v0.38.2

A licensing correction. Nothing changes in how HarnessRouter works.

If you're upgrading from before 0.38.1, read the 0.38.1 notes first. That release closes a security gap.

What was wrong

Measured on 0.38.0 and 0.38.1. The dependency and the sentence in NOTICE date from August, so earlier images are probably the same.

• The image shipped an LGPL library with no licence text beside it. Next.js lists sharp as optional for its image optimizer, and the build copied @img/sharp-libvips-* (LGPL-3.0-or-later) into the image. The console has never used that optimizer, so nothing called it. It's gone now.
• NOTICE said everything bundled is under a permissive licence. That wasn't true. It listed only direct dependencies.
• The image didn't carry LICENSE or NOTICE, though NOTICE says it travels with a copy.

What changed

• sharp and its native libraries are no longer installed or shipped.
• NOTICE is corrected. It names certifi (MPL-2.0, unchanged) and Pyphen (offered under GPL, LGPL or MPL, used under MPL, unchanged), and says Debian's system packages carry their own terms.
• The image now has /app/LICENSE, /app/NOTICE, and /app/THIRD-PARTY-console.txt with the licence text of every console package.

How it stays that way

scripts/check-licenses.py runs in the tests and inside every release's image, on both architectures, and fails on anything that isn't under a permissive licence and isn't named with a reason. The image check is what matters: a lockfile says what a project asked for, and an image holds what the build copied. Run against 0.38.1, it fails on exactly those packages.

Code under any other licence is used only as the whole, unchanged package named in NOTICE. None is copied into this project.

Full Changelog: v0.38.1...v0.38.2