Skip to content

Commit b870ff6

Browse files
sdimunziosdimunzio
authored
Merge pull request #134 from devgateway/open-sourcing-changes
Open sourcing changes
2 parents 68a68ed + f34af88 commit b870ff6

9 files changed

Lines changed: 178 additions & 50 deletions

File tree

‎.github/SECURITY.md‎

Lines changed: 2 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -13,21 +13,12 @@ Only the latest release on the `main` branch receives security fixes.
1313

1414
**Please do not report security vulnerabilities through public GitHub issues, pull requests, or discussions.**
1515

16-
To report a vulnerability privately, use one of the following methods:
16+
To report a vulnerability privately, use the following method:
1717

18-
### Option 1 — GitHub Private Vulnerability Reporting (preferred)
18+
### GitHub Private Vulnerability Reporting (preferred)
1919

2020
Use GitHub's built-in [private vulnerability reporting](https://github.com/devgateway/data-viz-wordpress/security/advisories/new) feature. Your report will be visible only to repository maintainers.
2121

22-
### Option 2 — Email
23-
24-
Send a description of the vulnerability to the Development Gateway maintainers. Include:
25-
26-
- A description of the vulnerability and its potential impact
27-
- Steps to reproduce or a proof-of-concept
28-
- Affected versions or components
29-
- Any suggested mitigations
30-
3122
## What to Expect
3223

3324
- **Acknowledgement:** within 5 business days of receipt

‎LICENSE-POLICY.md‎

Lines changed: 80 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,80 @@
1+
# License Selection Policy
2+
3+
This document captures the criteria used to select licenses for dual-licensed third-party
4+
dependencies in GPL-2.0-or-later projects. Apply these rules when updating NOTICE.md or
5+
evaluating new dependencies.
6+
7+
> **Note:** This project is a WordPress plugin and is therefore licensed under
8+
> GPL-2.0-or-later. The compatibility rules here are the **inverse** of an Apache-2.0
9+
> project — see the Apache-2.0 policy in `data-viz-api` for the other context.
10+
11+
---
12+
13+
## Quick Reference
14+
15+
| License options | Choose | Reason |
16+
|---|---|---|
17+
| GPL-2.0 / BSD-3-Clause | **GPL-2.0** | Consistent with GPL ecosystem |
18+
| GPL-2.0 / MIT | **GPL-2.0** | Consistent with GPL ecosystem |
19+
| Apache-2.0 / GPL-2.0 | **GPL-2.0** | Consistent with GPL ecosystem |
20+
| LGPL / anything | **LGPL** | Weak copyleft; keeps more freedoms |
21+
| MIT or BSD only | No choice needed | Always compatible with GPL |
22+
23+
---
24+
25+
## Compatible Licenses (no documentation required)
26+
27+
These licenses are unconditionally compatible with GPL-2.0-or-later and require no
28+
justification in NOTICE.md:
29+
30+
- MIT
31+
- ISC
32+
- BSD-2-Clause, BSD-3-Clause, BSD (informal)
33+
- Apache-2.0 (compatible with GPL-2.0-or-later via the "or later" clause)
34+
- GPL-2.0, GPL-2.0-or-later, GPL-3.0, GPL-3.0-or-later
35+
- LGPL-2.1, LGPL-2.1-or-later, LGPL-3.0, LGPL-3.0-only
36+
- MPL-2.0 (FSF confirmed compatible with GPL)
37+
- CC0-1.0, Public Domain
38+
- 0BSD, Unlicense
39+
40+
---
41+
42+
## Licenses That Require Documentation
43+
44+
Document in NOTICE.md if present, even if compatible:
45+
46+
| License | Reason to document |
47+
|---|---|
48+
| GPL-2.0 (without "or later") | Compatible but worth noting the version constraint |
49+
| Apache-2.0 WITH LLVM-exception | Unusual form; clarify the exception doesn't affect compatibility |
50+
| MPL-2.0 | Less common; confirm compatibility explicitly |
51+
| "SEE LICENSE IN LICENSE" | Ambiguous; verify and document actual license |
52+
| BSD (informal, no version) | Clarify it's BSD-2 or BSD-3 |
53+
54+
---
55+
56+
## Incompatible Licenses (must not be bundled into plugin output)
57+
58+
These licenses are **not compatible** with GPL-2.0-or-later and must not appear in
59+
runtime/bundled dependencies:
60+
61+
| License | Why incompatible |
62+
|---|---|
63+
| EPL-1.0, EPL-2.0 | Copyleft terms conflict with GPL |
64+
| CDDL-1.0, CDDL-1.1 | Copyleft terms conflict with GPL |
65+
| JSON License | "Good, not Evil" clause incompatible with any copyleft |
66+
| Proprietary / Commercial | Cannot be redistributed under GPL |
67+
68+
> **Dev-only exception:** Incompatible licenses in build tools or test runners that are
69+
> never bundled into the plugin output do not create a distribution conflict, but should
70+
> still be documented in NOTICE.md.
71+
72+
---
73+
74+
## WordPress-specific rules
75+
76+
- All WordPress plugins **must** declare `"license": "GPL-2.0-or-later"` in `package.json`
77+
and include a GPL-2.0-or-later `LICENSE` file.
78+
- Standalone CLI tools in this monorepo (e.g. `create-wp-customizer`,
79+
`upgrade-wp-customizer`) are not WordPress plugins and may use MIT.
80+
- Template scaffolding packages may use ISC or MIT.

