math-intrinsics 1.1.0 (MIT)
- media-typer 1.1.1 (MIT)
- merge-descriptors 2.0.0 (MIT)
- mime-db 1.54.0 (MIT)
- mime-types 3.0.2 (MIT)
- ms 2.1.3 (MIT)
- nanoid 3.3.18 (MIT)
- negotiator 1.1.0 (MIT)
- next 16.3.0 (MIT)
- object-assign 4.1.1 (MIT)
- object-inspect 1.13.4 (MIT)
- on-finished 2.4.1 (MIT)
- once 1.4.0 (ISC)
- parseurl 1.3.3 (MIT)
- path-key 3.1.1 (MIT)
- path-to-regexp 8.4.2 (MIT)
- pg 8.23.0 (MIT)
- pg-cloudflare 1.4.0 (MIT)
- pg-connection-string 2.14.0 (MIT)
- pg-int8 1.0.1 (ISC)
- pg-pool 3.14.0 (MIT)
- pg-protocol 1.16.0 (MIT)
- pg-types 2.2.0 (MIT)
- pgpass 1.0.5 (MIT)
- picocolors 1.1.1 (ISC)
- pkce-challenge 5.0.1 (MIT)
- postcss 8.5.23 (MIT)
- postgres-array 2.0.0 (MIT)
- postgres-bytea 1.0.1 (MIT)
- postgres-date 1.0.7 (MIT)
- postgres-interval 1.2.0 (MIT)
- proxy-addr 2.0.7 (MIT)
- qs 6.16.0 (BSD-3-Clause)
- range-parser 1.3.0 (MIT)
- raw-body 3.0.2 (MIT)
- react 19.2.8 (MIT)
- react-dom 19.2.8 (MIT)
- require-from-string 2.0.2 (MIT)
- router 2.2.0 (MIT)
- safer-buffer 2.1.2 (MIT)
- scheduler 0.27.0 (MIT)
- semver 7.8.5 (ISC)
- send 1.2.1 (MIT)
- serve-static 2.2.1 (MIT)
- setprototypeof 1.2.0 (ISC)
- sharp 0.35.3 (Apache-2.0)
- shebang-command 2.0.0 (MIT)
- shebang-regex 3.0.0 (MIT)
- side-channel 1.1.1 (MIT)
- side-channel-list 1.0.1 (MIT)
- side-channel-map 1.0.1 (MIT)
- side-channel-weakmap 1.0.2 (MIT)
- source-map-js 1.2.1 (BSD-3-Clause)
- split2 4.2.0 (ISC)
- statuses 2.0.2 (MIT)
- styled-jsx 5.1.6 (MIT)
- toidentifier 1.0.1 (MIT)
- tslib 2.8.1 (0BSD)
- tweetnacl 1.0.3 (Unlicense)
- type-is 2.1.0 (MIT)
- unpipe 1.0.0 (MIT)
- vary 1.1.2 (MIT)
- which 2.0.2 (ISC)
- wrappy 1.0.2 (ISC)
- xtend 4.0.2 (MIT)
- zod 4.5.4 (MIT)
- zod-to-json-schema 3.25.2 (ISC)
On our own servers
These run only on servers we operate, unmodified, and are not distributed to you.
Fonts and scripts on this website
The fonts and the 3D library this website uses are listed, with their versions and licences, in our website notice file.
Questions
Ask for a copy of any licence or source, or report a missing notice, at legal@emailplane.com.