Sendgrid-nodejs: Mimelib dependency is governed by the nebulous European Union Public License laws applicable to Estonia.

[CodeOtter]

Issue Summary

• Sendgrid >4.10.0 uses MailParser 0.6.1 (https://github.com/sendgrid/sendgrid-nodejs/blob/v4.10.0/package.json#L30)
• MailParser 0.6.1 uses MimeLib 0.2.19 (https://github.com/nodemailer/mailparser/blob/v0.6.1/package.json#L20)
• MimeLib 0.2.19 uses European Union Public License 1.1 (https://github.com/andris9/mimelib/blob/master/LICENSE#L3)
• Applicable law is determined by the "law of the European Union country where the Licensor resides or has his registered office." https://github.com/andris9/mimelib/blob/master/LICENSE#L276
• MimeLib's licensor resides in Tallin, Estonia (https://github.com/andris9) (Roping in @andris9 into this conversation)
• EUPL is frustratingly nebulous, and this StackExchange comment gets to the heart of the matter: "If you believe Wikipedia, the dynamic linking situation of the EUPL is completely up in the air, subject to the legal breezes of each individual jurisdiction. So we have even less 'principle' to apply to predicting the legal view of dynamic linkage with an EUPL license than we do with the GPL." https://opensource.stackexchange.com/questions/1524/is-it-possible-to-use-a-library-under-the-eupl-license-for-a-commercial-closed-s/1529#1529

Is there any chance of SendGrid can use https://www.npmjs.com/package/mailparser-mit instead to get around this uncertainty?

Steps to Reproduce

1. Use Sendgrid in a project
2. Show the mimelib LICENSE.md to an intellectual property lawyer
3. Steel yourself for blistering legal concerns

Technical details:

• sendgrid-nodejs Version: master (all)
• All node.js versions

[CodeOtter]

NodeMailer v0.6.1 has a dep of MimeLib ^0.2.19 (https://github.com/nodemailer/mailparser/blob/v0.6.1/package.json#L20)

Therefore, if we preemptively downgrade mimelib to v0.3.0 in our projects package.json via yarn's resolution feature via:

"resolutions": {
  "mimelib": "0.3.0"
}

Then all version of mimelib will refer to the MIT version and we resolve the problem.

Thanks!

[aslafy-z]

I just upgraded mailparser and it does not uses mimelib anymore but the home-made libmime which uses MIT licence.

https://github.com/nodemailer/mailparser/blob/v2.3.4/package.json#L15
https://github.com/nodemailer/libmime/blob/master/LICENSE

Issue: https://github.com/sendgrid/sendgrid-nodejs/issues/762
PR: https://github.com/sendgrid/sendgrid-nodejs/pull/763