globalizejs / globalizejs/globalize
Remove GPL License from upstream packages
- Dominant language
- JavaScript
- Stars
- 4.8k
- Forks
- 585
- PR merge metrics
- No merged PRs in 30d
Description
When adding a downstream dependency `strong-soap` I was getting a warning because `adm-zip` had GPL code and this fails our license check preventing us from using this package. Since then, the GPL code has been removed but the package tree needs to be updated. I've traced this update and I believe that `cldr-data` is the next package that needs to be updated in this process, followed by `globalize`

- At the root, `adm-zip` is the issue. This package has been updated to remove GPL code and any version above `0.4.12` no longer has this warning.
- `cldr-data-downloader` is the next culprit any looking at version [`0.3.5`](https://github.com/rxaviers/cldr-data-downloader/blob/master/package.json#L3) now has `adm-zip` at `0.4.13` and so this package is no longer an issue
- Next level is this [`cldr-data`](https://github.com/rxaviers/cldr-data-npm/blob/master/package.json#L39) which currently pings to 0.3.x of `cldr-data`, so it is unclear to me whether this package has been published with a more recent version with the bumped `adm-zip`. I've [opened an issue](https://github.com/rxaviers/cldr-data-npm/issues/67) in the `cldr-data` package asking them to bump this version in case it has not already been bumped.
### Proposal
- Potentially use an explicit version of `cldr-data-downloader` to `0.3.5`
- I am uncertain where the standard `cldr-data` package is being included in this package.json, but wherever that comes from, bumping that version after cldr-data fixes this license issue would be needed
- Publish a new patch or minor version of this module with the updated versions that no longer have GPL license code
Contributor guide
Assessment
This issue has not been assessed yet.