[action required] Found licenses incompatible with Icinga Web (modules)

[Al2Klimov]

$ composer install
...
$ composer licenses |grep -vFwe MIT -e BSD-3-Clause
Name: icinga/icinga-php-thirdparty
Version: dev-main
Dependencies:

Name                          Version Licenses
dompdf/dompdf                 v3.1.3  LGPL-2.1
dompdf/php-font-lib           1.0.1   LGPL-2.1-or-later
dompdf/php-svg-lib            1.0.0   LGPL-3.0-or-later
ezyang/htmlpurifier           v4.19.0 LGPL-2.1-or-later
wikimedia/less.php            v3.2.1  Apache-2.0
zircote/swagger-php           5.5.1   Apache-2.0
$

The GPLv2+ of IW2 itself may be debatable, as it permits using it as GPLv3, but new modules like icingadb are under plain GPLv2 which requires all code in the same address space to be GPLv2 compatible.

LGPL-3.0-or-later and Apache-2.0 clearly aren't, but only with GPLv3+. This is a legal problem.

Haven't looked through their versions, though. I hope older versions of those dependencies just fixes the problem, like e.g Icinga/icinga2#9675.

[Al2Klimov]

Alternatively we may raise GPLv2 -> GPLv2+ in all fully CLA-covered modules.

[lippserd]

It makes perfect sense to fix that, but I would simply introduce MIT-licensed shims.