jcoffey-dev
4a9c0c1c55
Three things a licence audit turned up. None of them is a conflict -- every one of the 182 installed packages is permissive, and the relicence was within the copyright holder's gift -- but all three are ways the AGPL fails to stick. The offer was hard-coded to this repository. Section 13 asks whoever runs a modified version to offer *that* version's source, so every deployment with a patch in it was pointing at the wrong tree, and would have gone on doing so unless its operator noticed and edited the About page. SOURCE_URL now sets it, alongside APP_NAME, and both the sign-in page and About read it. The offer was also only visible after signing in. Whoever is looking at the sign-in form is interacting with the program over a network too, so the footer carries it now. And the two workspace packages declared no licence at all. Private, so npm never minded, but anything reading the tree saw a blank where the rest of the project says AGPL-3.0-or-later. Checked both ways round: with SOURCE_URL set to a fork, the sign-in page and About both point at the fork; with it unset, both fall back to this repository.
34 lines
820 B
JSON
34 lines
820 B
JSON
{
|
|
"name": "@ihasmail/web",
|
|
"version": "2.0.0",
|
|
"private": true,
|
|
"license": "AGPL-3.0-or-later",
|
|
"type": "module",
|
|
"scripts": {
|
|
"dev": "vite",
|
|
"build": "tsc -p tsconfig.json --noEmit && vite build",
|
|
"preview": "vite preview",
|
|
"typecheck": "tsc -p tsconfig.json --noEmit",
|
|
"test": "vitest run"
|
|
},
|
|
"dependencies": {
|
|
"@tanstack/react-virtual": "^3.13.2",
|
|
"dompurify": "^3.2.4",
|
|
"lucide-react": "^0.477.0",
|
|
"qrcode-generator": "^2.0.4",
|
|
"react": "^19.0.0",
|
|
"react-dom": "^19.0.0",
|
|
"wouter": "^3.6.0",
|
|
"zustand": "^5.0.3"
|
|
},
|
|
"devDependencies": {
|
|
"@types/react": "^19.0.10",
|
|
"@types/react-dom": "^19.0.4",
|
|
"@vitejs/plugin-react": "^4.3.4",
|
|
"jsdom": "^26.0.0",
|
|
"typescript": "^5.7.3",
|
|
"vite": "^6.2.0",
|
|
"vitest": "^3.0.8"
|
|
}
|
|
}
|