acorn 8.17.0 introduces AGPL license in dependency tree

[RishithReddyRR]

acorn 8.17.0 (transitive dependency via @opentelemetry/instrumentation → import-in-the-middle) has been found to contain an
AGPL-licensed dependency in its package-lock.json. Previous versions (8.15.0, 8.16.0) did not have this issue.
This is problematic for organizations that cannot use AGPL-licensed software in commercial products.

Can you please check on why its producing AGPL license and fix it?

[LarryHu0217]

Thanks for raising this. I checked the current main branch package-lock.json and npm metadata for the relevant packages.

In the current lockfile:

• acorn@8.17.0 is recorded as MIT and marked as a development dependency.
• import-in-the-middle@3.3.1 is recorded as Apache-2.0.
• import-in-the-middle@3.3.1 does not declare acorn as a dependency.
• The lockfile references acorn through development/tooling packages such as espree, terser, ts-node, and webpack.

Therefore, I cannot reproduce the stated path @opentelemetry/instrumentation → import-in-the-middle → acorn from the current lockfile. This may be specific to another lockfile version, a scanner attribution, or a different transitive path.

Could you share the scanner name/version and the exact dependency/license path it reported? That would make the finding reproducible and help determine whether a package or lockfile change is needed. This is a dependency-path observation, not a legal licensing conclusion.

[pacocartones]

The license field is what changed, not the dependency tree. test262-parser-runner@0.5.0 (AGPL-3.0) is a root devDependency of acorn and is already in the 8.15.0 and 8.16.0 lockfiles — same version, same integrity hash, "dev": true in all three. 8.17.0 regenerated the lockfile with an npm that records license:

acorn tag	test262-parser-runner entry	entries carrying a license field
8.15.0	dev: true, no license	126 / 263
8.16.0	dev: true, no license	263 / 349
8.17.0	dev: true, license: AGPL-3.0	447 / 448

(unchanged in 8.18.0 — it wasn't "fixed", it's just visible now). None of it ships: acorn-8.17.0.tgz is 10 files with no package-lock.json, and its package.json has no dependencies key at all.

On the path itself, there's a version boundary worth naming: import-in-the-middle dropped acorn in 3.3.0 (2026-07-03) in favour of es-module-lexer@^2.2.0, and @opentelemetry/instrumentation@0.221.0 requires ^3.0.0 — so a fresh install genuinely has no acorn under it, while a lockfile still pinned to iitm ≤ 3.2.x does.

@RishithReddyRR — which import-in-the-middle version does your lockfile resolve to?

[RishithReddyRR]

Hi @LarryHu0217 @pacocartones ,
Thank You for responding. Sorry in description I didn't mentioned the whole context , issue mentioned above was encountered in jaeger-ui v2.20.0 where @opentelemetry/instrumentation(0.220.0) → import-in-the-middle(3.2.0) → acorn(8.17.0) is used , From your comments I understood to fix this issue iitm version should be >3.2.x. ,Now in the main branch of jaeger-ui I can see they uplifted version of @opentelemetry/instrumentation to 0.221.0 but iitm is still pointing to 3.2.0, I will ask to increase the version of iitm in jaeger community. Thank You for the help.