Skip to content

Blue Oak license in dependency tree is not OSI approved #25387

@JSMike

Description

@JSMike

Command

new

Is this a regression?

  • Yes, this behavior used to work in the previous version

The previous version in which this bug was not present was

No response

Description

Recent changes to glob result in issues with licenses. glob now depends on jackspeak and path-scurry which are using the new Blue Oak license. The Blue Oak license is not approved by OSI. This is impacting my company's ability to pull in @angular-devkit/build-angular@16 and @angular/cli@15, along with any other company that relies on OSI standards for legal.

isaacs/path-scurry#7

Minimal Reproduction

npx @angular/cli@latest new blueoak16 --interactive=false

Mike@DESKTOP ~/dev/blueoak16 (master)
$ npm ls jackspeak
blueoak16@0.0.0 C:\Users\Mike\dev\blueoak16
└─┬ @angular-devkit/build-angular@16.1.0
  └─┬ cacache@17.1.3
    └─┬ glob@10.2.7
      └── jackspeak@2.2.1

Mike@DESKTOP ~/dev/blueoak (master)
$ npm ls path-scurry
blueoak16@0.0.0 C:\Users\Mike\dev\blueoak16
└─┬ @angular-devkit/build-angular@16.1.0
  └─┬ cacache@17.1.3
    └─┬ glob@10.2.7
      └── path-scurry@1.9.2

or:

npx @angular/cli@l15.2.4 new blueoak15 --interactive=false

Mike@DESKTOP ~/dev/blueoak15 (master)
$ npm ls jackspeak
blueoak15@0.0.0 C:\Users\Mike\dev\blueoak15
└─┬ @angular/cli@15.2.8
  └─┬ pacote@15.1.0
    └─┬ read-package-json@6.0.4
      └─┬ glob@10.2.7
        └── jackspeak@2.2.1

Mike@DESKTOP ~/dev/blueoak15 (master)
$ npm ls path-scurry
blueoak15@0.0.0 C:\Users\Mike\dev\blueoak15
└─┬ @angular/cli@15.2.8
  └─┬ pacote@15.1.0
    └─┬ read-package-json@6.0.4
      └─┬ glob@10.2.7
        └── path-scurry@1.9.2

Exception or Error

No response

Your Environment

     _                      _                 ____ _     ___
    / \   _ __   __ _ _   _| | __ _ _ __     / ___| |   |_ _|
   / △ \ | '_ \ / _` | | | | |/ _` | '__|   | |   | |    | |
  / ___ \| | | | (_| | |_| | | (_| | |      | |___| |___ | |
 /_/   \_\_| |_|\__, |\__,_|_|\__,_|_|       \____|_____|___|
                |___/


Angular CLI: 16.1.0
Node: 18.16.0
Package Manager: npm 9.5.1
OS: win32 x64

Angular: 16.1.1
... animations, common, compiler, compiler-cli, core, forms
... platform-browser, platform-browser-dynamic, router

Package                         Version
---------------------------------------------------------
@angular-devkit/architect       0.1601.0
@angular-devkit/build-angular   16.1.0
@angular-devkit/core            16.1.0
@angular-devkit/schematics      16.1.0
@angular/cli                    16.1.0
@schematics/angular             16.1.0
rxjs                            7.8.1
typescript                      5.1.3

Anything else relevant?

May also apply to Angular 14.

Unable to pull in any bug fixes or enhancements due to automated OSI enforcement at my company.

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type
    No fields configured for issues without a type.

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions