LGPL license clarification for apps created with create-react-app

[kinware]

Is this a bug report?

No, it is a licensing question.

Are applications created using create-react-app covered by LGPL due to the LGPL-licensed jschardet (indirect) dependency of the react-scripts NPM package?

I'm pretty sure LGPL does not come into play as jschardet is an indirect dependenct of eslint, which I believe does not end up as a part of the resulting application bundles.

But just to be sure, maybe someone with more detailed knowledge about create-react-app and react-scripts can confirm this?

Details

react-scripts has an indirect dependency of jschardet which is LGPL licensed:

test-app@1.0.0
│ /tmp/test-app
│ Test App
└─┬ react-scripts@1.0.16
  │ Configuration and scripts for Create React App.
  │ git+https://github.com/facebookincubator/create-react-app.git
  │ https://github.com/facebookincubator/create-react-app#readme
  └─┬ eslint@4.10.0
    │ An AST-based pattern checker for JavaScript.
    │ git+https://github.com/eslint/eslint.git
    │ https://eslint.org
    └─┬ inquirer@3.3.0
      │ A collection of common interactive command line user interfaces.
      │ git+https://github.com/SBoudrias/Inquirer.js.git
      │ https://github.com/SBoudrias/Inquirer.js#readme
      └─┬ external-editor@2.0.5
        │ Edit a string with the users preferred text editor using $VISUAL or $ENVIRONMENT
        │ git+https://github.com/mrkmg/node-external-editor.git
        │ https://github.com/mrkmg/node-external-editor#readme
        └── **jschardet@1.6.0** 
            Character encoding auto-detection in JavaScript (port of python's chardet)
            git+https://github.com/aadsm/jschardet.git
            https://github.com/aadsm/jschardet#readme

Output from license-check:

└─ jschardet@1.6.0
   ├─ licenses: **LGPL-2.1+**
   ├─ repository: https://github.com/aadsm/jschardet
   ├─ publisher: António Afonso
   ├─ path: /tmp/test-app/node_modules/jschardet
   └─ licenseFile: /tmp/test-app/node_modules/jschardet/LICENSE

[gaearon]

I’m not a lawyer, but the only runtime dependencies that are injected by CRA are three polyfills:

• https://www.npmjs.com/package/object-assign (MIT)
• https://www.npmjs.com/package/promise (MIT)
• https://www.npmjs.com/package/whatwg-fetch (MIT)

The default generated app also depends on react and react-dom although you could remove those dependencies. They are also MIT.

ESLint is not part of the generated output.

I hope this is helpful!

[kinware]

Thank you Dan for clarifying exactly what gets injected. Clears this question up completely.

Taking this opportunity to thank you @gaearon for your hard work on Redux, RHL, CRA and React! Not to mention your high quality Redux tutorials on egghead, which I am sure are a big part of driving Redux adoption. Stellar!

[gaearon]

Thanks!