## AI disclosure Much of this project's code, tests and documentation was written with AI coding agents, and so was this request. I direct that work and am responsible for what is posted here. ### What this asks I maintain the [BlockNote module](https://www.drupal.org/project/blocknote), a rich text editor integration. It redistributes a compiled JavaScript bundle built from three `@blocknote/*` packages that are licensed MPL-2.0, together with their permissively licensed dependencies, inside a drupal.org repository whose contents are licensed GPL-2.0-or-later. It also copies one stylesheet out of one of those packages into its own source tree, so the repository holds MPL-2.0 source code form and not only compiled output. I am asking the Licensing Working Group to confirm, in a citable ruling, that this is permitted, on the basis that MPL-2.0 section 3.3 makes these files distributable under the terms of the GNU GPL version 2 or later as part of a Larger Work, and that the MPL-covered files remain available under the MPL in the repository and in the upstream project. I am not asking for an exception to the GPL-2.0-or-later requirement itself, and I am not asking for a license to be added to the allowlist for distribution packaging. I am asking whether the position below is correct, because MPL-2.0 does not appear anywhere in the allowlist tables of "Drupal.org distribution packaging requirements", https://www.drupal.org/node/1475972, even though the FSF list that https://www.drupal.org/about/licensing defers to treats MPL-2.0 as indirectly compatible with GPLv2. ### The packages Every package below is at version 0.54.2. The `@blocknote/*` packages publish in lockstep, so the version applies to all of them. | Package | Version | License declared in `package.json` | Redistributed in the repository | | ------- | ------- | ---------------------------------- | ------------------------------- | | `@blocknote/core` | 0.54.2 | MPL-2.0 | Yes, inside the built bundle | | `@blocknote/react` | 0.54.2 | MPL-2.0 | Yes, inside the built bundle | | `@blocknote/mantine` | 0.54.2 | MPL-2.0 | Yes, inside the built bundle, and one stylesheet copied into `js/src/mantine.css` | Upstream project: https://github.com/TypeCellOS/BlockNote. Published on npm under the `@blocknote` scope. Copyright holder: the BlockNote authors, TypeCellOS. The remaining packages that end up in the bundle are permissively licensed. `THIRD_PARTY_NOTICES.md` lists 63 packages compiled into the bundle: the 3 MPL-2.0 packages above, 58 under MIT, 1 under 0BSD and 1 under MIT OR CC0-1.0. The bundle also carries icon glyphs that upstream's own packages inline, some under Apache-2.0 and one under CC BY 4.0, and the module copies Remix Icon SVG files of its own; those are non-code assets and are the subject of a separate issue, #3578951. The authoritative list for any given release is the lockfile committed next to the bundle, and `THIRD_PARTY_NOTICES.md` in the repository is generated from it. ### License file status of the MPL-2.0 packages Each of the three packages ships a `LICENSE` file containing the stock, unmodified Mozilla Public License Version 2.0 text. That stock text includes Exhibit A, the standard source code form notice, and Exhibit B, the template of the "Incompatible With Secondary Licenses" notice, because both exhibits are part of the published license document. What matters for compatibility is whether the Exhibit B notice has been *attached* to the covered software, which is what section 1.5 and section 10.4 of the license describe. It has not been. A search of the upstream repository for the string "Incompatible With Secondary Licenses" returns matches only inside `LICENSE` files, that is, inside the template exhibit of the license text itself, and in no source file, header or package manifest. No `@blocknote/*` package declares itself Incompatible With Secondary Licenses. The repository's root `LICENSE.txt` states the position directly: > Source code in this repository is covered by the "Mozilla Public License Version 2.0" (MPL-2.0) license, except for the XL packages. > The XL packages (source code in the `packages/xl-*` directories and published in NPM as `@blocknote/xl-*`) are licensed under the "GNU General Public License Version 3" (GPL-3.0). Additionally, a commercial license is available. ### The section 3.3 