We have a copy of CronExpression in our codebase (https://github.com/camunda/camunda-bpm-platform/blob/master/engine/src/main/java/org/camunda/bpm/engine/impl/calendar/CronExpression.java). Similar to JUEL, this should be mentioned in the NOTICE file.