testing-library / dom-testing-library

🐙 Simple and complete DOM testing utilities that encourage good testing practices.
https://testing-library.com/dom
MIT License
3.26k stars 466 forks source link

Transitive lz-string library uses WTFPL #1187

Closed Blacktiger closed 11 months ago

Blacktiger commented 1 year ago

This library depends on lz-string which according to npm is licensed by the WTFPL. That license is a banned license at many organizations (including my employer). Please consider replacing it with something that includes a sane license since npm and yarn don't provide any good way to replace the library with a different one.

Describe the feature you'd like:

Replace the lz-string dependency with something else. It includes a license file declaring the license as WTFPL which is a banned license at many organizations.

Suggested implementation:

The only place I see in the code which uses lz-string is: https://github.com/testing-library/dom-testing-library/blob/4f965e9e6f2c89b50b88f7f50273264a606542b5/src/screen.ts#L17

If there is no decoding done on the string it doesn't even seem like that method does anything so maybe it can be simply removed? Or replaced with some alternative library/algorithm? It does seem like lz-string is also used in the testing-playground but I don't know how that relates to this project.

Describe alternatives you've considered:

I tried to see if yarn would allow me to replace the dependency with something else. The original library now has an MIT license file on the github repository, but there doesn't seem to be any way to get it re-published under that license without forking (possible to do just for dom-testing-library if that library is important).

revelt commented 1 year ago

Linking the issue ticket on lz-string: https://github.com/pieroxy/lz-string/issues/147

eps1lon commented 1 year ago

(possible to do just for dom-testing-library if that library is important).

Do you have any legal references if we can just do that? Like, can we just fork the current state and publish under @testing-library/lz-string? Would that not mean that all the current code is under WTFPL?

Blacktiger commented 1 year ago

If the current codebase has an MIT license I would think so. According to the above ticket it appears the author may finally be re-publishing the package soon.

eps1lon commented 1 year ago

Doesn't seem like they published it yet. Will ask again in a week and then just publish it from a fork if they forget again. I thought we would also have to relicense (which I'm not familiar with). But the source is already licensed under MIT which means we can just publish it anywhere.

MatanBobi commented 11 months ago

Closing since this was resolved in https://github.com/testing-library/dom-testing-library/pull/1219