@keystatic/core depends on y-provider, which declares no licence

Open
#1,621 0 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Assessment

Difficulty
5/5
Estimated time
Over a week
Newbie friendliness
35/100
Issue type
Bug
Clarity
Needs clarification
Activity status
Active
Tech stack
typescript
Domain
tooling

Research direction

Start by running the listed npm view commands and tracing @keystatic/core@0.5.51 through @toeverything/y-indexeddb@0.10.0-canary.9 to y-provider. Determine whether a suitable release or replacement removes the undeclared licence metadata; done means the dependency tree no longer contains an unclassifiable y-provider package, or its upstream package declares the licence.

Written by the indexing model from the issue text.

Description

What

@keystatic/core@0.5.51 → @toeverything/y-indexeddb@0.10.0-canary.9 → y-provider@0.10.0-canary.9.

y-provider (a Yjs provider utility from the AFFiNE project, published in 2023 as canary builds) has no license field in its package.json, no LICENSE file in the tarball, and no repository field, so licence scanners report it as "no licence declared". The latest published version, 0.10.3-canary.2 (2023-11-23), is the same. The AFFiNE monorepo it comes from is MIT-licensed, but nothing in the npm artefact says so.

Why it matters

Anyone running a licence audit on a Keystatic-based site (we generate sites with Keystatic as an optional CMS and keep a dependency licence register) ends up with one transitive package they cannot classify, and @toeverything/y-indexeddb is the only reason it is in the tree.

Ask

One of:

  • pin @toeverything/y-indexeddb to a release whose y-provider declares a licence, if one exists;
  • vendor or replace the IndexedDB provider so the unlicensed canary package is no longer required;
  • or, if you have a line to the AFFiNE maintainers, ask for a license: MIT field on y-provider and a non-canary release.

Happy to test a canary. Thanks for Keystatic.

Reproduce
npm view y-provider@0.10.0-canary.9 license repository   # both empty
npm view @toeverything/y-indexeddb@0.10.0-canary.9 dependencies
Dominant language
TypeScript
Stars
2.4k
Forks
159
Avg merge
21h 41m
Merged PRs (30d)
2

Contributor guide

No contributing guide indexed for this repository

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from Thinkmill/keystatic

All issues in Thinkmill/keystatic

Similar issues

More TypeScript issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.