Verify dependancy licensing

[wojciechczerniak]

Description

We're releasing a new library. Before we do that we should verify all the dependencies for this project. We can use FOSSA or any other software to check the dependency tree carefully.

• SAP/chevrotain (Apache 2.0, 1 dep)
  • bd82/regexp-to-ast (MIT, no deps)
• csv-parser and csv-stringify should be moved outside of this repo Cleanup R&D tools before we release the lib #23. If not, verify them too removed in Cleanup R&D tools before we release the lib #23
• moment, MIT
• gpu.js MIT. Not mentioned in the readme! Added in 05de3ce
  • acron (MIT, no deps)
  • gl (BSD-2-Clause, 6 deps)
    • bindings (MIT, 1 dep)
      • file-uri-to-path (MIT, no deps)
    • bit-twiddle (MIT, no deps)
    • glsl-tokenizer (MIT, 1 dep)
      • through2 (MIT, 1 dep)
        • readable-stream (MIT, no deps)
    • nan (MIT, no deps)
    • node-gyp (MIT, 11 deps)
    • prebuild-install (MIT, 15 deps)
  • gl-wiretap, (MIT, no deps)
  • gpu-mock.js (MIT, no deps)

[swistak35]

It's fine to use whatever tool you prefer, but also check make verify-production-licenses, we run license checker on CI

[wojciechczerniak]

Thanks, was very helpful.