Compliance [Needs Review]: Audit & remove GPL-3.0 dependencies (@whiskeysockets/baileys) for MIT cleanliness

[khaira777]

Important

Status: Needs Compliance / Licensing Review
This issue outlines a license compliance review. It requires maintainer review and approval before deciding whether to replace or decouple the dependency.

Extracted from fork richanonymous22/FloCafe (branch: claude/plemmo-epos-audit-fro8v9):

Overview

Audit and remove @whiskeysockets/baileys (GPL-3.0 copyleft license) from the main application bundle to ensure FloCafe remains 100% pure MIT-compliant without GPL copyleft exposure for distributed binary releases.

Key Features & Technical Details

1. GPL-3.0 Dependency Issue:
   • Including GPL-3.0 dependencies directly inside the main desktop Electron application bundle creates copyleft ambiguity for distributed MIT binaries.
2. Proposed Remediation:
   • Remove direct @whiskeysockets/baileys bundle imports from the main process or decouple WhatsApp messaging into an optional external plugin / webhook extension.
3. Reference Implementation:
   • Commit da57263 in richanonymous22/FloCafe.

[khaira777]

Verdict: ALREADY RESOLVED / OUTDATED — baileys is MIT in the pinned range

Findings:

• @whiskeysockets/baileys@7.0.0-rc13 (package.json ^7.0.0-rc13) is MIT-licensed: license field "MIT", its LICENSE file is "MIT License — Copyright (c) 2025 Rajeh Taher/WhiskeySockets", and the npm registry reports MIT for 7.x. Baileys was GPL-3.0 in the 6.x line; the 7.x rewrite was relicensed to MIT. package-lock.json/node_modules resolve 7.0.0-rc13, so the GPL exposure this issue describes does not exist in the current dependency graph.

Optional follow-up (maintainer decision): CI's dependency-review checks vulnerabilities, not licenses — if MIT-purity scanning is wanted, that's a separate small CI item, not a dependency removal.