Third-Party Attributions

August 12, 2026 · View on GitHub

This document provides detailed attribution information for third-party software, libraries, and content included in or used by ArcadeDB.

Table of Contents

  1. Source Code Origins
  2. Derived and Included Code
  3. Runtime Dependencies
  4. Test Dependencies
  5. Build-Time Dependencies
  6. License References

Source Code Origins

OrientDB

ArcadeDB includes components originally developed for OrientDB, an Open Source Multi-Model NoSQL Database.

History: ArcadeDB was created in 2021 by Luca Garulli, the same founder of OrientDB, after SAP's acquisition of OrientDB LTD. ArcadeDB was written from scratch with a new engine architecture, but reuses OrientDB's SQL engine (now heavily modified) and some utility classes. ArcadeDB maintains compatibility with OrientDB's SQL dialect.

Components Reused:

  • SQL query engine (heavily modified)
  • Various utility classes

Note: ArcadeDB is not a fork - it is a new codebase that selectively incorporates and builds upon specific OrientDB components.

Derived and Included Code

1. Neo4j openCypher Grammar and TCK

openCypher is an open source implementation of the Cypher query language, originally created by Neo4j.

  • Copyright: Neo4j Sweden AB
  • License: Apache License 2.0
  • Website: https://opencypher.org/
  • Trademark Notice: Cypher® is a registered trademark of Neo4j Inc.

Included Components:

ComponentTypeLocationCount
Cypher25Parser.g4ANTLR4 Grammarengine/src/main/antlr4/com/arcadedb/query/opencypher/grammar/1 file
Cypher25Lexer.g4ANTLR4 Grammarengine/src/main/antlr4/com/arcadedb/query/opencypher/grammar/1 file
TCK Test FeaturesCucumber/Gherkin Testsengine/src/test/resources/opencypher/tck/features/220 files

Attribution Notice from TCK License:

"This work was created by the collective efforts of the openCypher community. Without limiting the terms of Section 6, any Derivative Work that is not approved by the public consensus process of the openCypher Implementers Group should not be described as 'Cypher' (and Cypher® is a registered trademark of Neo4j Inc.) or as 'openCypher'. Extensions by implementers or prototypes or proposals for change that have been documented or implemented should only be described as 'implementation extensions to Cypher' or as 'proposed changes to Cypher that are not yet approved by the openCypher community'."

License Files:

  • Grammar files: Include full Apache 2.0 header with Neo4j copyright
  • TCK feature files: Include full Apache 2.0 header with attribution notice

2. OpenCypher-Gremlin - StringTranslationUtils

OpenCypher-Gremlin (also known as Cypher for Gremlin) enables Cypher queries over Gremlin-enabled graph databases.

Modification Note: This file is a security-patched override of the original OpenCypher-Gremlin implementation. The upstream project is not actively maintained and was unwilling to merge the security fix, necessitating this local override.

Original Author: @ExtReMLapin (as noted in code comments)

Runtime Dependencies

The following table lists runtime dependencies bundled with ArcadeDB distributions:

Core Dependencies

Group IDArtifact IDVersionLicenseHomepage
org.slf4jslf4j-api2.0.18MIThttps://www.slf4j.org/
org.slf4jslf4j-jdk142.0.18MIThttps://www.slf4j.org/
ch.qos.logbacklogback-classic1.5.27EPL 1.0 / LGPL 2.1https://logback.qos.ch/
ch.qos.logbacklogback-core1.5.27EPL 1.0 / LGPL 2.1https://logback.qos.ch/
com.conversantmediadisruptor1.2.21Apache 2.0https://github.com/conversant/disruptor
at.yawk.lz4lz4-java1.10.3Apache 2.0https://github.com/yawkat/lz4-java
org.antlrantlr4-runtime4.13.2BSD 3-Clausehttps://www.antlr.org/
com.google.code.gsongson2.13.2Apache 2.0https://github.com/google/gson
org.yamlsnakeyaml2.4Apache 2.0https://bitbucket.org/snakeyaml/snakeyaml

Apache Lucene (Full-Text Search)

