I see that mongoimport has a vended copy of the Go core csv package at mongoimport/csv, used by mongoimport/csv.go. There's no indication of what version that is and it doesn't appear to be tracked with our other vended dependencies. There's also no mention of it in the third-party-licenses file(s).

We need to audit all files to identify vended code in non-standard locations, document them, and ensure we have proper license statements.