Some (sub) package.json do not list the licences which lead to tools like syft report unknown licence

[cjolif]

Operating System

Any

Environment (if applicable)

Any

Firebase SDK Version

12.4

Firebase SDK Product(s)

AI

Project Tooling

Not relevant

Detailed Problem Description

Some (sub) package.json do not list the licences which lead to tools like syft report unknown licence

Includes:

https://github.com/firebase/firebase-js-sdk/blob/main/packages/messaging/sw/package.json
https://github.com/firebase/firebase-js-sdk/blob/main/packages/auth/cordova/package.json
https://github.com/firebase/firebase-js-sdk/blob/main/packages/auth/web-extension/package.json
https://github.com/firebase/firebase-js-sdk/blob/main/packages/auth/internal/package.json
https://github.com/firebase/firebase-js-sdk/blob/main/packages/database-compat/standalone/package.json
https://github.com/firebase/firebase-js-sdk/blob/main/packages/firestore/lite/package.json
https://github.com/firebase/firebase-js-sdk/blob/main/packages/webchannel-wrapper/bloom-blob/package.json
https://github.com/firebase/firebase-js-sdk/blob/main/packages/webchannel-wrapper/webchannel-blob/package.json

Steps and code to reproduce issue

Non relevant.

[google-oss-bot]

I couldn't figure out how to label this issue, so I've labeled it for a human to triage. Hang tight.

[jbalidiong]

Hi @cjolif, thanks for reporting this. Let me check what we can do for this issue or bring someone here that can provide more context about it. I’ll update this thread if I have any information to share.

[hsubox76]

Those packages aren't published NPM packages, just placeholders representing different entry points for legacy bundlers, so we didn't add license fields to them. We figured the license of the actual NPM package that encompasses those sub packages should count.

It shouldn't be too hard to add the license field to these packages though, just to make tools like Syft work, so we can add that task to our backlog.

Can I ask if this problem is blocking your development or build, or just leading to annoying errors in the Syft report?

[cjolif]

Thanks a lot of the update.

Can I ask if this problem is blocking your development or build, or just leading to annoying errors in the Syft report?

Just annoying errors I have to manually override, but not strictly speaking blocking (I guess the tool recursively goes through the packages, that's why it encounters them even if subpackages).