Group IDArtifact IDVersionLicenseHomepage
org.apache.lucenelucene-core10.3.2Apache 2.0https://lucene.apache.org/
org.apache.lucenelucene-analysis-common10.3.2Apache 2.0https://lucene.apache.org/
org.apache.lucenelucene-queryparser10.3.2Apache 2.0https://lucene.apache.org/
org.apache.lucenelucene-queries10.3.2Apache 2.0https://lucene.apache.org/
org.apache.lucenelucene-sandbox10.3.2Apache 2.0https://lucene.apache.org/
org.apache.lucenelucene-facet10.3.2Apache 2.0https://lucene.apache.org/
org.apache.lucenelucene-spatial-extras10.3.2Apache 2.0https://lucene.apache.org/

Apache Lucene Notice: Lucene is a registered trademark of The Apache Software Foundation. See the NOTICE file for Lucene's own third-party attributions.

Spatial and GIS Libraries

Group IDArtifact IDVersionLicenseHomepage
org.locationtech.spatial4jspatial4j0.8Apache 2.0https://github.com/locationtech/spatial4j
org.locationtech.jtsjts-core1.20.0Eclipse Distribution License 1.0https://github.com/locationtech/jts

Vector Embeddings

Group IDArtifact IDVersionLicenseHomepage
io.github.jbellisjvector4.0.0-rc.7Apache 2.0https://github.com/jbellis/jvector
org.apache.commonscommons-math33.6.1Apache 2.0https://commons.apache.org/proper/commons-math/
org.agronaagrona1.20.0Apache 2.0https://github.com/real-logic/agrona

GraalVM (JavaScript Support)

Group IDArtifact IDVersionLicenseHomepage
org.graalvm.sdkgraal-sdk25.0.2UPL 1.0https://www.graalvm.org/
org.graalvm.polyglotpolyglot25.0.2UPL 1.0https://www.graalvm.org/
org.graalvm.polyglotjs25.0.2UPL 1.0https://www.graalvm.org/
org.graalvm.jsjs-language25.0.2UPL 1.0https://www.graalvm.org/
org.graalvm.regexregex25.0.2UPL 1.0https://www.graalvm.org/
org.graalvm.truffletruffle-api25.0.2UPL 1.0https://www.graalvm.org/
org.graalvm.truffletruffle-runtime25.0.2UPL 1.0https://www.graalvm.org/

License Note: UPL = Universal Permissive License 1.0

Studio Frontend Libraries

PackageVersionLicenseHomepage
marked15.xMIThttps://github.com/markedjs/marked

Compression

Group IDArtifact IDVersionLicenseHomepage
org.xerial.snappysnappy-java1.1.10.7Apache 2.0https://github.com/xerial/snappy-java

Server and Networking

Group IDArtifact IDVersionLicenseHomepage
io.undertowundertow-core~2.3.xApache 2.0https://undertow.io/
io.nettynetty-*~4.1.xApache 2.0https://netty.io/

Apache Ratis (High Availability Module)

Group IDArtifact IDVersionLicenseHomepage
org.apache.ratisratis-server3.2.2Apache 2.0https://ratis.apache.org/
org.apache.ratisratis-grpc3.2.2Apache 2.0https://ratis.apache.org/
org.apache.ratisratis-metrics-default3.2.2Apache 2.0https://ratis.apache.org/

Apache Ratis Notice: Apache Ratis is a Java library that implements the Raft consensus protocol. See the NOTICE file for Ratis's own third-party attributions.

