Refined package.json for npm publishing#62
Conversation
thehabes
left a comment
There was a problem hiding this comment.
There is some good clean up in here. Be careful with your license and the versioning signal you are sending out. Consider the comments from the static reviewer and decide if there should be changes in this scope.
Static Review Comments
Branch: issue-58
Review Date: 2026-03-30
Reviewer: Pair Static Review - Claude & @thehabes
Claude and Bryan make mistakes. Verify all issues and suggestions. Avoid unnecessary scope creep.
| Category | Issues Found |
|---|---|
| 🔴 Critical | 1 |
| 🟠 Major | 0 |
| 🟡 Minor | 1 |
| 🔵 Suggestions | 0 |
Critical Issues 🔴
Issue 1: LICENSE file contradicts "license": "MIT" declaration
File: package.json:24 / LICENSE
Category: Legal / Breaking Change
Problem:
The license field is changed from "UNLICENSED" to "MIT", but the repository's LICENSE file currently contains:
There is no license.
This is a legal contradiction. npm packaging and consumers will see MIT in the metadata, but the actual license text does not grant MIT rights. Under copyright law, no license text = all rights reserved, regardless of what package.json says. This exposes the project to:
- Users assuming MIT terms that aren't legally granted
- npm audit / compliance tooling flagging the mismatch
- Potential legal disputes if anyone redistributes the package
Suggested Fix:
Replace the contents of the LICENSE file with the full MIT License text, including the correct copyright holder and year. For example:
MIT License
Copyright (c) 2026 Research Computing Group, Saint Louis University
Permission is hereby granted, free of charge, to any person obtaining a copy
of this software and associated documentation files (the "Software"), to deal
in the Software without restriction, including without limitation the rights
to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
copies of the Software, and to permit persons to whom the Software is
furnished to do so, subject to the following conditions:
The above copyright notice and this permission notice shall be included in all
copies or substantial portions of the Software.
THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
SOFTWARE.
Confirm the correct copyright holder and year with the project maintainers before committing. This may require approval from SLU's legal or technology transfer office.
How to Verify:
- Open the
LICENSEfile and confirm it contains the full MIT license text - Run
npm pack --dry-runand confirmLICENSEis included in the tarball - Run
npx license-checker --json --start .(or similar) and confirm no mismatch is reported
Major Issues 🟠
None.
Minor Issues 🟡
Issue 1: Version jump from 0.0.0 to 1.0.0 signals stable release
File: package.json:4
Category: Non-functional / Semantic Versioning
Problem:
Per semver, 1.0.0 signals a stable public API. The previous 0.0.0 indicated no release had been cut. This is a significant declaration that tells npm consumers the public API is defined and backward-compatible changes will follow semver rules going forward.
This isn't wrong — it may be exactly the intent — but confirm with the team that this commitment is intentional. If the API is not ready for a stable 1.0.0 then consider starting at 0.1.0 instead.
Suggestions 🔵
None.
If there are significant code changes in response to this review please test those changes. Run the application manually and test or perform internal application tests when applicable.
Worked on #58 to refine package.json for npm publishing. Set the version to 1.0.0 and license to MIT, included a bin field and updated description and keywords.
npm packoutput produces a tarball, and the content produced includes expected sources and metadata files.