Skip to content

fix(posthog-js): use SPDX expression for license field#3443

Open
jleknes wants to merge 1 commit intoPostHog:mainfrom
jleknes:fix/posthog-js-spdx-license-expression
Open

fix(posthog-js): use SPDX expression for license field#3443
jleknes wants to merge 1 commit intoPostHog:mainfrom
jleknes:fix/posthog-js-spdx-license-expression

Conversation

@jleknes
Copy link
Copy Markdown

@jleknes jleknes commented Apr 22, 2026

Fixes #2627.

Replace "license": "SEE LICENSE IN LICENSE" in packages/browser/package.json with the SPDX expression "(Apache-2.0 AND MIT)". This unblocks automated license-compliance tools (e.g. license-checker-rseidelsohn) that first try to parse the license field as an SPDX expression and only fall back to LICENSE-file scanning when that fails – and the fallback can't reliably resolve a multi-license LICENSE file.

The expression uses AND because the LICENSE file applied to this package combines:

  • Apache-2.0 – PostHog / Mixpanel original code
  • MIT – code derived from Sentry, rrweb (and via vendored modules: Meta Metro, Expo)

AND (rather than OR) is the correct operator: a consumer of the published package must comply with both licenses simultaneously.

The expression validates against spdx-expression-parse (the same parser npm and most license-checker tools use).

Out of scope for this PR (worth a follow-up)

  • @posthog/rollup-plugin and @posthog/webpack-plugin are missing the license field entirely.
  • The other publishable sub-packages currently declare "MIT". Some of them (notably posthog-react-native, @posthog/core, posthog-node) also include MIT-licensed third-party derivatives sitting alongside PostHog's own code, so it's worth confirming whether "MIT" is accurate for each or whether they should also use a (Apache-2.0 AND MIT) expression.

Replace "SEE LICENSE IN LICENSE" with the SPDX expression
"(Apache-2.0 AND MIT)" so automated license-compliance tools can parse
the field. The expression matches the LICENSE file, which combines
Apache-2.0 (PostHog/Mixpanel code) with MIT (derived Sentry/rrweb code).

Fixes PostHog#2627
@vercel
Copy link
Copy Markdown

vercel Bot commented Apr 22, 2026

@jleknes is attempting to deploy a commit to the PostHog Team on Vercel.

A member of the Team first needs to authorize it.

@greptile-apps
Copy link
Copy Markdown
Contributor

greptile-apps Bot commented Apr 22, 2026

Reviews (1): Last reviewed commit: "fix(posthog-js): use SPDX expression for..." | Re-trigger Greptile

@github-actions
Copy link
Copy Markdown
Contributor

This PR hasn't seen activity in a week! Should it be merged, closed, or further worked on? If you want to keep it open, post a comment or remove the stale label – otherwise this will be closed in another week.

@github-actions github-actions Bot added the stale label Apr 30, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Use SPDX identifier in license information

1 participant