‎NOTICE.md‎

Lines changed: 67 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,67 @@
1+
# Third-Party License Notices
2+
3+
This project (Data Viz WordPress) is licensed under the GNU General Public License,
4+
version 2 or later (GPL-2.0-or-later), as required by WordPress.
5+
6+
The following third-party libraries are included or linked as dependencies. Libraries
7+
licensed under MIT, ISC, BSD-2-Clause, BSD-3-Clause, or GPL-2.0-or-later are omitted
8+
as they are straightforwardly compatible with this project's GPL-2.0-or-later license.
9+
Where a library is available under multiple licenses, the license chosen for use in this
10+
project is noted explicitly.
11+
12+
License selection criteria for this project are documented in
13+
[LICENSE-POLICY.md](./LICENSE-POLICY.md).
14+
15+
---
16+
17+
## BSD-3-Clause OR GPL-2.0
18+
19+
### node-forge
20+
21+
- **License chosen:** GPL-2.0 (dual-licensed BSD-3-Clause / GPL-2.0)
22+
- **Used in:** wp-react-blocks-plugin (transitive via @wordpress/scripts)
23+
- **Notes:** GPL-2.0 is chosen for consistency with this project's GPL-2.0-or-later
24+
license and the broader GPL ecosystem of WordPress dependencies.
25+
26+
---
27+
28+
## Apache-2.0
29+
30+
### mousetrap
31+
32+
- **License:** Apache-2.0 WITH LLVM-exception
33+
- **Used in:** wp-react-blocks-plugin (transitive via @wordpress/components)
34+
- **Notes:** Apache-2.0 is compatible with GPL-2.0-or-later. The LLVM exception is a
35+
patent retaliation carve-out and does not affect license compatibility.
36+
37+
---
38+
39+
## Mozilla Public License 2.0 (MPL-2.0)
40+
41+
### axe-core
42+
43+
- **License:** MPL-2.0
44+
- **Used in:** transitive via @wordpress/scripts (test/development tooling only; not
45+
bundled into plugin output)
46+
- **Notes:** MPL-2.0 is compatible with GPL-2.0-or-later per the FSF license list.
47+
48+
---
49+
50+
## LGPL-3.0-only
51+
52+
### rollup-plugin-dts
53+
54+
- **License:** LGPL-3.0-only
55+
- **Used in:** build tooling only (transitive via unbuild); not bundled into plugin output
56+
- **Notes:** LGPL-3.0 is compatible with GPL-2.0-or-later. This is a development-time
57+
dependency only.
58+
59+
---
60+
61+
## Packages with missing or ambiguous license declarations
62+
63+
### spawndamnit
64+
65+
- **Declared license:** "SEE LICENSE IN LICENSE"
66+
- **Actual license:** MIT (verified from LICENSE file)
67+
- **Used in:** build tooling (transitive via @changesets/cli)

‎packages/create-wp-customizer/README.md‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -36,7 +36,7 @@ The CLI will ask:
3636
1. **Project name** — used as the plugin directory name and WordPress plugin slug
3737
2. **Template** — choose between JavaScript (`template-js`) or TypeScript (`template-ts`)
3838

39-
After confirming, the tool generates the project structure and installs dependencies.
39+
After confirming, the tool generates the project structure. Install dependencies afterward using the commands in [After Scaffolding](#after-scaffolding).
4040

