-
Ship the MIT LICENSE file these packages have always declared but never included.
Every one of these declares
"license": "MIT"in its manifest, and npm shows that on the registry page — but the tarball carried no licence text at all. MIT's own terms require the notice to accompany "all copies or substantial portions of the Software", so a consumer vendoring one of these packages had nothing to comply with.No code changes. This is the licence text only, published so the tarballs match what the manifests have been claiming.
tests/architecture/release-surface.test.tsnow asserts the LICENSE file exists and is MIT, not just the manifest field — the field-only check is how this went unnoticed, and is also howcreate-sailorshipped the full AGPL-3.0 text under an MIT declaration for its entire published history.
- Publish registry package metadata under the MIT license.