Aws-cdk: Missing license in child dependency cli-color

[kbradl16]

json-diff dependency uses cli-color (0.1.7) which does not have a license. Remediate missing license or switch dependencies.

[sam-goodwin]

According to its npm and github pages, it uses the ISC License

[kbradl16]

While I do see that the npm and github pages do include a license, we have to look at the version being used. The license was added after the current version being used (version 0.1.7) which was last updated 7 years ago which would put the time around 2012, so I do not think any of the license(s) apply.

The license file was updated on Aug 20, 2018; previously it was MIT from Feb 21, 2017; and copyright? license from Nov 24, 2014 (According to the LICENSE file). Although the package.json license was updated to MIT on Jan 16, 2013 in version v.0.2.2.

[NGL321]

It looks like every version of cli-color since inception was licensed with the ISC license and every version of json-diff uses the MIT license.

Closing out this issue

[kbradl16]

@SomayaB @NGL321 I don't think you've done proper due diligence on this issue. Please look into it more closely. It 100% has not been licensed correctly from inception. The version being used contains no license...

If you look at this link: https://github.com/medikoo/cli-color/blob/ebeb2e81a0c984047a71c392cf81897e34ad5b8a/package.json you will not see any license in the repo at this node version (0.1.7) of "cli-color" package. As stated in my previous comment.

License was added in this commit:
https://github.com/medikoo/cli-color/commit/d28882bed9d9dc4833a719bad404e5f3682385be in version v0.2.2

And json-diff is using the unlicensed version of the cli-color package v0.1.7 https://github.com/andreyvit/json-diff/blob/master/package.json#L21