Replace @webreflection/toml-j0.4 because it is a license-hazard
#2335
Replies: 3 comments 6 replies
-
|
I don't understand where's the license hazard when it's MIT, see https://github.com/WebReflection/toml-j0.4 |
Beta Was this translation helpful? Give feedback.
-
|
@iFreilicht to provide more context:
because it's MIT though, I don't understand what's the concern ... if you read "why we have that" you'll realize this is the most secure module you can bet on ... as it won't ever change over time. the day we'll change it, it'd be for something else either as dead or smaller/faster, not a full TOML parser for sure ... does this make sense? |
Beta Was this translation helpful? Give feedback.
-
|
Oh, hmm maybe I checked it wrong, but I just looked at https://github.com/pyscript/pyscript/blob/main/core/package.json#L85, which shows a dependency on https://www.npmjs.com/package/@webreflection/toml-j0.4, the license of which is "none" and the linked Github page of which 404s. I'm not entirely sure just having the comment
But that's alright, I'll just add the full license you linked above in our repo manually. Thank you for clearing this up! |
Beta Was this translation helpful? Give feedback.
-
|
we want to comply with licenses too so if the issue in here is that the provided dependency has malformed About having the whole license in each dependency, that's not how anyone else out there uses CDNs services or bundlers so, as long as it's clear we depend on that module, that module points at the right repo on npm and the license field in there is correct, I think we should be OK? |
Beta Was this translation helpful? Give feedback.
-
|
Well, sort of. CDNs actually allow you to inspect the contents of a package directly. For example, you might just load https://cdn.jsdelivr.net/npm/@webreflection/toml-j0.4@1.1.3/toml.js on your page, but if someone sees this, they can easily look at https://cdn.jsdelivr.net/npm/@webreflection/toml-j0.4@1.1.3/ and find LICENSE there. The CDN is storing the "copy of the Software" as a web-accessible folder and they "include" "The above copyright notice and this permission notice", just like the license requires. I don't know any CDNs that don't allow you to do this sort of inspection, and I believe this is precisely how they're complying with these licensing terms. The way you're handling it in your repo does not comply with that from what I can tell, as the "copy of the Software" does not "include" "The above copyright notice and this permission notice". However, I'm not a lawyer, so I can't say for sure. In any case, even if what you said ("we depend on that module, that module points at the right repo on npm and the license field in there is correct") was actually sufficient to comply with the license, this is not the case in this instance. The license field on npm is not correct, that's precisely why I thought there was a licensing issue here to begin with. |
Beta Was this translation helpful? Give feedback.
-
|
OK, I've updated the package.json and re-published it ... it will be part of our next PyScript release ... are we good? https://www.npmjs.com/package/@webreflection/toml-j0.4 |
Beta Was this translation helpful? Give feedback.
-
|
Looks good to me! |
Beta Was this translation helpful? Give feedback.
-
|
We have deduced that the package is indeed MIT. I personally believe that the way licensing 3rd-party packages is currently handled is not compliant, but that is irrelevant to this discussion. |
Beta Was this translation helpful? Give feedback.
-
|
here is where we bundle 3rd party libraries https://github.com/pyscript/pyscript/blob/main/core/rollup/3rd-party.cjs we could add a link on top of these that points explicitly at the jsdelvr CDN that provides that content so allow people surfing those packages ... we do this at build time only to allow offline usage through a package that contains those 3rd party dist, otherwise we could just grab (as we do already) those files via the CDN itself at runtime ... but that would break the offline use case. So ... would a link to the original source file at the CDN as it's served from the CDN solve all your concerns? |
Beta Was this translation helpful? Give feedback.
-
The package @webreflection/toml-j0.4 is currently used in the core library.
The last version was published 2 years ago, and the project has no license. Please consider removing it in favor of something more mainstream.
This can be particularly annoying when deploying pyscript in a restricted environment, see https://docs.pyscript.net/2024.3.2/user-guide/offline/. My workaround for now is to just not use any toml functionality and remove all files related to that library before deploying to a server.
Beta Was this translation helpful? Give feedback.
All reactions