Apache TinkerPop / Gremlin (Optional Module)

Group IDArtifact IDVersionLicenseHomepage
org.apache.tinkerpopgremlin-core3.8.xApache 2.0https://tinkerpop.apache.org/
org.apache.tinkerpopgremlin-driver3.8.xApache 2.0https://tinkerpop.apache.org/
org.apache.tinkerpopgremlin-server3.8.xApache 2.0https://tinkerpop.apache.org/
org.apache.tinkerpopgremlin-util3.8.xApache 2.0https://tinkerpop.apache.org/
org.apache.tinkerpopgremlin-groovy3.8.xApache 2.0https://tinkerpop.apache.org/
org.apache.groovygroovy~4.0.xApache 2.0https://groovy-lang.org/
org.antlrantlr4-runtime (shaded, relocated to com.arcadedb.gremlin.shaded.org.antlr)4.9.1BSD 3-Clausehttps://www.antlr.org/

Note: Gremlin support is an optional module. These dependencies are only included when the Gremlin module is enabled. The Gremlin module's shaded jar bundles its own relocated copy of antlr4-runtime 4.9.1 (required by the TinkerPop/OpenCypher-Gremlin translation layer), independent of the engine's antlr4-runtime 4.13.2 listed under Core Dependencies.

gRPC (Optional Module)

Group IDArtifact IDVersionLicenseHomepage
io.grpcgrpc-netty-shaded1.79.0Apache 2.0https://grpc.io/
io.grpcgrpc-protobuf1.79.0Apache 2.0https://grpc.io/
io.grpcgrpc-stub1.79.0Apache 2.0https://grpc.io/
io.grpcgrpc-services1.79.0Apache 2.0https://grpc.io/
com.google.protobufprotobuf-java4.33.5BSD 3-Clausehttps://protobuf.dev/

Google Core Libraries

Group IDArtifact IDVersionLicenseHomepage
com.google.guavaguava33.5.0-androidApache 2.0https://github.com/google/guava
com.google.code.findbugsjsr3053.0.2Apache 2.0https://code.google.com/archive/p/jsr-305/
com.google.errorproneerror_prone_annotations2.45.0Apache 2.0https://errorprone.info/

Apache Commons Libraries

Group IDArtifact IDVersionLicenseHomepage
org.apache.commonscommons-compress1.28.0Apache 2.0https://commons.apache.org/proper/commons-compress/
org.apache.commonscommons-lang33.18.0Apache 2.0https://commons.apache.org/proper/commons-lang/
commons-codeccommons-codec1.19.0Apache 2.0https://commons.apache.org/proper/commons-codec/
commons-iocommons-io2.20.0Apache 2.0https://commons.apache.org/proper/commons-io/

Apache HttpComponents

Group IDArtifact IDVersionLicenseHomepage
org.apache.httpcomponentshttpclient4.5.14Apache 2.0https://hc.apache.org/httpcomponents-client-4.5.x/
org.apache.httpcomponentshttpcore4.4.16Apache 2.0https://hc.apache.org/httpcomponents-core-4.4.x/

Security and Authentication

Group IDArtifact IDVersionLicenseHomepage
org.conscryptconscrypt-openjdk-uber2.5.2Apache 2.0https://github.com/google/conscrypt
com.google.authgoogle-auth-library-credentials1.41.0BSD 3-Clausehttps://github.com/googleapis/google-auth-library-java
com.google.authgoogle-auth-library-oauth2-http1.41.0BSD 3-Clausehttps://github.com/googleapis/google-auth-library-java

Monitoring and Metrics (Optional)

Group IDArtifact IDVersionLicenseHomepage
io.micrometermicrometer-core1.16.5Apache 2.0https://micrometer.io/
io.micrometermicrometer-observation1.16.5Apache 2.0https://micrometer.io/
io.micrometermicrometer-registry-otlp1.16.5Apache 2.0https://micrometer.io/
org.hdrhistogramHdrHistogram2.2.2Public Domain / CC0https://hdrhistogram.github.io/HdrHistogram/

Distributed Tracing (Optional)

Used only by the optional tracing module (OpenTelemetry distributed tracing). Confined to that plugin; not on the core/server compile classpath.

