<p dir="auto">I've pulled together a list of questionable licenses that license scanners will pick up for Airflow. Ideally we should look to remove the dependencies from the project.</p>
<table role="table">
<thead>
<tr>
<th>Project</th>
<th>License</th>
<th>PR</th>
</tr>
</thead>
<tbody>
<tr>
<td><a href="https://pypi.org/project/astroid/" rel="nofollow">astroid</a></td>
<td>LGPL-3.0</td>
<td></td>
</tr>
<tr>
<td><a href="https://pypi.org/project/certifi/" rel="nofollow">certifi</a></td>
<td>MPL-2.0</td>
<td></td>
</tr>
<tr>
<td><a href="https://pypi.org/project/chardet/" rel="nofollow">chardet</a></td>
<td>LGPL-2.1</td>
<td></td>
</tr>
<tr>
<td><a href="https://pypi.org/project/JayDeBeApi/" rel="nofollow">JayDeBeApi</a></td>
<td>LGPL-3.0</td>
<td></td>
</tr>
<tr>
<td><a href="https://pypi.org/project/ldap3/" rel="nofollow">ldap3</a></td>
<td>LGPL-3.0</td>
<td></td>
</tr>
<tr>
<td><a href="https://pypi.org/project/mysql-connector-python/" rel="nofollow">mysql-connector-python</a></td>
<td>GPL-3.0</td>
<td></td>
</tr>
<tr>
<td><a href="https://pypi.org/project/paramiko/" rel="nofollow">paramiko</a></td>
<td>LGPL-3.0</td>
<td></td>
</tr>
<tr>
<td><a href="https://pypi.org/project/pathspec/" rel="nofollow">pathspec</a></td>
<td>MPL-2.0</td>
<td></td>
</tr>
<tr>
<td><a href="https://pypi.org/project/psycopg2binary/" rel="nofollow">psycopg2-binary</a></td>
<td>LGPL-3.0</td>
<td></td>
</tr>
<tr>
<td><a href="https://pypi.org/project/pycountry/" rel="nofollow">pycountry</a></td>
<td>LGPL-2.1</td>
<td></td>
</tr>
<tr>
<td><a href="https://pypi.org/project/PyGithub/" rel="nofollow">PyGithub</a></td>
<td>LGPL-3.0</td>
<td></td>
</tr>
<tr>
<td><a href="https://pypi.org/project/pymssql/" rel="nofollow">pymssql</a></td>
<td>LGPL-3.0</td>
<td></td>
</tr>
<tr>
<td><a href="https://pypi.org/project/PySmbClient/" rel="nofollow">PySmbClient</a></td>
<td>GPL-3.0</td>
<td></td>
</tr>
<tr>
<td><a href="https://pypi.org/project/pytest-rerunfailures/" rel="nofollow">pytest-rerunfailures</a></td>
<td>MPL-2.0</td>
<td></td>
</tr>
<tr>
<td><a href="https://pypi.org/project/text-unidecode/" rel="nofollow">text-unidecode</a></td>
<td>Artistic-2.0</td>
<td></td>
</tr>
<tr>
<td><a href="https://pypi.org/project/Unidecode/" rel="nofollow">Unidecode</a></td>
<td>GPL-3.0</td>
<td><a class="issue-link js-issue-link" data-error-text="Failed to load title" data-id="689438090" data-permission-text="Title is private" data-url="https://github.com/apache/airflow/issues/10665" data-hovercard-type="pull_request" data-hovercard-url="/apache/airflow/pull/10665/hovercard" href="https://github.com/apache/airflow/pull/10665">#10665</a></td>
</tr>
<tr>
<td><a href="https://pypi.org/project/yamllint/" rel="nofollow">yamllint</a></td>
<td>GPL-3.0</td>
<td></td>
</tr>
</tbody>
</table>
<p dir="auto">We need to <a href="https://www.apache.org/licenses/GPL-compatibility.html" rel="nofollow">avoid GPL</a>.</p>
<blockquote>
<p dir="auto">Apache 2 software can therefore be included in GPLv3 projects, because the GPLv3 license accepts our software into GPLv3 works. <strong>However, GPLv3 software cannot be included in Apache projects. The licenses are incompatible in one direction only, and it is a result of ASF’s licensing philosophy and the GPLv3 authors’ interpretation of copyright law.</strong></p>
</blockquote>
<p dir="auto">Snyk is reporting the following dependencies in our requirements.txt for python 3.6, 3.7, 3.8 are GPL v3:</p>
<ul dir="auto">
<li>jaydebeapi v1.2.3</li>
<li>mysql-connector-python v8.0.18</li>
<li>pysmbclient	v0.1.5</li>
<li>unidecode v1.1.1</li>
<li>yamllint v1.23.0</li>
</ul>
<p dir="auto">I see some previous discussion + mitigation for <code class="notranslate">unidecode</code> but not all of these.</p>