← oss-verified

vercel/next.js

github.com

observed at 93eaf146 — 4 of 4 criteria failed; LLM audit unavailable

Observed (not attested)

No .oss-verified/attestation.bundle in this repo. We ran the oss-verify CLI against it ourselves on 2026-05-28.

This is our observation, not a signed credential. To publish your own attestation, add the GitHub Action / GitLab include from better-internet-org/oss-verify to this repo.

Criteria (observed)

✗ reuse: 26908 of 26908 source files missing SPDX-License-Identifier and no repo-level license declaration was found: - .agents/skills/README.md - .agents/skills/authoring-skills/SKILL.md - .agents/skills/backport-pr/SKILL.md - .agents/skills/create-pr/SKILL.md - .agents/skills/dce-edge/SKILL.md - .agents/skills/flags/SKILL.md - .agents/skills/gh-stack/SKILL.md - .agents/skills/pr-status-triage/SKILL.md - .agents/skills/pr-status-triage/local-repro.md - .agents/skills/pr-status-triage/workflow.md (+26898 more)
✗ osi_license: No declared license found. Looked at package.json `license` field, SPDX-License-Identifier headers in LICENSE/LICENCE/COPYING, and text-pattern detection against the LICENSE body.
✗ dependency_licenses: 100 packages with non-OSI licenses: android_system_properties@0.1.5: 'MIT/Apache-2.0' is not a valid SPDX expression: Unexpected `0` at offset 13 arrayvec@0.5.2: 'MIT/Apache-2.0' is not a valid SPDX expression: Unexpected `0` at offset 13 aws-lc-sys@0.30.0: non-OSI leaves: OpenSSL base64@0.13.1: 'MIT/Apache-2.0' is not a valid SPDX expression: Unexpected `0` at offset 13 bitflags@1.3.2: 'MIT/Apache-2.0' is not a valid SPDX expression: Unexpected `0` at offset 13 bitstream-io@2.5.3: 'MIT/Apache-2.0' is not a valid SPDX expression: Unexpected `0` at offset 13 blake3@1.8.2: non-OSI leaves: CC0-1.0 brotli-decompressor@2.3.4: 'BSD-3-Clause/MIT' is not a valid SPDX expression: Unexpected `T` at offset 15 bytecount@0.6.8: 'Apache-2.0/MIT' is not a valid SPDX expression: Unexpected `T` at offset 13 cesu8@1.1.0: 'Apache-2.0/MIT' is not a valid SPDX expression: Unexpected `T` at offset 13
✗ no_proprietary_blobs: Found 77 suspect file(s): - .github/actions/needs-triage/dist/index.js (avg line length 32768 chars — minified-without-source?) - .github/actions/next-repo-actions/dist/feature-requests/index.mjs (avg line length 32768 chars — minified-without-source?) - .github/actions/next-repo-actions/dist/issues/index.mjs (avg line length 32768 chars — minified-without-source?) - .github/actions/next-repo-actions/dist/prs/index.js (avg line length 32768 chars — minified-without-source?) - .github/actions/next-repo-actions/dist/wrong-issue-template/index.js (avg line length 32768 chars — minified-without-source?) - .github/actions/pr-auto-label/dist/index.js (avg line length 32768 chars — minified-without-source?) - .github/actions/upload-turboyet-data/dist/index.js.map (avg line length 32768 chars — minified-without-source?) - .github/actions/validate-docs-links/dist/index.js (avg line length 32768 chars — minified-without-source?) - examples/blog-starter/public/assets/blog/dynamic-routing/cover.jpg (binary, 117724 bytes, entropy 7.55 bits/byte) - examples/blog-starter/public/assets/blog/hello-world/cover.jpg (binary, 105406 bytes, entropy 7.84 bits/byte) - examples/blog-with-comment/public/desk.jpg (binary, 317143 bytes, entropy 7.97 bits/byte) - examples/blog/public/images/photo.jpg (binary, 216182 bytes, entropy 7.96 bits/byte) - examples/blog/public/images/photo2.jpg (binary, 153745 bytes, entropy 7.96 bits/byte) - examples/cms-kontent-ai/docs/author-content-type.png (binary, 111054 bytes, entropy 7.94 bits/byte) - examples/cms-kontent-ai/docs/post-preview-button.png (binary, 195832 bytes, entropy 7.94 bits/byte) - examples/cms-kontent-ai/docs/publish-post-overview.png (binary, 197343 bytes, entropy 7.96 bits/byte) - examples/cms-prismic/.slicemachine/assets/slices/Image/default/preview.png (binary, 485020 bytes, entropy 7.98 bits/byte) - examples/cms-tina/public/assets/blog/dynamic-routing/cover.jpg (binary, 117724 bytes, entropy 7.55 bits/byte) - examples/cms-tina/public/assets/blog/hello-world/cover.jpg (binary, 105406 bytes, entropy 7.84 bits/byte) - examples/cms-umbraco-heartcore/docs/install-sample.png (binary, 174625 bytes, entropy 7.90 bits/byte) Maintainers may exempt files via .oss-verified.toml (not yet wired in this MVP).

Run

Repository: https://github.com/vercel/next.js
Last checked: 2026-05-28T10:37:11.714Z
Commit: 93eaf146ecd2d5b2f291b04a7c51bca0b02f2dec
Overall result: failing
Deterministic checks: failed
LLM audit: unavailable — API error; will retry on the next watchlist cycle
show raw error
2/3 passes blocked: Anthropic API call failed (429) after 4 attempts: {"type":"error","error":{"type":"rate_limit_error","message":"This request would exceed your organization's rate limit of 30,000 input tokens per minute (org: 62638852-fd7d-4b3c-abb7-9d300e93c6ea, mod | Anthropic API call failed (429) after 4 attempts: {"type":"error","error":{"type":"rate_limit_error","message":"This request would exceed your organization's rate limit of 30,000 input tokens per minute (org: 62638852-fd7d-4b3c-abb7-9d300e93c6ea, mod
Recheck interval: 30 days

Links

This is our observation — the maintainer has not published a signed attestation. The check is reproducible: clone the repo at 93eaf146ecd2 and run npx @better-internet/oss-verify --report-json.