Group IDArtifact IDVersionLicenseHomepage
io.micrometermicrometer-tracing1.7.0Apache 2.0https://micrometer.io/
io.micrometermicrometer-tracing-bridge-otel1.7.0Apache 2.0https://micrometer.io/
io.opentelemetryopentelemetry-sdk1.62.0Apache 2.0https://opentelemetry.io/
io.opentelemetryopentelemetry-api1.62.0Apache 2.0https://opentelemetry.io/
io.opentelemetryopentelemetry-context1.62.0Apache 2.0https://opentelemetry.io/
io.opentelemetryopentelemetry-sdk-trace1.62.0Apache 2.0https://opentelemetry.io/
io.opentelemetryopentelemetry-sdk-common1.62.0Apache 2.0https://opentelemetry.io/
io.opentelemetryopentelemetry-exporter-otlp1.62.0Apache 2.0https://opentelemetry.io/
io.opentelemetryopentelemetry-exporter-otlp-common1.62.0Apache 2.0https://opentelemetry.io/
io.opentelemetryopentelemetry-exporter-common1.62.0Apache 2.0https://opentelemetry.io/
io.opentelemetryopentelemetry-exporter-sender-okhttp1.62.0Apache 2.0https://opentelemetry.io/
io.opentelemetryopentelemetry-extension-trace-propagators1.62.0Apache 2.0https://opentelemetry.io/
io.opentelemetry.semconvopentelemetry-semconv1.41.1Apache 2.0https://opentelemetry.io/
com.squareup.okhttp3okhttp5.3.2Apache 2.0https://square.github.io/okhttp/
com.squareup.okiookio3.16.4Apache 2.0https://square.github.io/okio/
org.jetbrains.kotlinkotlin-stdlib2.2.21Apache 2.0https://kotlinlang.org/
org.jetbrainsannotations13.0Apache 2.0https://github.com/JetBrains/java-annotations

Transitive Dependencies Found by the #5651 License Audit

Not declared directly in any module's pom.xml; pulled in transitively and missing from this document until the Maven-wide allow-list check (.github/scripts/check-license-allowlist.py) was added and run against the full reactor for the first time.

Group IDArtifact IDLicensePulled in viaHomepage
org.mozillarhinoMPL-2.0io.swagger:swagger-parser (API documentation tooling)https://mozilla.github.io/rhino/
org.mindrotjbcryptISCorg.apache.tinkerpop:gremlin-groovy (optional Gremlin module)https://github.com/djmdjm/jBCrypt
javax.annotationjavax.annotation-apiCDDL 1.1 + GPLv2 with classpath exceptionnot individually traced; a common transitive dependency of javax/jakarta-based libraries in the graphhttp://jcp.org/en/jsr/detail?id=250
jakarta.annotationjakarta.annotation-apiEPL 2.0 / GPL-2.0 WITH Classpath-exception-2.0 (dual; EPL 2.0 selected)not individually traced; a common transitive dependency of jakarta-based libraries in the graphhttps://projects.eclipse.org/projects/ee4j.ca

License Note: MPL-2.0 and CDDL are permitted here under CLAUDE.md's "for libraries only, unmodified" carve-out (the same one LGPL 2.1+ already had). jakarta.annotation-api is dual EPL-2.0/GPL-2.0+CPE; EPL-2.0 was already allowed outright, so the GPL option is moot. javax.annotation-api's CDDL/GPLv2 dual license is the standard javax.*-API license; the classpath exception on its GPL option is what makes it safe to depend on.

Test Dependencies

These dependencies are used only for testing and are not included in production distributions:

Group IDArtifact IDVersionLicenseHomepage
org.junit.jupiterjunit-jupiter6.0.2EPL 2.0https://junit.org/junit5/
org.junit.jupiterjunit-jupiter-api6.0.2EPL 2.0https://junit.org/junit5/
org.junit.jupiterjunit-jupiter-engine6.0.2EPL 2.0https://junit.org/junit5/
org.junit.jupiterjunit-jupiter-params6.0.2EPL 2.0https://junit.org/junit5/
org.assertjassertj-core3.27.7Apache 2.0https://assertj.github.io/doc/
org.mockitomockito-core5.21.0MIThttps://site.mockito.org/
org.testcontainerstestcontainers2.0.3MIThttps://testcontainers.com/
org.testcontainerstestcontainers-junit-jupiter2.0.3MIThttps://testcontainers.com/
org.testcontainerstestcontainers-toxiproxy2.0.3MIThttps://testcontainers.com/
org.awaitilityawaitility4.3.0Apache 2.0https://github.com/awaitility/awaitility
com.jayway.jsonpathjson-path2.10.0Apache 2.0https://github.com/json-path/JsonPath
com.github.docker-javadocker-java-api3.7.0Apache 2.0https://github.com/docker-java/docker-java
net.bytebuddybyte-buddy1.18.3Apache 2.0https://bytebuddy.net/
org.openjdk.jmhjmh-core1.37GPL-2.0 WITH Classpath-exception-2.0https://openjdk.java.net/projects/code-tools/jmh/
org.openjdk.jmhjmh-generator-annprocess1.37GPL-2.0 WITH Classpath-exception-2.0https://openjdk.java.net/projects/code-tools/jmh/

