Copilot commented on code in PR #6418:
URL: https://github.com/apache/shenyu/pull/6418#discussion_r3540501252
##########
shenyu-dist/shenyu-bootstrap-dist/src/main/release-docs/LICENSE:
##########
@@ -775,6 +777,7 @@ The text of each license is also included at
licenses/LICENSE-[project].txt.
mcp-json 0.17.0: https://github.com/modelcontextprotocol/java-sdk, MIT
mcp-json-jackson2 0.17.0:
https://github.com/modelcontextprotocol/java-sdk, MIT
mcp-spring-webflux 0.17.0:
https://github.com/modelcontextprotocol/java-sdk, MIT
+ oshi-core 6.10.0: https://github.com/oshi/oshi, MIT
Review Comment:
oshi-core is listed twice with different versions; in this repo oshi-core is
declared as 6.10.0 (see shenyu-common/pom.xml), so keeping the older 6.7.0
entry here is likely stale and can confuse license auditing.
##########
shenyu-dist/shenyu-bootstrap-dist/src/main/release-docs/LICENSE:
##########
@@ -653,6 +653,8 @@ The text of each license is the standard Apache 2.0 license.
spring-ai-openai 1.1.2: https://github.com/spring-projects/spring-ai,
Apache 2.0
spring-ai-retry 1.1.2: https://github.com/spring-projects/spring-ai,
Apache 2.0
spring-ai-template-st 1.1.2: https://github.com/spring-projects/spring-ai,
Apache 2.0
+ fastjson 1.2.76: https://github.com/alibaba/fastjson, Apache 2
+ error_prone_annotations 2.5.1:
http://www.apache.org/licenses/LICENSE-2.0.txt, Apache 2.0
Review Comment:
The newly added fastjson entry uses an inconsistent license label ("Apache
2" vs the rest of the file’s "Apache 2.0"), and the error_prone_annotations
entry links to the Apache license text rather than the component’s project page
(the section header says to use a project link).
##########
shenyu-dist/shenyu-admin-dist/src/main/release-docs/LICENSE:
##########
@@ -580,6 +581,7 @@ The text of each license is also included at
licenses/LICENSE-[project].txt.
checker-qual 3.33.0: https://checkerframework.org/, MIT
jopt-simple 5.0.4: https://github.com/jopt-simple/jopt-simple, MIT
oshi-core 6.7.0: https://github.com/oshi/oshi, MIT
+ oshi-core 6.10.0: https://github.com/oshi/oshi, MIT
Review Comment:
oshi-core is listed twice with different versions. Since oshi-core is
declared as 6.10.0 in shenyu-common/pom.xml and 6.7.0 doesn’t appear elsewhere
in the repo, the 6.7.0 entry here is likely stale and should be removed to
avoid confusion during license audits.
##########
shenyu-dist/shenyu-admin-dist/src/main/release-docs/LICENSE:
##########
@@ -741,3 +743,13 @@ The text of each license is also included at
licenses/LICENSE-[project].txt.
jakarta.xml.bind-api 4.0.2:
https://mvnrepository.com/artifact/jakarta.xml.bind/jakarta.xml.bind-api, EDL
1.0
jakarta.mail 1.6.7:
https://mvnrepository.com/artifact/com.sun.mail/jakarta.mail, EDL 1.0
angus-activation 2.0.2:
https://mvnrepository.com/artifact/org.eclipse.angus/angus-activation, EDL 1.0
+
+
+========================================================================
+LGPL licenses
+========================================================================
+
+The following components are provided under a LGPL license. See project link
for details.
+
+ jna 5.18.1: https://mvnrepository.com/artifact/net.java.dev.jna/jna,
LGPL-2.1-or-later
+ jna-platform 5.18.1:
https://mvnrepository.com/artifact/net.java.dev.jna/jna-platform,
LGPL-2.1-or-later
Review Comment:
This new LGPL section lists JNA as LGPL-only, but elsewhere in the project’s
LICENSE files JNA is treated as (at least) Apache 2.0 / dual-licensed. Marking
it as dual-licensed here keeps the document internally consistent and avoids
implying LGPL-only usage.
##########
shenyu-dist/shenyu-bootstrap-dist/src/main/release-docs/LICENSE:
##########
@@ -826,3 +829,13 @@ The following components are provided under the XPP
License. See project link fo
The text of each license is also included at licenses/LICENSE-[project].txt.
mxparser 1.2.2: https://github.com/x-stream/mxparser, XPP
+
+
+========================================================================
+LGPL licenses
+========================================================================
+
+The following components are provided under a LGPL license. See project link
for details.
+
+ jna 5.18.1: https://mvnrepository.com/artifact/net.java.dev.jna/jna,
LGPL-2.1-or-later
+ jna-platform 5.18.1:
https://mvnrepository.com/artifact/net.java.dev.jna/jna-platform,
LGPL-2.1-or-later
Review Comment:
JNA is already described elsewhere in this LICENSE as dual-licensed (Apache
2.0/LGPL). In this new LGPL section it’s listed as LGPL-only, which is
inconsistent within the same document and may be misleading for compliance
reviews.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
