This should be the top comment... perhaps you could raise the issue on github?

The commercial license, though, is pretty reasonably priced. $25 for one developer, $110 for 8, and $320 for unlimited.

Alternatively, porting to shuffle.js or filterizr (both MIT licensed) might not be too hard.

https://vestride.github.io/Shuffle/

https://yiotis.net/filterizr/#/

This is the most concise reason why not to use this code. The rest are complaining about the code quality rather than the implications of the licensing issues here.

It's quite OK to use, if you do a review, identify all problematic dependencies, and license them under more "commercially friendly" licenses, or replace them with something else.

I do advise to be very careful about such things, and spend the effort to figure out the legal obligations that stem from transitive deps though. Not just for this project either, for _any_ project.

Or, you know, if you’re okay with the GPL. :)

But agreed, you need to be aware of the license obligations of any code you use.

What I wanted to point out is that just because software X is licensed under MIT or BSD or Apache 2.0, doesn't mean that all of its dependencies are, and therefore, that it's _only_ licensed under those licenses. I have observed several times in the wild people not understanding or appreciating the meaning of this crucial difference. That's a recipe for much regret later on when you think you can keep your trade secrets, and you legally can't.

But it's used as-is. That shouldn't trigger the viral clause, or am I misunderstanding something?

You are misunderstanding something. ANY GPLv3 anywhere in your code makes your code subject to GPLv3's terms.

But that is in your code, isn’t this just linking it?

No, linking GPL'ed code makes the product GPL'ed too, unless you're under the System Library exemption, another author-specified exemption or are actually using LGPL'ed not GPL'ed code.

Your code is still under whatever GPL-compatible license you want, but the GPL component means you can only use the product under the GPL, so for example if somebody requested the source code of your distributed product under the GPL, you'd need to provide it, all of it, under the GPL or a compatible license. You cannot just provide the GPL licensed components.

The linked GPL'ed code seems to be client-side/frontend code, so at the very least everything client-side would fall under the GPL (if you want to argue the client(-side) and the server(-side) are different products).

As other commenters have pointed out linking may still make your software GPL. However, there is still some debate on this [1].

[1] https://en.wikipedia.org/wiki/GNU_General_Public_License#Lin...

Linking to GPL code makes all of the code subject to the GPL.

You're thinking of the Affero GPL (AGPL), which triggers the reciprocity clause on modification for network services.

The Lesser GPL (LGPL) limits the reciprocity to the code itself, provided you're only doing dynamic linking or equivalent and not melding the code into yours (i.e. static linking).