Skip to content

Refined package.json for npm publishing#62

Merged
allenbakki merged 1 commit intomainfrom
issue-58
Mar 30, 2026
Merged

Refined package.json for npm publishing#62
allenbakki merged 1 commit intomainfrom
issue-58

Conversation

@Mehulantony
Copy link
Copy Markdown
Collaborator

Worked on #58 to refine package.json for npm publishing. Set the version to 1.0.0 and license to MIT, included a bin field and updated description and keywords. npm pack output produces a tarball, and the content produced includes expected sources and metadata files.

Copy link
Copy Markdown
Collaborator

@thehabes thehabes left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

There is some good clean up in here. Be careful with your license and the versioning signal you are sending out. Consider the comments from the static reviewer and decide if there should be changes in this scope.

Static Review Comments

Branch: issue-58
Review Date: 2026-03-30
Reviewer: Pair Static Review - Claude & @thehabes

Claude and Bryan make mistakes. Verify all issues and suggestions. Avoid unnecessary scope creep.

Category Issues Found
🔴 Critical 1
🟠 Major 0
🟡 Minor 1
🔵 Suggestions 0

Critical Issues 🔴

Issue 1: LICENSE file contradicts "license": "MIT" declaration

File: package.json:24 / LICENSE
Category: Legal / Breaking Change

Problem:
The license field is changed from "UNLICENSED" to "MIT", but the repository's LICENSE file currently contains:

There is no license.

This is a legal contradiction. npm packaging and consumers will see MIT in the metadata, but the actual license text does not grant MIT rights. Under copyright law, no license text = all rights reserved, regardless of what package.json says. This exposes the project to:

  • Users assuming MIT terms that aren't legally granted
  • npm audit / compliance tooling flagging the mismatch
  • Potential legal disputes if anyone redistributes the package

Suggested Fix:
Replace the contents of the LICENSE file with the full MIT License text, including the correct copyright holder and year. For example:

MIT License

Copyright (c) 2026 Research Computing Group, Saint Louis University

Permission is hereby granted, free of charge, to any person obtaining a copy
of this software and associated documentation files (the "Software"), to deal
in the Software without restriction, including without limitation the rights
to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
copies of the Software, and to permit persons to whom the Software is
furnished to do so, subject to the following conditions:

The above copyright notice and this permission notice shall be included in all
copies or substantial portions of the Software.

THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
SOFTWARE.

Confirm the correct copyright holder and year with the project maintainers before committing. This may require approval from SLU's legal or technology transfer office.

How to Verify:

  1. Open the LICENSE file and confirm it contains the full MIT license text
  2. Run npm pack --dry-run and confirm LICENSE is included in the tarball
  3. Run npx license-checker --json --start . (or similar) and confirm no mismatch is reported

Major Issues 🟠

None.


Minor Issues 🟡

Issue 1: Version jump from 0.0.0 to 1.0.0 signals stable release

File: package.json:4
Category: Non-functional / Semantic Versioning

Problem:
Per semver, 1.0.0 signals a stable public API. The previous 0.0.0 indicated no release had been cut. This is a significant declaration that tells npm consumers the public API is defined and backward-compatible changes will follow semver rules going forward.

This isn't wrong — it may be exactly the intent — but confirm with the team that this commitment is intentional. If the API is not ready for a stable 1.0.0 then consider starting at 0.1.0 instead.


Suggestions 🔵

None.


If there are significant code changes in response to this review please test those changes. Run the application manually and test or perform internal application tests when applicable.

@allenbakki allenbakki merged commit e43cd97 into main Mar 30, 2026
2 checks passed
@allenbakki allenbakki deleted the issue-58 branch March 30, 2026 21:32
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants