@keystatic/core depends on y-provider, which declares no licence

[PeretzNiro]

What

@keystatic/core@0.5.51 → @toeverything/y-indexeddb@0.10.0-canary.9 → y-provider@0.10.0-canary.9.

y-provider (a Yjs provider utility from the AFFiNE project, published in 2023 as canary builds) has no license field in its package.json, no LICENSE file in the tarball, and no repository field, so licence scanners report it as "no licence declared". The latest published version, 0.10.3-canary.2 (2023-11-23), is the same. The AFFiNE monorepo it comes from is MIT-licensed, but nothing in the npm artefact says so.

Why it matters

Anyone running a licence audit on a Keystatic-based site (we generate sites with Keystatic as an optional CMS and keep a dependency licence register) ends up with one transitive package they cannot classify, and @toeverything/y-indexeddb is the only reason it is in the tree.

Ask

One of:

• pin @toeverything/y-indexeddb to a release whose y-provider declares a licence, if one exists;
• vendor or replace the IndexedDB provider so the unlicensed canary package is no longer required;
• or, if you have a line to the AFFiNE maintainers, ask for a license: MIT field on y-provider and a non-canary release.

Happy to test a canary. Thanks for Keystatic.

Reproduce

npm view y-provider@0.10.0-canary.9 license repository   # both empty
npm view @toeverything/y-indexeddb@0.10.0-canary.9 dependencies