Skip to content

Fix broken Posit logo link and add third-party JS license file - #410

Open
cpsievert wants to merge 4 commits into
mainfrom
fix/thirdparty-license-and-posit-logo
Open

cpsievert wants to merge 4 commits into
mainfrom
fix/thirdparty-license-and-posit-logo

Conversation

@cpsievert

@cpsievert cpsievert commented Sep 21, 2026 •

Copy link
Copy Markdown
Collaborator

Summary

  • The Posit logo in the docs footer/404 pages and Python API docs pointed to a dead posit.co/wp-content/... URL, so the logo was showing as broken. It now uses the same working tidyverse.org logo URL already relied on by the R pkgdown config.

  • shinychat.js bundles MIT-licensed third-party code (React, use-stick-to-bottom, tabbable, and dozens of others in the remark/rehype/unified/prosemirror/tiptap tree), but only shipped esbuild's attribution comment pointing at a LICENSE file we don't distribute — leaving the bundle without the license text it's required to carry.

    The JS build now walks esbuild's own metafile (already generated for every build) to find every package that actually contributed code to shinychat.js, and concatenates each package's own license file (already present in every bundled package's node_modules/ directory) into dist/THIRDPARTY.txt. This is synced into both the Python and R package asset directories via the existing make update-dist flow. No new npm dependency was needed for this — it reuses build metadata build.ts already produces.

Fixes #234, fixes #299.

Test plan

  • npm run build (lint + bundle) succeeds and produces js/dist/THIRDPARTY.txt covering all 125 packages actually bundled into shinychat.js
  • npm test — 1360 tests pass
  • make update-dist syncs THIRDPARTY.txt into pkg-py/src/shinychat/www/ and pkg-r/inst/lib/shiny/
  • uv build (Python sdist + wheel) — verified THIRDPARTY.txt present in both via tar tzf/unzip -l
  • pkgbuild::build() (R package tarball) — verified THIRDPARTY.txt present via tar tzf
  • Verified https://www.tidyverse.org/posit-logo.svg resolves (200, image/svg+xml)

…bundle

- Replace dead posit.co/wp-content link for the Posit logo in the docs
  footer/404 pages and Python API docs with the working tidyverse.org
  URL already used by the R pkgdown config (fixes #234).
- Emit dist/THIRDPARTY.txt during the JS build via generate-license-file,
  covering the full production dependency graph bundled into shinychat.js
  (react, react-dom, scheduler, use-sync-external-store, use-stick-to-bottom,
  tabbable, etc.), so MIT license texts ship alongside the vendored code
  (fixes #299).
Sync generated third-party license file into js/dist and both
package asset directories (make update-dist).
…te-license-file

Avoids pulling in generate-license-file's ~160-package dependency tree
(@npmcli/arborist, etc.) just to concatenate license files. esbuild
already tracks every file that ends up in shinychat.js via its metafile;
resolve each input path back to its node_modules package root, dedupe,
and read the license file each package already ships. This is also more
precise than scanning package.json's declared dependencies, which pulled
in type-only @types/* packages that never ship any runtime code.

This branch has not been deployed

No deployments
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Ship third-party license texts for the bundled JS assets Minor: Broken hyperlink for Posit image at the bottom of the docs site

1 participant