Forward-port OSS npm license metadata fix - #4794
Conversation
Ensure the OSS npm tarball declares MIT and ships an independently verified MIT-only license. (cherry picked from commit e9567c2)
WalkthroughThe package now includes an MIT license file, declares MIT metadata, publishes the license, documents the declaration, and validates packed package contents before running Jest tests. ChangesPackage License Compliance
Estimated code review effort: 1 (Trivial) | ~5 minutes Suggested reviewers: 🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches📝 Generate docstrings
🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
Greptile SummaryCorrects the OSS npm package’s license metadata.
Confidence Score: 5/5The pull request appears safe to merge with no actionable defects identified. The package metadata and bundled license now agree with the repository’s OSS licensing, and the new guard validates the actual packed artifact without introducing a recursive package lifecycle or CI failure path. Important Files Changed
Reviews (1): Last reviewed commit: "Fix OSS npm package license metadata (#4..." | Re-trigger Greptile |
|
+ci-run-hosted |
Hosted CI RequestedTriggered 9 workflow(s) for View progress in the Actions tab. |
github-actions
Bot
added
the
ready-for-hosted-ci
![claude[bot]](https://avatars.github.com/in/1236702?s=60&v=4){kind=small}
![coderabbitai[bot]](https://avatars.github.com/in/347564?s=60&v=4){kind=small}
![chatgpt-codex-connector[bot]](https://avatars.github.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: d7cdd52a7d
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
Review summaryReviewed this as a forward-port of the OSS npm license fix (MIT for
Two things worth addressing before merge (left as inline comments):
Neither is a correctness bug in the license-fix itself — the metadata change and guard both work as intended — but the |
size-limit report 📦
|
Review summaryReviewed this as a forward-port of the OSS npm license metadata fix (#4792). The core change is sound and fixes a real bug: before this PR, Left two inline comments on
No security concerns — the script uses |
Address-review summaryScan scope: full PR history through 2026-07-26T05:27:36Z; no previous address-review cutoff. Mattered
Optional
Skipped
Deferred-work tracking: dropped; the two optional suggestions are not worth separate follow-up. All five review threads are resolved. Current-head Claude and CodeRabbit artifacts plus green hosted CI provide the independent merge signal. Next default scan starts after this comment. Say |
…t-policy * origin/main: (33 commits) Fix ci-required base ref for PR merge-ref checkouts (#4819) Honor response charset and reject non-2xx HTTP-served SSR bundles (#4817) [Pro] Redact RSC render-error metadata on the fetched (client-navigation) payload path (#4821) Forward-port the 17.0.1 changelog section to main (#4814) Handle selector metacharacters in renderComponent DOM IDs (#4808) [Pro] Prevent caching RSC renders with errors (#4804) Agents: trust Copilot review identities (#4807) Agents: bind fleet closeout to generated pack (#4805) Docs: ADR 0002 — Skills-in-package over MCP for agent-native DX (#4735) Scope GitHub release commands to the origin repository (#4803) Forward-port OSS npm license metadata fix (#4794) Add golden-output gate for the serverWebpackConfig generator template (#4790) Cover the rspack CSS SSR generator fixes and de-duplicate the loader path (#4788) Configure agent workflow repo policy (#4785) Forward-port gh include mixed framing from #4684 (#4784) Release: enforce one-change forward-port closeout (#4783) Forward-port multi-URL rolling-deploy seeding to main (#4782) Docs: clarify React 18 streaming without RSC (#4780) Docs: forward-port v17 upgrade and generator gate guidance (#4781) Record the final React on Rails 17.0.0 changelog (#4742) ... # Conflicts: # AGENTS.md # internal/contributor-info/release-train-runbook.md
Why
Forward-port the OSS npm license correction from the
release/17.0.1train somaindoes not regress after the ephemeral release branch is removed.Release-branch source: #4792 (
e9567c207e9c30ac9b956a1ed4306a4381e584cc).What changed
-x.react-on-railsas MIT and includes the package-local MIT license.Verification
pnpm install --frozen-lockfilepnpm --filter react-on-rails test— 27 suites, 367 testspnpm exec eslint packages/react-on-rails/scripts/check-package-license.mjspnpm exec prettier --check packages/react-on-rails/package.json packages/react-on-rails/LICENSE.md packages/react-on-rails/scripts/check-package-license.mjsgit diff --check origin/main...HEADChangelog
The release entry is handled by the dedicated
17.0.1.rc.0changelog PR againstrelease/17.0.1; its release closeout will be forward-ported separately.Summary by CodeRabbit
LICENSE.md.Merge qualification
development/beta; beta gate satisfied.ready-for-hosted-ci— optimized hosted CI completed for the current head.deferred_to_update_changelog— release-branch entry is already published and final closeout will be reconciled separately.Confidence note:
pnpm install --frozen-lockfile;pnpm --filter react-on-rails test(27 suites / 367 tests); focused artifact guard (0.45s); ESLint; Prettier;git diff --check origin/main...HEAD; pre-push hooks.