Unlicensed indirect dependency

[matthiasr]

What happened?

The dependency sasha-s/go-csync, an indirect dependency via disgo, introduced in #3320, does not have an open source license. A repository being public is not enough.

This unfortunately means that it cannot be used in open source projects such as this one. Upstream issues: sasha-s/go-csync#4, disgoorg/disgo#329.

How can we reproduce this?

N/A

goreleaser version

1.11.0 and later

GoReleaser Check

• goreleaser check shows no errors

Search

• I did search for other open and closed issues before opening this

Supporter

• I am a sponsor or a Pro customer

Code of Conduct

• I agree to follow this project's Code of Conduct

Additional context

FOSSA flags this:

This package contains unlicensed code, which by default is copyrighted to the original author. You may not use these dependencies without first obtaining a license.

[caarlos0]

ouch, thanks for bringing this to my attention!

I'll subscribe to the upstream issue, if they don't solve it I'll probably end up replacing disgo with something else, as we only use the post feature...

[caarlos0]

actually it was pretty easy to remove the dep entirely #4521