Build-Time Dependencies

These dependencies are used only during the build process:

Group IDArtifact IDVersionLicenseHomepage
org.apache.maven.pluginsmaven-compiler-plugin3.xApache 2.0https://maven.apache.org/plugins/maven-compiler-plugin/
org.apache.maven.pluginsmaven-surefire-plugin3.xApache 2.0https://maven.apache.org/surefire/maven-surefire-plugin/
org.jacocojacoco-maven-plugin0.8.xEPL 2.0https://www.jacoco.org/jacoco/
org.antlrantlr4-maven-plugin4.13.2BSD 3-Clausehttps://www.antlr.org/
io.grpcprotoc-gen-grpc-java1.79.0Apache 2.0https://grpc.io/
com.github.os72protoc-jar-maven-plugin3.xApache 2.0https://github.com/os72/protoc-jar-maven-plugin

License References

Full license texts are available in the LICENSES/ directory:

  • Apache-2.0.txt - Apache License, Version 2.0
  • MIT.txt - MIT License
  • BSD-3-Clause.txt - BSD 3-Clause License
  • EPL-2.0.txt - Eclipse Public License 2.0
  • UPL-1.0.txt - Universal Permissive License 1.0
  • LGPL-2.1-or-later.txt - GNU Lesser General Public License 2.1 or later
  • EDL-1.0.txt - Eclipse Distribution License 1.0

Primary Project License

ArcadeDB itself is licensed under the Apache License 2.0.

See the LICENSE file in the root directory for the full license text.

REUSE Compliance

This project follows the REUSE Software Specification 3.3 for copyright and license attribution. All source files contain SPDX license identifiers and copyright notices in their headers.

Contributor Acknowledgments

ArcadeDB is built on the shoulders of giants. We thank:

  • OrientDB community - For the SQL engine and utility components
  • openCypher community - For the standardized Cypher query language and TCK
  • Neo4j - For creating Cypher and supporting openCypher
  • Apache Software Foundation - For Lucene, TinkerPop, and numerous other libraries
  • The Java community - For the robust ecosystem and tooling
  • All individual contributors - Named in git history and @author tags

Special recognition to original authors mentioned in source files:

  • Johann Sorel - SQLMethod interface design
  • @ExtReMLapin - OpenCypher-Gremlin security fix

How to Contribute

When adding new dependencies to ArcadeDB:

  1. Check License Compatibility - Ensure the license is compatible with Apache 2.0

    • ✅ Approved: Apache 2.0, MIT, BSD, EPL, UPL, public domain
    • ❌ Incompatible: GPL, AGPL, proprietary licenses without explicit permission

  2. Update This File - Add the dependency to the appropriate section above

  3. Update NOTICE File - If the dependency is Apache-licensed and has its own NOTICE file, incorporate required notices

  4. Add License Text - If introducing a new license type, add the full text to LICENSES/ directory

  5. SPDX Headers - Ensure all new source files have proper SPDX-FileCopyrightText and SPDX-License-Identifier headers

For detailed contribution guidelines, see CONTRIBUTING.md.

Questions or Concerns

If you have questions about licensing or attribution:

This attribution document is maintained as part of ArcadeDB's commitment to open source compliance and transparency. Last updated: 2026-02-07