LGPL software infects ring-swagger, making it unusable in some corporations.

[kenrestivo-stem]

We were going to use yada/swagger at work, but can't now, because a search of the transitive depencies shows it depends on ring-swagger, which depends on metosin/scjsv, which depends on json-schema-validator, which is LGPL, and LGPL is not allowed.

Lein tree shows:

   [yada/swagger "1.2.1"]
     [metosin/ring-swagger "0.22.12" :exclusions [[org.clojure/clojure]]]
       [frankiesardo/linked "1.2.9"]
       [metosin/ring-http-response "0.8.0"]
       [metosin/schema-tools "0.9.0"]
       [metosin/scjsv "0.4.0"]
         [com.github.fge/json-schema-validator "2.2.6"]
           [com.github.fge/json-schema-core "1.2.5"]
             [com.github.fge/jackson-coreutils "1.8"]
             [com.github.fge/uri-template "0.9"]
               [com.github.fge/msg-simple "1.1"]
                 [com.github.fge/btf "1.2"]

It seems, per lein-licenses, like all the fge libraries are LGPL:

com.github.fge/json-schema-core - 1.2.5 - Lesser General Public License, version 3 or greater
com.github.fge/msg-simple - 1.1 - Lesser General Public License, version 3 or greater
com.github.fge/jackson-coreutils - 1.8 - Lesser General Public License, version 3 or greater
com.github.fge/uri-template - 0.9 - Lesser General Public License, version 3 or greater
com.github.fge/btf - 1.2 - Lesser General Public License, version 3 or greater
com.github.fge/json-schema-validator - 2.2.6 - Lesser General Public License, version 3 or greater

You'll probably need to update the license of ring-swagger, so it can disclose that it depends on LGPL software.

[Deraen]

Json-schema-validator 3 is dual licenced with LGPL and Apache license, so updating scjsv to that should help.

[Deraen]

For quickfix, you can exclude metosin/scjsv dependency, ring-swagger only needs it if you require ring.swagger.validator namespace.

[Deraen]

I read the json-schema-validator readme wrong, CURRENT version is dual licensed, some previous versions were LGPL only. Lein-licences just doesn't support multiple licences: https://github.com/technomancy/lein-licenses/issues/4

~/.m2/repository/com/github/fge/json-schema-validator/2.2.6 master*
❯ head -n22 json-schema-validator-2.2.6.pom | tail -n12
  <licenses>
    <license>
      <name>Lesser General Public License, version 3 or greater</name>
      <url>http://www.gnu.org/licenses/lgpl.html</url>
      <distribution>repo</distribution>
    </license>
    <license>
      <name>Apache Software License, version 2.0</name>
      <url>http://www.apache.org/licenses/LICENSE-2.0</url>
      <distribution>repo</distribution>
    </license>
  </licenses>

[Deraen]

I checked all the other packages also, and they are all dual licensed.

[kenrestivo-stem]

Great, thanks.

Also, I was able to do this to avoid the warning:

[yada "1.2.1" :exclusions [github.fge/json-schema-validator]]