Licensing Vulnerability in react-use Dependency

Open Beginner friendly
#2,615 0 comments 1 reaction 0 assignees View on GitHub

Nobody has claimed this yet.

Assessment

Difficulty
2/5
Estimated time
1-3 hours
Newbie friendliness
64/100
Issue type
Bug
Clarity
Mostly clear
Activity status
Stale
Tech stack
react, typescript
Domain
security

Research direction

Locate the throttle-debounce 3.0.1 dependency in the repository and review how it is used by react-use. Check the dependency update against the existing React 18.2.0 setup, then run the project's available tests and FOSSA scan; done means the GPL-2.0-only flag is gone.

Written by the indexing model from the issue text.

Description

What is the current behavior?

When running a FOSSA scan, the 'throttle-debounce' package version 3.0.1 returns a flag of 'Flagged: GPL-2.0-only' for its licensing. The most up-to-date version of the throttle-debounce package (5.0.2) has since adjusted to use MIT as its licensing. Additional behavior changes in throttle-debounce do not seem to affect how it's being currently used in react-use.

What is the expected behavior?
FOSSA scan no longer flagging GPL licensing as an issue.

A little about versions:

  • OS: N/A
  • Browser (vendor and version): N/A
  • React: 18.2.0
  • react-use: 17.6.0
  • Did this worked in the previous package version? unsure but likely not
Dominant language
TypeScript
Stars
44k
Forks
3.3k
No merged PRs in 30d

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from streamich/react-use

All issues in streamich/react-use

Similar issues

More TypeScript issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.