Conversation
Adds the generated-block markers to LICENSE.note and a `licenseNote.bundled` field to package.json, so that the list of bundled npm components is kept current by the `routine` workflow instead of by hand. Only `@selectize/selectize` and `lit` reach inst/ from node_modules -- `tools/updateSelectize.R` copies selectize's dist, and esbuild inlines lit into inst/www/shared/shiny.js via srcts/src/components/errorConsole.ts. Everything else in LICENSE.note is downloaded from a CDN or GitHub by a tools/update*.R script and stays hand-listed outside the markers. Doing so surfaced that lit was undocumented: it is redistributed in shiny.js but appeared in neither LICENSE.note nor Authors@R, while every other bundled library has both. Adds its BSD-3-Clause text and a `cph` entry for Google LLC.
r-pkgs asks that LICENSE.note describe "the overall license of the
package, and the specific licenses of each individual component". The
file only did the second half; {diffviewer} and {bslib} both open with
the overall statement.
Collaborator
Author
|
Re-checked this against the best practices linked in the original issue and found one more gap in this file, now fixed. r-pkgs asks that
Also worth noting for reviewers, since it is the reason a file like this exists: shiny is MIT and bundles Apache-2.0 ( The |
Matches the upstream change in rstudio/shiny-workflows#69: this file is about licenses, and versions here would rewrite the block on every lockfile bump without the licensing having changed.
Both are already exact-pinned devDependencies matching the versions the tools/update*.R scripts vendor (jquery 3.7.1, bootstrap-datepicker 1.10.0), so they can be listed from node_modules with no new installs. Drops their hand-written entries, along with selectize.js, which the previous commit left listed both by hand and in the generated block. The generated Apache-2.0 for bootstrap-datepicker matches the Apache text already under that heading, and MIT for jquery covers both the 3.7.1 copy and the 1.12.4 one under legacy/.
showdown.js was removed in #4306, which replaced client-side markdown rendering in showcase mode with server-side rendering and deleted inst/www/shared/showdown/. Its LICENSE.note entry and license section were left behind, so the file has been claiming shiny redistributes it since. No reference to showdown remains anywhere else in the tree.
Both update scripts fetched their files from a CDN or GitHub while the
version was pinned separately in package.json (jQuery) or nowhere at all
(strftime). Sourcing from node_modules makes package.json the single record
of what ships, and lets the license-note step report both licenses
automatically instead of them being maintained by hand.
updatejQuery.R already ran `npm install --save-exact jquery@version`; it
now does so before copying rather than after, and copies from
node_modules/jquery/dist. updateStrftime.R gains the equivalent install,
adding strftime as a devDependency.
Verified by running both scripts: every vendored asset comes out
byte-identical to what was already committed. The npm `dist/` files match
the CDN ones exactly, apart from the source map comment jQuery strips from
CDN builds, which this script already appended.
Tier 2 of the migration stops here. The remaining downloads cannot be
moved without changing what ships or without an unverifiable rebuild:
- DataTables: npm splits the bundle across datatables.net and
datatables.net-bs, and the five sort-indicator PNGs are CDN-only, so
the script would stay half-download either way.
- ion.rangeSlider, selectize-plugin-a11y: npm has the sources, but both
are patched after download, so a migration cannot be checked by
comparing against the committed files.
- jQuery UI: the vendored copy is a custom download-builder subset
("some components"); npm ships the full library.
- Bootstrap: vendored at 3.4.1 with no update script at all.
rstudio/shiny-workflows#70 made the step opt-in, defaulting to false, so the markers in LICENSE.note are not enough on their own any more.
schloerke
marked this pull request as draft
August 18, 2026 15:13
Collaborator
Author
|
It's not automated well enough. Pausing for now |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Adopts the
license-notehelper added in rstudio/shiny-workflows#69 (which closes rstudio/shiny-workflows#28), so the bundled-JavaScript list inLICENSE.noteis regenerated by theroutineworkflow instead of maintained by hand.What changed
LICENSE.notegains a marker pair. Theroutineworkflow rewrites only the region between the markers; the hand-written entries above and all the full license texts below are never touched.package.jsongainslicenseNote.bundled, naming what actually gets bundled from npm.DESCRIPTIONandLICENSE.notegain the missinglitattribution — see below.Why only two packages are listed
Only
@selectize/selectizeandlitreachinst/fromnode_modules:tools/updateSelectize.Rcopiesnode_modules/@selectize/selectize/distintoinst/www/shared/selectize.litintoinst/www/shared/shiny.js, viasrcts/src/components/errorConsole.ts. Confirmed by findinglit-html/lit-htmlandlit-html/is-serverin the builtshiny.js.Everything else currently in
LICENSE.note— jQuery, jQuery UI, Bootstrap, bootstrap-datepicker, ion.rangeSlider, DataTables, strftime, showdown.js, highlight.js, the tar implementation from R — is fetched from a CDN or a GitHub archive by atools/update*.Rscript rather than from npm, so none of it is discoverable this way. Those entries stay hand-listed outside the markers, which is exactly why the helper only owns a delimited block.Note that
jqueryandbootstrap-datepickerdo appear indevDependenciesbut are not what ships:updatejQuery.Rdownloads fromcode.jquery.comandupdateBootstrapDatepicker.Rfrom the upstream GitHub archive, andjqueryis mapped towindow.jQuerybyesbuild-plugin-globalsrather than bundled.The
litgap — worth a careful lookAdopting the helper surfaced that
litis redistributed ininst/www/shared/shiny.jsbut was documented nowhere: absent from theLICENSE.notecomponent list, absent from the full license texts (which the file's own preamble promises are "included below"), and absent fromAuthors@R, where every other bundled library has acphentry.This PR adds lit's BSD-3-Clause text and a
person(, "Google LLC", role = c("ctb", "cph"), comment = "lit library")entry, following the pattern the file already uses. This is a licensing judgement and I would like a maintainer to confirm it rather than take it on my say-so — both that the attribution is correct and that nothing else bundled is similarly missing.Authors@Rwas checked to still parse (35 people).Also worth a second opinion: the generator reads
@selectize/selectizeas Apache-2.0 from itspackage.json, which matches the Apache text already under theselectize.jsheading here.Verification
--checkexits 0.npm ci(231 packages) then generate reproduces the committed block exactly.Sequencing
This is inert until
shiny-workflows'v1tag moves. Until thenroutineruns the released@v1, which has nolicense-notestep, so the markers just sit there as ordinary text. Nothing here breaks in the meantime. To exercise it before merge, point.github/workflows/R-CMD-check.yaml'sroutinejob at@maintemporarily (rstudio/shiny-workflows#69 is merged; only the tag move is outstanding).Merge order: rstudio/shiny-workflows#69, move
v1, then this.