Details
-
Type:
Bug
-
Status:
Open
-
Priority:
Minor
-
Resolution: Unresolved
-
Affects Version/s: None
-
Fix Version/s: None
-
Component/s: IO
-
Labels:None
Description
Xstream's tests use Douglas Crockford's org.json:json library for JSON parsing. The library has a modified MIT license with additional "evil" clause that makes it non-free sofware from legal point of view. There are many different JSON parsers for Java that offer the same or better functionality. Please consider swithing to different implementation without licensing issues. I'm attaching a patch that should port affected tests to Google Gson library.
Activity
It's not critical, I just wanted to make you aware of the fact that it's non-free. XStream's users might be affected because even though it's a test-only dependency, it's not marked as such and therefore ends up being pulled in at runtime. So if you're fine with the license, ignore the patch and please just add <scope>test</scope> to the dependency.
Michael Simacek
added a comment - It's not critical, I just wanted to make you aware of the fact that it's non-free. XStream's users might be affected because even though it's a test-only dependency, it's not marked as such and therefore ends up being pulled in at runtime. So if you're fine with the license, ignore the patch and please just add <scope>test</scope> to the dependency. Hi Michael,
it's declared optional, therefore it is not pulled in automatically by clients of XStream. However, you're right, declaring it with the proper scope should have been done from the beginning, since it is only used in the tests. I'll consider a switch for the 1.5.x line nevertheless.
Thanks for heads-up,
Jörg
Jörg Schaible
added a comment - Hi Michael,
it's declared optional, therefore it is not pulled in automatically by clients of XStream. However, you're right, declaring it with the proper scope should have been done from the beginning, since it is only used in the tests. I'll consider a switch for the 1.5.x line nevertheless.
Thanks for heads-up,
Jörg 
Why is the license critical for a test dependency? No XStream user is affected. Note: XStream 1.4.x still supports Java 1.4 and gson does not.