argument MPL-2.0 section 3.3, "Distribution of a Larger Work", permits the covered software to be distributed under the terms of a "Secondary License", which section 1.12 defines as the GNU GPL version 2.0, the GNU LGPL version 2.1, the GNU AGPL version 3.0, or any later versions of those licenses, provided the covered software also remains available under the terms of the MPL. The FSF, which https://www.drupal.org/about/licensing defers to for the definition of GPL compatibility, states this as: > Section 3.3 provides indirect compatibility between this license and the GNU GPL version 2.0, the GNU LGPL version 2.1, the GNU AGPL version 3, and all later versions of those licenses. and qualifies it: > Parties who release original work under MPL 2.0 may choose to opt out of this compatibility by including a sentence in the license notices that says that the work is "Incompatible With Secondary Licenses." Any software that includes this notice is not compatible with the GPL or AGPL. The BlockNote packages do not include that notice, as set out above, so the opt-out does not apply and section 3.3 does. The condition attached to section 3.3 is that the MPL-covered files stay available under the MPL. That is satisfied twice over: upstream publishes them under MPL-2.0 on npm and on GitHub, and the module repository ships the upstream license text and the provenance information for each package in `THIRD_PARTY_NOTICES.md`, next to the sources from which the bundle is built. I could not find a ruling on MPL-2.0 itself in this queue, which is why I am asking. Two earlier cases bear on it: - In a 2013 request to the packaging allowlist, https://git.drupalcode.org/project/drupalorg_whitelist/-/work_items/1996750, kreynen noted that CKEditor plugins whose license page read "GPLv3, LGPLv3, and MPLv1.1" did not qualify as compatible with GPLv2. MPL 1.1 is GPL-incompatible in the FSF's own list; MPL 2.0 was written specifically to fix that, which is what section 3.3 is for. The request was later closed as fixed, once CKEditor's developers confirmed that the plugins are GPL-2.0-or-later under CKEditor's own GPL, LGPL and MPL tri-license. - In 2017 this queue declined an exception for a contributed module to bundle a compiled GPL-3.0 JavaScript library, YoastSEO.js, https://git.drupalcode.org/project/drupal_lwg/-/work_items/2873002: "The LWG cannot approve exception requests to include libraries that are only compatible with GPL-3.0 (including javascript) at this time." That is the case section 3.3 distinguishes this one from: GPL-3.0-only code offers no path to GPL-2.0-or-later, and MPL-2.0 code without the Exhibit B notice does. https://git.drupalcode.org/project/drupal_lwg/-/work_items/3447461, "Allow GPL-Compatible Licensing for Non-Derivative Code and Drupal.org General Projects", is open policy work on licenses for code that is not derived from Drupal. It is not a ruling, and this request does not depend on its outcome. ### What is deliberately excluded The `@blocknote/xl-*` packages are offered under GPL-3.0 or a commercial license; each declares `GPL-3.0 OR PROPRIETARY`. At 0.54.2 eight are published: `@blocknote/xl-ai`, `@blocknote/xl-docx-exporter`, `@blocknote/xl-email-exporter`, `@blocknote/xl-multi-column`, `@blocknote/xl-odt-exporter`, `@blocknote/xl-pdf-exporter`, `@blocknote/xl-typst-compiler` and `@blocknote/xl-typst-exporter`. GPL-3.0-only code is not compatible with GPL-2.0-or-later in the direction Drupal needs, and https://www.drupal.org/node/1475972 states that no new libraries available exclusively under GPL-3.0, LGPL-3.0, Apache-2.0 or AGPL-3.0 will be allowlisted. None of these packages is in the module's dependency tree, none is in the bundle, and the module does not require them. A site that holds a commercial license can install them itself and integrate them from a module of its own; that is outside this repository. ### How the bundle is built and what is in the repository The module's JavaScript is TypeScript source in `js/src/`, built with Vite into a compiled bundle committed at `dist/`, in the same pattern Drupal core uses for its CKEditor 5 build in `core/assets/vendor`, and that the Gutenberg, ProseMirror, Canvas and CKEditor 5 Plugin Pack projects use for their own JavaScript. What is in the repository, and therefore in the release tarball: - `js/src/`, the module's