Open Source Credits

Last updated: 26 May 2026 · Audit reference: oss-license-sweep.md

About this page

Surging Markets is built on top of a deep stack of open source software. This page exists to honor the attribution requirements of the licenses we depend on (Apache-2.0, MIT, BSD-2-Clause, BSD-3-Clause, ISC, and Artistic-1.0), and to publicly thank the maintainers and contributors who made our platform possible.

We list every direct dependency declared in composer.json and package.json, grouped by license. Apache-2.0 dependencies appear first because that license carries the most formal NOTICE-file requirement; where the upstream project ships a NOTICE file, we reproduce its contents verbatim below. For transitive dependencies we link to canonical SPDX license text rather than enumerating thousands of packages; the full transitive license tree can be re-generated at any time via composer licenses --format=json and npx license-checker --json --production.

If you spot an attribution we owe and have missed, please email [email protected] and we will correct it.

Apache License 2.0 dependencies

These packages are licensed under the Apache License, Version 2.0. Per §4(d) of the license, any NOTICE files shipped with these projects are reproduced verbatim below.

sentry/sentry-symfony 3.5.3 — Apache-2.0

Sentry SDK for Symfony. Homepage: getsentry.com · Source: github.com/getsentry/sentry-symfony

No upstream NOTICE file shipped with this package version. Attribution provided per Apache-2.0 §4(c) requirement to retain the license terms.

livekit-client 2.18.9 — Apache-2.0

LiveKit JavaScript client SDK used for our real-time audio/video rooms. Homepage: livekit.io · Source: github.com/livekit/client-sdk-js

No upstream NOTICE file shipped with this package version. Copyright © LiveKit, Inc.

sharp 0.34.5 — Apache-2.0

High-performance Node.js image processing library. Homepage: sharp.pixelplumbing.com · Source: github.com/lovell/sharp

No upstream NOTICE file shipped with this package version. Copyright © Lovell Fuller and contributors.

playwright 1.60.0 — Apache-2.0

Microsoft Playwright — browser automation library used for end-to-end testing. Homepage: playwright.dev · Source: github.com/microsoft/playwright

NOTICE (reproduced verbatim from node_modules/playwright/NOTICE):

Playwright
Copyright (c) Microsoft Corporation

This software contains code derived from the Puppeteer project (https://github.com/puppeteer/puppeteer),
available under the Apache 2.0 license (https://github.com/puppeteer/puppeteer/blob/master/LICENSE).

Dual-licensed (Apache-2.0 or GPL-2.0)

patchwork/utf8 v1.3.2 — Apache-2.0 OR GPL-2.0 (we elect Apache-2.0)

Transitive UTF-8 polyfill (no longer actively maintained; superseded by symfony/polyfill-*). Source: github.com/tchwork/utf8

Per the dual-license terms, Surging Markets formally elects the Apache-2.0 prong. No source-disclosure obligation attaches under the elected prong for our SaaS deployment.

MIT License dependencies

The following packages are licensed under the MIT License. The license text is included once below; each listed package’s copyright notice applies.

MIT License text
Permission is hereby granted, free of charge, to any person obtaining a copy of
this software and associated documentation files (the "Software"), to deal in
the Software without restriction, including without limitation the rights to
use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of
the Software, and to permit persons to whom the Software is furnished to do so,
subject to the following conditions:

The above copyright notice and this permission notice shall be included in all
copies or substantial portions of the Software.

THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS
FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR
COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER
IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN
CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
PHP packages (Composer) — 43 packages
  • anahkiasen/underscore-php @ dev-master
  • antishov/doctrine-extensions-bundle @ v1.4.3
  • doctrine/common @ 2.13.3
  • doctrine/migrations @ 3.0.0
  • excelwebzone/recaptcha-bundle @ v1.5.25
  • guzzlehttp/guzzle @ 7.2.0
  • laupifrpar/pusher-bundle @ 4.1.0
  • league/csv @ 9.6.2
  • lexik/jwt-authentication-bundle @ v2.10.5
  • manuelodelain/linkify-twig-extension @ 2.0
  • sensio/framework-extra-bundle @ v5.6.1
  • sensiolabs/security-checker @ v6.0.3
  • stripe/stripe-php @ v7.67.0
  • symfony/apache-pack @ v1.0.1
  • symfony/asset @ v5.1.10
  • symfony/console @ v5.1.10
  • symfony/dotenv @ v5.1.10
  • symfony/expression-language @ v5.1.10
  • symfony/flex @ v1.11.0
  • symfony/form @ v5.1.10
  • symfony/framework-bundle @ v5.1.10
  • symfony/http-client @ v5.1.11
  • symfony/lock @ v5.1.10
  • symfony/mailer @ v5.1.10
  • symfony/mailgun-mailer @ v5.2.4
  • symfony/messenger @ v5.1.11
  • symfony/monolog-bundle @ v3.6.0
  • symfony/orm-pack @ v1.0.8
  • symfony/process @ v5.1.10
  • symfony/property-info @ v5.1.10
  • symfony/security-bundle @ v5.1.10
  • symfony/sendgrid-mailer @ v5.1.10
  • symfony/serializer @ v5.1.10
  • symfony/serializer-pack @ v1.0.4
  • symfony/swiftmailer-bundle @ v3.5.1
  • symfony/twig-bundle @ v5.1.10
  • symfony/validator @ v5.1.10
  • symfony/webpack-encore-bundle @ v1.8.0
  • symfony/yaml @ v5.1.10
  • twig/extra-bundle @ v3.2.1
  • twig/intl-extra @ v3.2.1
  • twig/string-extra @ v3.2.1
  • vich/uploader-bundle @ 1.16.0

Plus ~91 transitive MIT-licensed PHP packages (Symfony components, Doctrine ORM, Monolog, Twig, Sentry SDK core, Pusher PHP server, JWT bundles, etc.). Run composer licenses for the full enumerated list.

JavaScript packages (npm) — 11 packages
  • @babel/plugin-proposal-class-properties @ 7.18.6
  • @symfony/stimulus-bridge @ 2.1.0
  • @symfony/webpack-encore @ 1.8.2
  • copy-webpack-plugin @ 14.0.0
  • core-js @ 3.48.0
  • file-loader @ 6.2.0
  • jquery @ 4.0.0
  • pusher-js @ 8.4.0
  • regenerator-runtime @ 0.13.11
  • slick-carousel @ 1.8.1
  • stimulus @ 2.0.0

Plus the broader npm transitive tree (Babel toolchain, Webpack loaders, polyfills, etc.) — predominantly MIT. Run npx license-checker --production for the full enumeration.

BSD-3-Clause dependencies

Licensed under the BSD 3-Clause License. Redistribution and use in source and binary forms, with or without modification, are permitted provided that the conditions of the BSD-3-Clause license are met.

BSD-3-Clause packages
  • beberlei/doctrineextensions @ v1.3.0
  • firebase/php-jwt @ v5.5.1
  • plus transitive: sentry/sentry (core SDK), lcobucci/jwt, google/recaptcha, laminas/* (laminas-code, laminas-eventmanager, etc.)

BSD-2-Clause dependencies

Licensed under the BSD 2-Clause License.

BSD-2-Clause packages
  • One transitive BSD-2-Clause package in the Composer tree (run composer licenses for current name — commonly pdepend or PHP_CodeSniffer in similar trees).

ISC License dependencies

Licensed under the ISC License (functionally equivalent to a simplified BSD/MIT).

ISC packages
  • paragonie/sodium_compat (PHP)
  • webpack-notifier @ 1.15.0 (npm)
  • Numerous transitive npm packages (rimraf, glob, semver, etc.)

Artistic-1.0 dependencies

Licensed under the Artistic License 1.0.

Artistic-1.0 packages
  • behat/transliterator @ v1.3.0 (transitive via gedmo/doctrine-extensions)

TradingView Charting Library

Our charts are powered by the TradingView Charting Library, used under a separate commercial license granted by TradingView, Inc. The library is not open source and is not redistributed by Surging Markets. Per TradingView’s attribution requirement: charts on this site are powered by TradingView, a charting platform for a global community of traders and investors.

Canonical license texts

Contact

Attribution corrections or license questions: [email protected].

← Back to Dashboard