Middy: functionShield middleware uses closed-source dependency with custom license/EULA

[bmv437]

Hi there 👋

I've really been enjoying using middy, but recently ran into a legal issue with one of it's dependencies.

After running a security and license scan on our project dependencies, we realized that the functionShield middleware that comes bundled with middy also includes the @puresec/function-shield package. @puresec/function-shield is closed-source, and if you look at the license, it points to a custom license/EULA.

This means that just by installing middy (and installing it's dependency @puresec/function-shield), you're legally agreeing to the terms in the PureSec license/EULA. Even if you don't use the functionShield middleware (as we don't), you're still downloading it and agreeing to the license.

Would it be possible to move @puresec/function-shield from the dependencies section of middy's package.json, and move it into peerDependencies? That way npm won't install it automatically when installing middy. We can also add a note in the documentation that in order to use the functionShield middleware, you'll also need to install @puresec/function-shield and suggest to review the license before installing.

I'd be happy to submit a PR with the changes I suggested, please let me know what you think.
Thanks!

[lmammino]

I would be honestly very favourable in moving function shield outside of middy core.

I believe, this middleware, as useful as it can be, doesn't belong to the core functionality of middy.
License issues, like the one you pointed out, make me even more biased towards removing this from the core.

But, before applying any change, I'd like to get at least some shared approval by other main contributors: @theburningmonk, @vladgolubev, @dkatavic, @ossareh.

Also, if we decide to do the change, we should find a decent way to document this breaking change.

[theburningmonk]

@lmammino I concur, it's useful and I'm big fan of it, but shouldn't be part of the core, which should be super focused on the most common use cases only.

[lmammino]

Gonna try to create a PR for this ASAP. Thanks @theburningmonk

[bmv437]

Thanks everyone for the prompt response and resolution!
Looking forward to the changes being released 👍

[lmammino]

Hey @bmv437, just released in 0.22.0. Looking forward to your feedback!

[ossareh]

I'm late to the party here, this change seems correct to me; thanks for handling it so swiftly @lmammino 👍

[lmammino]

Thanks @ossareh :)

[oorryy]

Hi everyone,

Thank you for the feedback and raising the concerns regarding the license. We are about to switch FunctionShield to a standard creative-commons license: https://creativecommons.org/licenses/by-nd/4.0/ - which I hope won't pose any issues. Would appreciate your feedback on this license.