chore: remove licensee as a devDependency

[lukekarrys]

It is only used during CI and we can call it with npx

[ljharb]

I would strongly suggest keeping licensee; especially with its community corrections overrides, it's going to be more robust than a homegrown script.

[ljharb]

This is much better, but will still break whenever v11 comes out - what's the benefit of hiding the dependency information by not listing it explicitly? Listing it explicitly means tooling is aware of it.

[wraithgar]

It uses a lot of the same subdependencies as npm, but it uses older versions of them. There is quite a bit of cognitive load trying to manage them in the tree and disregard them as not something to update.

[ljharb]

when you say "manage them in the tree", do you mean in the lockfile? or do you mean that npm vendors dev deps as well as runtime deps? (perhaps only runtime deps should be vendored, if so)

[wraithgar]

We update deps in npm every release, it is a very mentally intensive process because of the nature of npm, every update is done individually and checked. Checking for outdated deps is also done every time and these only make the process more exhausting. This is a quality of life improvement for the folks who maintain npm. Arguments coming from the perspective of ideals or the purity of architecture are not going to carry any weight here.

[lukekarrys]

If npx licensee breaks when v11 comes out, we will either fix it or use npx licensee@10 with a todo to migrate in the future. I think its actually good we use npx licensee here so we know when v11 comes out. Keeping it as a dev dep would give us the same benefit of course.

But currently licensee creates a lot of noise when running npm ls locally. Reducing this noise is worth whatever time we spend in the future fixing licensee or staying on an outdated version.

[ljharb]

Alrighty. Seems like a motivation to change the workflow so npm maintainers' quality of life isn't dramatically worse than everyone else's :-) but obv its up to yall

[lukekarrys]

The best future here would be npm outdated (or any command) taking any --query as a parameter. We'd codify that via a run-script in our repo and then npm run my-outdated would skip anything we consider non-essential to our usual outdated checking. The dev vs prod binary doesn't cut it here.

But that will take substantially longer than replacing licensee with npx licensee. 😄