Relicense to GPLv2-or-later for the WordPress.org submission - #17
Merged
Conversation
Relicense Basicrum-owned code from MIT to GPLv2-or-later, the license the plugin directory recommends. MIT was already GPL-compatible and acceptable, so this removes doubt rather than a blocker. The GPLv2 text ships in LICENSE and plugins/basicrum/LICENSE.md, and the plugin header, readme.txt, composer.json, THIRD-PARTY-NOTICES.txt, the root README, and the generated POT all declare it. Bundled Boomerang keeps its BSD license and stays scoped out of the Basicrum license. Link the service privacy information the directory's external-services guidance asks for. The Basicrum Privacy Notice covers only basicrum.com, its contact form, and beta requests, so the readme says exactly that instead of implying it covers the hosted collector, and points webmasters at the collector operator's own terms. Drop composer/installers from the release package. It only positions this package when a Composer project installs it as a dependency and has no role inside an installed plugin, so the build removes it from the staged tree and then restores the repository manifest, leaving the shipped vendor directory, class map, and Composer metadata in agreement. The archive goes from 146 files to 44 and the authoritative class map from 110 entries to 11. verify-release.sh now guards both. Also carries the pending working-tree changes for the same submission: the Tested up to 7.1 bump with its blocking CI rows, the immediate-mode privacy wording, and the submission and privacy-policy checklists. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
composer audit --locked failed on three development dependencies whose advisories were published after the last green run: - squizlabs/php_codesniffer 3.13.5 to 3.13.6 (CVE-2026-67434, OS command injection, high) - wp-coding-standards/wpcs 3.4.0 to 3.4.1 (CVE-2026-45293, arbitrary code execution, high) - phpcsstandards/phpcsutils 1.2.2 to 1.2.3 (CVE-2026-65954, arbitrary code execution) phpcsstandards/phpcsextra moved 1.5.0 to 1.5.1 as a dependency of that set. All four resolve inside the existing composer.json constraints against the declared PHP 7.4 platform, so no constraint changed. Every affected package is require-dev and none is installed by the production build, so the release archive is unchanged. lint, lint:php, analyse, and unit stay green on the newer PHP_CodeSniffer and WPCS. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Relicense Basicrum-owned code from MIT to GPLv2-or-later, the license the plugin directory recommends. MIT was already GPL-compatible and acceptable, so this removes doubt rather than a blocker. The GPLv2 text ships in LICENSE and plugins/basicrum/LICENSE.md, and the plugin header, readme.txt, composer.json, THIRD-PARTY-NOTICES.txt, the root README, and the generated POT all declare it. Bundled Boomerang keeps its BSD license and stays scoped out of the Basicrum license.
Link the service privacy information the directory's external-services guidance asks for. The Basicrum Privacy Notice covers only basicrum.com, its contact form, and beta requests, so the readme says exactly that instead of implying it covers the hosted collector, and points webmasters at the collector operator's own terms.
Drop composer/installers from the release package. It only positions this package when a Composer project installs it as a dependency and has no role inside an installed plugin, so the build removes it from the staged tree and then restores the repository manifest, leaving the shipped vendor directory, class map, and Composer metadata in agreement. The archive goes from 146 files to 44 and the authoritative class map from 110 entries to 11. verify-release.sh now guards both.
Also carries the pending working-tree changes for the same submission: the Tested up to 7.1 bump with its blocking CI rows, the immediate-mode privacy wording, and the submission and privacy-policy checklists.