docs: declare the bundled Geist webfonts in LICENSE - #3140
Conversation
Part of apache#2974. The renderer bundle emits Geist Variable and Geist Mono Variable `.woff2` files, so binary artifacts redistribute OFL-1.1 material that LICENSE did not declare. Worth noting for the checklist: a dependency scan does not find this. Both `@fontsource-variable/*` packages are declared as devDependencies and neither appears in `app.asar` — only the font files vite emits into `dist-renderer` ship. Verified by listing `dist-renderer/assets/*.woff2` (11 files across both families) against the packaged bundle. The same check clears the other two entries the audit listed for this item. `lightningcss` and `caniuse-lite` are build-time only and reach no artifact, so neither needs a LICENSE declaration for binary releases; `caniuse-lite` is also CC-BY-4.0 rather than MPL-2.0. Claude-Session: https://claude.ai/code/session_014ajaRxC4jydavY9nYUFj5J
|
Warning Review limit reached
Next review available in: 22 minutes Limit details: You’ve used all 3 included reviews currently available under your plan. Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available. How can I continue?After more reviews become available, a review can be triggered using the To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews. How do review limits work?CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability. For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window. Please refer docs for additional details. Review details⚙️ Run configurationConfiguration used: Path: .coderabbit.yaml Review profile: CHILL Plan: Pro Plus Run ID: 📒 Files selected for processing (1)
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Path: .coderabbit.yaml Review profile: CHILL Plan: Pro Plus Run ID: 📒 Files selected for processing (1)
🚧 Files skipped from review as they are similar to previous changes (1)
Included review availability: Your plan includes up to 3 reviews per rolling hour; 0 remain after this review. 📝 WalkthroughSummaryThis PR adds SIL Open Font License 1.1 attribution for bundled Geist and Geist Mono The change extends the existing This is the smallest coherent solution. It changes only Validation and risksLint and formatting checks pass. The license text includes the complete OFL-1.1 header and upstream FAQ URL. No source code paths changed. The font packages remain development dependencies. Only generated font files in Review-relevant risksThe current diff changes licensing and release attribution for bundled font files. Material licensing or release changes require independent human review under repository policy. No user-visible behavior, public contract, security, or governance effect was identified in the current diff. Required-check status remains unverified unless supported by direct evidence. The person performing the merge must review the final diff. A maintainer makes the final determination. WalkthroughThe ChangesFont licensing
Estimated code review effort: 1 (Trivial) | ~2 minutes Merge Risk: ⚪ Minimal · up to This localized documentation change declares bundled Geist webfont materials in LICENSE without changing runtime behavior; no actionable merge-blocking risk remains. 🚥 Pre-merge checks | ✅ 3 | ❌ 2❌ Failed checks (2 warnings)
✅ Passed checks (3 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Comment |
There was a problem hiding this comment.
Pull request overview
Updates the repository’s root LICENSE file to declare redistribution of bundled Geist/Geist Mono webfont binaries (OFL-1.1) as part of Apache Incubator onboarding/license compliance work (Issue #2974, Phase 3).
Changes:
- Adds a new third-party license entry for bundled Geist Variable and Geist Mono Variable
.woff2assets. - Includes the SIL Open Font License (OFL) 1.1 text in
LICENSEfor redistributed font material.
Suppressed comments (1)
LICENSE:251
- The copied OFL-1.1 text starts at “PREAMBLE” and omits the standard license header block (license name/date and reference URL). For license compliance/readability, include the full upstream header immediately before the preamble.
PREAMBLE
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
The copied license started at PREAMBLE and dropped the standard header — license name, version, date, and the upstream FAQ URL. For a declaration whose whole purpose is reproducing the license the fonts ship under, a truncated copy undercuts the point. The embedded text is now byte-identical to the upstream `@fontsource-variable/geist` LICENSE from the header onward, and the introducing sentence no longer restates what that header already says. Claude-Session: https://claude.ai/code/session_014ajaRxC4jydavY9nYUFj5J
The entry named a source and a copyright but no version, so the attribution could not be checked against what actually shipped. The `trycua/cua` entry above pins a revision for the same reason. Records the emitting package versions from package-lock.json rather than a font-repo revision: the `.woff2` files are built by those packages, so they are what a reader would have to fetch to reproduce the bundled bytes. Claude-Session: https://claude.ai/code/session_014ajaRxC4jydavY9nYUFj5J
There was a problem hiding this comment.
Pull request overview
Copilot reviewed 1 out of 1 changed files in this pull request and generated no new comments.
Suppressed comments (1)
LICENSE:239
- The section header says "Geist and Geist Mono" but the text below and the emitting packages are specifically the variable font families. Aligning the header to the redistributed artifacts avoids ambiguity if non-variable Geist fonts are added later.
Geist and Geist Mono (bundled webfonts)
likun666661
left a comment
likun666661
left a comment
There was a problem hiding this comment.
Verified the pinned 5.3.0 package versions against package-lock.json and the published npm tarballs. The OFL text matches the upstream package licenses, the bundled .woff2 files are correctly identified, and the packaging config also carries both upstream license files. CI is green. LGTM.
…ion (#3155) #3140 added the Geist OFL declaration to LICENSE, and the notices generator folds LICENSE into its output, so the committed file has been stale since that merged. `npm run check:third-party-notices` has failed on `main` ever since. Nothing caught it because the Windows `package` job is the only caller of this check, it runs on pull requests alone, and its trigger paths do not include LICENSE — so the PR that caused the drift never ran the job that would have said so. The next PR to touch one of those paths inherited the failure. Regenerated output only: 107 lines added, none removed, all of them the OFL text #3140 introduced. Verified under `npm ci` so the dependency closure matches what CI resolves. generated by: Claude Code
Part of #2974 (Phase 3, Declare Category B dependencies in LICENSE).
What ships that LICENSE did not declare
The desktop renderer bundle emits Geist Variable and Geist Mono Variable
.woff2files, so binary artifacts redistribute OFL-1.1 material with no corresponding declaration. This adds one, in the same shape as the existingtrycua/cuaentry.Why a dependency scan does not find it
Both
@fontsource-variable/*packages are declared as devDependencies, and neither appears inapp.asar. Only the font files vite emits intodist-renderership. Verified by listingdist-renderer/assets/*.woff2— 11 files across the two families — against the packaged bundle.Flagging it because the same reasoning narrows the rest of that checklist item:
@fontsource-variable/geist*— OFL-1.1.woff2indist-rendererlightningcss— MPL-2.0caniuse-liteSo the item reduces to the fonts. Happy to be corrected if the intent was to declare build-time dependencies too — my reading of the release policy is that LICENSE covers what a release artifact actually redistributes.
Checks
Lint and format pass. Source-only change, no code paths touched.