Aman-Mittal commented on issue #377: URL: https://github.com/apache/fineract-backoffice-ui/issues/377#issuecomment-5308243845
Blocker **L1** (the LGPL-3.0 devDependency) is addressed by #378, which removes `eslint-plugin-sonarjs` and replaces it with MIT/Apache-2.0 equivalents. That changes the PMC question rather than answering it. The decision "is a build-only Category X dependency acceptable in a source release?" is no longer blocking *this* release, because there is no longer such a dependency — but it is still worth an answer on the dev list, since it will come up again on the next transitive bump. #378 also turns the policy into a gate, so the next one fails CI rather than an audit: ``` Category A PASS Category B REVIEW reported for PMC awareness Category X BLOCK Unknown BLOCK legal review ``` Current state over the whole tree: **1188 Category A, 7 acknowledged (BlueOak-1.0.0), 2 Category B (MPL-2.0, test-only), 0 Category X, 0 unclassified.** Production alone is 25 packages, all Category A. One item for the PMC comes *out* of that work rather than being resolved by it: `BlueOak-1.0.0` is plainly permissive but is named in neither ASF category list. It is recorded in the script's `ACKNOWLEDGED` map, treated as Category A, and marked **pending PMC confirmation** — a written decision rather than a silent one. It reaches the tree only through build tooling (ESLint and the Angular CLI), so nothing distributed depends on the answer. Cognitive complexity was preserved through the swap by implementing the rule locally at the same threshold, since nothing permissive on npm implements it. Details in the PR. Remaining blockers on this issue are unchanged: **V1** (version is `0.0.0`), **D1** (no release documentation), and **E1–E3** if the release ships a container. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