4141
## Generated Structure
4242

‎plugins/wp-react-blocks-plugin/blocks/package.json‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -7,6 +7,7 @@
77
"Timothy Mugo"
88
],
99
"private": true,
10+
"license": "GPL-2.0-or-later",
1011
"description": "",
1112
"keywords": [
1213
"WordPress",
@@ -57,7 +58,6 @@
5758
"@wordpress/rich-text": "^7.32.0",
5859
"ajv": "^8.17.1",
5960
"classnames": "^2.5.1",
60-
"gzip-js": "^0.3.2",
6161
"lodash": "^4.17.21",
6262
"lodash.isempty": "^4.4.0",
6363
"lodash.isequal": "^4.5.0",

‎plugins/wp-react-custom-api/wp-react-custom-api.php‎

Lines changed: 5 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -3,8 +3,11 @@
33
Plugin Name: Custom WP-REST-API Endpoints
44
Version: 0.0.1
55
Description: Adding custom endpoints on WP REST API
6-
Author: Timothy Mugo (Development Gateway)
7-
Author URI:
6+
Author: Development Gateway
7+
Author URI: https://www.developmentgateway.org/
8+
License: GPL-2.0-or-later
9+
License URI: https://www.gnu.org/licenses/gpl-2.0.html
10+
Copyright: © 2025 Development Gateway
811
*/
912

1013
function custom_api_test_callback() {

‎plugins/wp-react-custom-multilang/wp-multilang.php‎

Lines changed: 13 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -1,21 +1,28 @@
11
<?php
22
/**
3-
* Plugin Name: WP Multilang
3+
* Plugin Name: WP Multilang (Customized)
44
* Plugin URI: https://github.com/ahmedkaludi/wp-multilang
55
* GitHub Plugin URI: https://github.com/ahmedkaludi/wp-multilang
66
* Description: Multilingual plugin for WordPress. Go Multilingual in minutes with full WordPress support. Translate your site easily with this localization plugin. (DO NOT UPDATE THIS PLUGIN)
7-
* Author: TCDI Team
8-
* Author URI: https://wp-multilang.com/
9-
* License: GPL2
7+
* Author: Development Gateway
8+
* Author URI: https://www.developmentgateway.org/
9+
* License: GPL-2.0-or-later
1010
* License URI: https://www.gnu.org/licenses/gpl-2.0.html
1111
* Text Domain: wp-multilang
1212
* Domain Path: /languages
1313
* Version: 2.4.16
14-
* Copyright: © 2017-2019 Valentyn Riaboshtan
14+
*
15+
* Based on WP Multilang by Valentyn Riaboshtan
16+
* Original Copyright: © 2017-2019 Valentyn Riaboshtan
17+
* Original Plugin URI: https://github.com/ahmedkaludi/wp-multilang
18+
*
19+
* Modifications Copyright: © 2025 Development Gateway
20+
* Modified by: Development Gateway — added language-switcher Gutenberg block
21+
* and additional admin scripts.
1522
*
1623
* @package WPM
1724
* @category Core
18-
* @author Valentyn Riaboshtan
25+
* @author Valentyn Riaboshtan (original), Development Gateway (modifications)
1926
*/
2027

2128
use WPM\Includes\WP_Multilang;

‎plugins/wp-react-custom-rest-menu/wp-react-custom-rest-menu.php‎

Lines changed: 9 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -3,8 +3,15 @@
33
Plugin Name: Custom WP-REST-API V2 Menus
44
Version: 0.7.7
55
Description: Adding menus endpoints on WP REST API v2
6-
Author: Originally created by Claudio La Barbera - Modified by Sebastian Dinunzio (Development Gateway)
7-
Author URI:
6+
Author: Development Gateway
7+
Author URI: https://www.developmentgateway.org/
8+
License: GPL-2.0-or-later
9+
License URI: https://www.gnu.org/licenses/gpl-2.0.html
10+
11+
Based on WP REST API Menus by Claudio La Barbera and contributors.
12+
Original plugin: https://wordpress.org/plugins/wp-api-menus/
13+
Original Copyright: © Claudio La Barbera and contributors (GPLv2 or later)
14+
Modifications Copyright: © 2025 Development Gateway
815
*/
916

1017
/**

‎pnpm-lock.yaml‎

Lines changed: 0 additions & 27 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

0 commit comments

Comments
 (0)