chore(deps): remove license-checker-rseidelsohn and replace with GH action#1488
chore(deps): remove license-checker-rseidelsohn and replace with GH action#1488guoda-puidokaite wants to merge 21 commits intomainfrom
Conversation
|
guoda-puidokaite
changed the title
guoda-puidokaite
changed the title
guoda-puidokaite
changed the title
guoda-puidokaite
changed the title
| "lint": "turbo run lint", | ||
| "test": "turbo run test", | ||
| "typecheck": "turbo run typecheck", | ||
| "check-licenses": "npx license-checker-rseidelsohn --summary --excludePackages='spawndamnit@3.0.1' --excludePrivatePackages --onlyAllow 'MIT;ISC;Apache-2.0;BSD-2-Clause;BSD-3-Clause;BSD-4-Clause;CC-BY-3.0;CC-BY-4.0;BlueOak-1.0.0;CC0-1.0;0BSD;Python-2.0;BSD*;Unlicense'", |
There was a problem hiding this comment.
Should Unlicense really be allowed (as in old check)? I think it should be removed?
There was a problem hiding this comment.
Yes, by docs, we need to remove this.
There was a problem hiding this comment.
I don't remember why we introduce it. But I remember we had to introduce so some packages could go through...
There was a problem hiding this comment.
The rule is "No license - no rights". So just want to understand the context here.
2 participants
Summary
Changes Made
license-checker-rseidelsohnfrom pnpm dependencies as it's not regularly maintained and introduced high vulnerabilities (in ticket description).Note: We're following the official guidance from the OSPO office and only "Permitted/Low Risk" dependencies. See OSPO Wiki.
Example:
Related Issues
Closes #1436
Testing Instructions
Please double check supported licences are correct.
You can test by introducing an unsupported licence (as discussed in our team meeting on Friday). However, the test here I should be sufficient.
Checklist
PR Manifesto
Review the PR Manifesto for best practises.