own TypeScript source, under GPL-2.0-or-later with the rest of the module, except the one file named below. - `package.json` and the lockfile, which pin every dependency to an exact version and are the authoritative record of what the bundle contains. - `dist/blocknote.js` and `dist/blocknote.css`, the compiled output. - `js/src/mantine.css`, a copy of `src/mantineStyles.css` from `@blocknote/mantine`, under MPL-2.0 and carrying the license notice from Exhibit A of that license. The section below sets it out. - `THIRD_PARTY_NOTICES.md`, generated from the lockfile, naming for each bundled package its author and copyright holder, its license with the upstream license text or a link to it, its version, and the URL it was obtained from. This is the file that satisfies the documentation requirement in https://www.drupal.org/node/422996, which asks for provenance, license and source. What is not in the repository: `node_modules`, and any `@blocknote/xl-*` package. The continuous integration pipeline installs the pinned dependencies, rebuilds the bundle and fails the build if the rebuilt output differs from the committed output. The committed bundle therefore cannot drift from the sources and the lockfile that describe it, which is what makes the provenance record meaningful rather than aspirational. Upstream source for every bundled package is available from npm and from https://github.com/TypeCellOS/BlockNote at the exact pinned versions, and the MPL-covered files remain under the MPL there, as section 3.3 requires. ### The stylesheet copied into the repository `js/src/mantine.css` in the module is a copy of `src/mantineStyles.css` from `@blocknote/mantine` 0.54.2. It is the stylesheet the editor kit uses to pull in the Mantine component styles and to set the Mantine baseline and default custom properties. The copy exists so that the module can leave out the component stylesheets for components the editor never renders, which halves the size of the compiled stylesheet it ships. The list of imports is shortened. The rules under the imports are the upstream rules with nothing taken out and nothing put in, differing from them only in where long declarations wrap. This makes the file a Modification in the sense of MPL-2.0 section 1.10, and it makes the repository a distributor of covered software in source code form, which section 3.1 governs, and not only a distributor of executable form, which is what sections 3.2 and 3.3 cover. The module answers section 3.1 the way Exhibit A of the license describes: the file carries the source code form license notice at its head, names the package and version it came from, and points at `THIRD_PARTY_NOTICES.md`, where the full license text is reproduced. No license notice was removed from the copied text; the upstream file carries none. The file stays under the MPL, and section 3.3 is what additionally allows it to be distributed under GPL-2.0-or-later with the rest of the module, on the same reasoning as the bundle. I am raising it separately because the compatibility question a working group is usually asked is about compiled output, and because a reviewer who finds an MPL-2.0 source file in a GPL-2.0-or-later repository has a fair reason to stop and ask. ### The question Does the Licensing Working Group confirm that `@blocknote/core`, `@blocknote/react` and `@blocknote/mantine`, licensed MPL-2.0 with the stock license text and without an attached Exhibit B "Incompatible With Secondary Licenses" notice, may be redistributed inside a drupal.org repository licensed GPL-2.0-or-later under MPL-2.0 section 3.3, both in compiled form in `dist/` and in source code form in the one copied stylesheet described above, given that the upstream MPL-covered files remain available under the MPL, that the copied file stays under the MPL and carries the Exhibit A notice, and that provenance, license and source are documented in the repository as https://www.drupal.org/node/422996 requires? If the answer is yes, would the working group consider adding MPL-2.0 to the allowlist at https://www.drupal.org/node/1475972, with the Exhibit B caveat stated, so that the next maintainer in this position does not have to ask? If the answer is no, or yes only under conditions, please state the conditions. I will comply before the module's first stable release rather than after it.