fobject dependency issues

[lookfirst]

Please bear with me, this is node backwards incompatibility dependency hell.

This project has a dependency on fobject. That project depends on graceful-fs@3.x.

graceful-fs@3.x is incompatible with node 6. isaacs/node-graceful-fs#61

fobject author isn't fixing things for months now. notslang/fobject#4

So, you get the pressure now. Either dump fobject or find a replacement please.

[lookfirst]

Ok, now the author just changed the license to GPL3, which means that you can no longer depend on it at all without causing other people to get infected.

[notslang]

Sorry about the delay - I published v0.0.4 which upgrades all the deps (without any breaking changes).

@lookfirst: With regards to being "infected", read this: http://www.rosenlaw.com/html/GPL.pdf ... accord, roots, and all the other related software is already FOSS and is fully compliant with the terms of the GPL. The license change just prevents you from taking the new version of fobject, modifying it, and then releasing it to users without providing the source code. IIRC, you can even use a GPL-3.0 module in a proprietary project so long as the source of that module isn't modified or that modified source code is provided to users (since a node module acts as a standalone component). The text of the GPL calls this an "aggregate":

A compilation of a covered work with other separate and independent works, which are not by their nature extensions of the covered work, in or on a volume of a storage or distribution medium, is called an "aggregate" if the compilation and its resulting copyright are not used to limit the access or legal rights of the compilation's users beyond what the individual works permit. Inclusion of a covered work in an aggregate does not cause this License to apply to the other parts of the aggregate.

[lookfirst]

You're right about the infected part, I take that back.

The rosenlaw pdf was written in 2001, which is ~6 years before GPLv3 was published. It is referring to v2.

[jescalan]

Well then, it looks like the next step here is to bump the dependency and release. Anyone want to put in a PR?

[jescalan]

Ok merged up 👍

[lookfirst]

do a release please?

[jescalan]

released as accord@0.23.0

[gwhite]

It's worth noting that the definition of an "aggregate" under the GPLv3 differs to the version @slang800 quoted above. The actual definition includes an extra condition, highlighted below:

A compilation of a covered work with other separate and independent works, which are not by their nature extensions of the covered work, and which are not combined with it such as to form a larger program, in or on a volume of a storage or distribution medium, is called an “aggregate” if the compilation and its resulting copyright are not used to limit the access or legal rights of the compilation's users beyond what the individual works permit. Inclusion of a covered work in an aggregate does not cause this License to apply to the other parts of the aggregate.

This suggests to me that if you were to use a GPL node module such as fobject within a node application, you could not consider it to be an aggregate, and so the special exemptions granted to aggregates would not apply.

If you want to distribute a node application that uses a GPL node module, you have to decide whether your application would be considered to be a "work based on" the module. If it is, the whole application must be licensed under the GPL.

It is somewhat debatable whether a program which uses a GPL library is considered to be a "work based on" that library. The GPL FAQ indicates that it is - see for example:

• https://www.gnu.org/licenses/gpl-faq.html#IfLibraryIsGPL
• https://www.gnu.org/licenses/gpl-faq.html#GPLStaticVsDynamic