blog post for the finding of a non-free dependency #461

Idea: Non-free dependency was discovered and removed in new releases.

so, without the project
s/found/discovered
s/newest/new

For less repetition (now excerpt and title sound very similar) I suggest:

A dependency on a non-free package was discovered and removed in new releases.

Hmm I haven't noticed but I actually suggested the title in my comment. The excerpt can be longer and descriptive.

Given #461 (comment), I would suggest the following title:
Non-free dependency discovered in Forgejo and removed

And excerpt: A non-free JS library was discovered in the NPM dependency tree of the project and got the whole component depending on it was reimplemented without it. New 7.0 and 8.0 releases were published without this dependency.

excerpt: A non-free JavaScript library was discovered in the dependency tree of the project and the whole component depending on it was reimplemented. New 7.0 and 8.0 releases are published without this library.

Maybe it would be nice in the excerpt to also give already the reason why that is important?

Maybe it would be nice in the excerpt to also give already the reason why that is important?

I can't imagine how to write that in a short and quickly understandable form.

The problem is tracked in forgejo/discussions#193.
This is where it was reported.

I reformulated it and added the discussion.

• what timezone is used for dates?
• I don't think we need a dot after day number (not sure where such format is even used)
• s/were/was
• revert s/an/the

Btw, @bramh said he contacted Gitea in Discord about this yesterday. So it may worth noting, IDK, would like to see what Bram thinks.

I think it's better to link to https://github.com/go-gitea/gitea/issues/31660

Time changed to UTC (sorry, forgot the time zones)

Or should I remove the timestamps 🤔 They may be confusing...

They may be redundant.

This post needs to be released after #456, or I need to remove the link to the 8.0.0 release post.

They can be released at the same time and link to each other.

I changed it for the moment to forgejo/forgejo#4153 (for the case when we want to release this post before the release of 8.0.0 - can change it back later)

issue/ticket naming consistency.

It would be important to add related links. Either in the tracking issue, or here.

• Gitea commit that introduced the problem
• https://github.com/djaxho/pure-vue-chart/issues/2
• ...

added the gitea commit

1. Forgejo news titles usually include "Forgejo"
2. title could already be more precise on "removal"

e.g., Forgejo removes a non-free dependency

Possibly add link to https://codeberg.org/forgejo/forgejo/src/branch/forgejo/RELEASE-NOTES.md#7-0-6

Forgejo commitment is to always be a completely free, open source and community-first product. Non-free dependencies and distribution licensing are not in line with the values of Forgejo. The inclusion of a non-free component within the binary affects it's whole license. There's no place for non-free binaries in the Forgejo spaces, which unfortunately means that they all must be removed from releases prior to 7.0.6.

Add also link to the values of Forgejo

@earl-warren any idea when the planned deadline is for the removal of the old binaries? 🤔

Why not write "This will happen as soon as possible", to indicate we might need some quick tooling for this?

@fnetX We wanted to have a time gap so that theoretically people could mirror if necessary.

Here is a proposal:

Because GSAP is not Free Software, it cannot be [distributed in the Forgejo organization](https://codeberg.org/forgejo) hosted by Codeberg. It is not allowed by the [Codeberg Terms of Use](https://codeberg.org/Codeberg/org/src/branch/main/TermsOfUse.md#2-allowed-content-usage) and goes against [Forgejo core values](https://codeberg.org/forgejo/governance/src/branch/main/MISSION.md#values). The Forgejo binaries and OCI images will be deleted. It will take some time because the technical impact on existing Forgejo instances that depend on these images has to be carefully addressed.

two lines above: It uses "dependency" two times, but actually refers to different dependencies. What about "direct dependency" and "indirect dependency" to clarify the difference? If this is agreed upon, it should also be added in some other places so the reader gets an explanation of what it means ...

You mean Additionally [the author](https://github.com/lafriks/vue-bar-graph/issues/14) of the direct dependency and [Gitea](https://github.com/go-gitea/gitea/issues/31660) were informed of the non-free indirect dependency.

Or smth like Additionally [the author](https://github.com/lafriks/vue-bar-graph/issues/14) of the dependency and [Gitea](https://github.com/go-gitea/gitea/issues/31660) were informed of the non-free subdependency. 🤔

This would be the only place where GSAP is mentioned directly, and this would certainly raise questions and online searches for this non-free library.

I add a link to the license page of GASP

And maybe reword it to smth like: Because GSAP, the subdependency, is not Free...

A separator before this line would help. As it stands it does not read well in the continuation of the summary that comes before it.

In order to rule out further infringements

the word infringements is not right in this context.

Will change it to: To prevent more violations, the dependencies have been carefully checked and a new, improved tool for checking licenses has been introduced.

s/against/against the/

s/on these images/on them/

s/OCI/container/

During the investigation, another indirect dependency with incompatible license was found.
It has a more restrictive, [copyleft license](https://github.com/Juris-M/citeproc-js/blob/master/LICENSE) that is violated by Forgejo's [current license](https://codeberg.org/forgejo/forgejo/src/branch/forgejo/LICENSE).
The dependency was used for citing a repository in APA format (if the repository is set up for this) and has been [removed for the moment](https://codeberg.org/forgejo/forgejo/pulls/4595).

at is violated by Forgejo's...

I don't think it is necessary to get into specifics in this blog post, the link to the removal has all the information if someone is interested. And "violated" in this case is not correct: a license is incompatible with another, a license violation involves a person.

actually only if it switches to AGPL, if I understand correctly?

More positive final sentence would be nice to have.

What about:

As Forgejo decided to accept copyleft license last year, this dependency may be added again in the future.

actually only if it switches to AGPL, if I understand correctly?

Yes. And it is quite likely this will happen eventually. But this is probably too much details for this blog post, don't you think?

I'm OK with it.

small is not necessarily and it GSAP isn't really small - it's mjs dist is over 200 KiB (regular build is 570 KiB).

it is small compared to the entire codebase and it is also small in its impact in terms of user experience. I think it is fitting in that context because the first thought that comes to mind is: "what is the magnitude of the problem?". And honestly, it is a tiny thing with annoyingly large consequences.