You are viewing a plain text version of this content. The canonical link for it is here.
Posted to dev@openserverless.apache.org by "pjfanning (via GitHub)" <gi...@apache.org> on 2026/09/15 20:48:49 UTC
[PR] LICENSE: attribute npm packages embedded in the pre-built JavaScript bundles [openserverless]
pjfanning opened a new pull request, #251:
URL: https://github.com/apache/openserverless/pull/251
## What
Lists, in the top-level `LICENSE`, the npm packages statically embedded in the three pre-built JavaScript bundles that the source release ships, and reproduces the MIT, ISC and BSD-3-Clause licence texts they require.
Found while verifying the 0.9.0-incubating RC5 source tarball. The bundles are `bun build` outputs checked into the `oplugins` submodule; they were attributed only in `oplugins/NOTICE`, while the top-level `LICENSE` stated that every bundled component is Apache-2.0. ASF policy puts pointers to permissive third-party licences in `LICENSE`, not `NOTICE`.
## Bundles covered
| Bundle | Embedded packages | Licences |
|---|---|---|
| `oplugins/util/upload.js` (1.0 MB) | minio 8.0.1 + 27 dependencies | Apache-2.0, MIT ×24, ISC ×2, BSD-3-Clause ×1 |
| `oplugins/util/config/configurator.js` | @clack/core, @clack/prompts, sisteransi, picocolors | MIT ×3, ISC ×1 |
| `oplugins/admin/usage/usage.js` | yaml 2.8.3 | ISC |
Every package's licence was checked against the npm registry for the exact version pinned in the shipped lockfiles (`oplugins/util/upload/bun.lock`, `oplugins/admin/usage/usagechecker/package-lock.json`) and, for the configurator, the lockfile at the tagged `oplugins` commit (its source directory is excluded from the tarball by `no-release.txt`). All are ASF Category A.
Two corrections relative to the list in `oplugins/NOTICE`:
- `@clack/core` is pinned at 0.3.4, not 0.3.5.
- `stream-chain` is not embedded in `upload.js` (only `stream-json/jsonl` and `stream-json/utils` are); it is omitted here.
The intro sentence of the "Bundled components" section no longer claims that every component is Apache-2.0.
## Stacked on #250
This branch is based on the branch of #250 because both PRs append to the end of `LICENSE`. Once #250 merges, this PR's diff reduces to the single commit `LICENSE: attribute npm packages embedded in the pre-built JavaScript bundles`.
## Follow-ups outside this repo
- The bundles themselves carry a plain ASF licence header above a megabyte of MIT/ISC/BSD code. A separate PR against `apache/openserverless-task` should make those headers state that the file embeds third-party code.
- `oplugins/NOTICE` should be trimmed to required attributions only; the per-package list belongs in `oplugins/LICENSE`.
🤖 Generated with [Claude Code](https://claude.com/claude-code)
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: dev-unsubscribe@openserverless.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] LICENSE: attribute npm packages embedded in the pre-built JavaScript bundles [openserverless]
Posted by "pjfanning (via GitHub)" <gi...@apache.org>.
pjfanning commented on PR #251:
URL: https://github.com/apache/openserverless/pull/251#issuecomment-5687942366
This includes the changes from #250 but I'd prefer to merge that while we decide what to do about these javascript files.
It appears that they are built and maybe we don't need to ship them in our tar.gz file and just build them as part of the build. That means we don't have the same requirements for listing the licenses in our source release tar.gz.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: dev-unsubscribe@openserverless.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] LICENSE: attribute npm packages embedded in the pre-built JavaScript bundles [openserverless]
Posted by "sciabarracom (via GitHub)" <gi...@apache.org>.
sciabarracom closed pull request #251: LICENSE: attribute npm packages embedded in the pre-built JavaScript bundles
URL: https://github.com/apache/openserverless/pull/251
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: dev-unsubscribe@openserverless.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] LICENSE: attribute npm packages embedded in the pre-built JavaScript bundles [openserverless]
Posted by "sciabarracom (via GitHub)" <gi...@apache.org>.
sciabarracom commented on PR #251:
URL: https://github.com/apache/openserverless/pull/251#issuecomment-5687995176
the problem here looks like I forgot to analyzed the package.json of the utilities, luckily they are all compiant but they shoud have been included in the source license. Thank you for pointing out.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: dev-unsubscribe@openserverless.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] LICENSE: attribute npm packages embedded in the pre-built JavaScript bundles [openserverless]
Posted by "pjfanning (via GitHub)" <gi...@apache.org>.
pjfanning commented on PR #251:
URL: https://github.com/apache/openserverless/pull/251#issuecomment-5688038632
I think we need to look at removing them from future source releases.
You should be able to add bun build commands to the build scripts to regenerate them.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: dev-unsubscribe@openserverless.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] LICENSE: attribute npm packages embedded in the pre-built JavaScript bundles [openserverless]
Posted by "sciabarracom (via GitHub)" <gi...@apache.org>.
sciabarracom commented on PR #251:
URL: https://github.com/apache/openserverless/pull/251#issuecomment-5791108234
managed after updating the references and cleaned the code
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: dev-unsubscribe@openserverless.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org