acorn 8.17.0 introduces AGPL license in dependency tree

[RishithReddyRR]

acorn 8.17.0 (transitive dependency via @opentelemetry/instrumentation → import-in-the-middle) has been found to contain an
AGPL-licensed dependency in its package-lock.json. Previous versions (8.15.0, 8.16.0) did not have this issue.
This is problematic for organizations that cannot use AGPL-licensed software in commercial products.

Can you please check on why its producing AGPL license and fix it?

[dosubot[bot]]

This issue doesn't appear to originate from the Jaeger project itself. The Jaeger backend is written in Go and doesn't have Node.js dependencies [1]. The JavaScript dependencies in the main repo and documentation repo are limited to documentation tooling (Hugo/Docsy, Prettier, etc.) and don't include acorn or import-in-the-middle [2] [3].

The dependency chain you're describing (@opentelemetry/instrumentation → import-in-the-middle → acorn) is a Node.js OpenTelemetry SDK concern. If you're encountering this in your own application that uses OpenTelemetry JS instrumentation, the right place to report it would be the opentelemetry-js or opentelemetry-js-contrib repositories, or potentially the import-in-the-middle or acorn repositories directly, depending on where the AGPL dependency was actually introduced.

If this is specifically affecting the jaeger-ui (which is a separate repo), it would be best to open an issue there instead.

To reply, just mention @dosu.

---

Share context across your team and agents. Try Dosu.

[RishithReddyRR]

@dosu
We have generated FOSS dependencies.yaml file for Jaeger-Ui v2.20.0 and found AGPL license for acorn dependency.

From our observation we found that acorn being used as transtive dependency of @opentelemetry/instrumentation.

From pnpm-lock.yaml file : @opentelemetry/instrumentation(0.220.0) → import-in-the-middle(3.2.0) → acorn(8.17.0) is used

So, we have contacted opentelemetry-js team, please find more details in below link. To know more about why acorn started giving AGPL license now, please go through the link.

open-telemetry/opentelemetry-js#6978

To remove AGPL license they have suggested to uplift import-in-the-middle >= 3.3.0. So please uplift and regenerate the pnpm-lock.yaml file so that AGPL license will be removed.

[dosubot[bot]]

Thanks for the detailed follow-up and for tracking this down through the OpenTelemetry JS discussion!

To summarize the findings from that discussion for others following along:

• The AGPL-3.0 license (test262-parser-runner@0.5.0) was always a dev-only dependency of acorn — it existed in acorn 8.15.0 and 8.16.0 too, just without the license field recorded in the lockfile. acorn 8.17.0 regenerated its lockfile with a newer npm that started explicitly recording license fields, making it visible to scanners for the first time. The AGPL dependency does not ship in the acorn tarball [1].

• The structural fix is as you identified: import-in-the-middle dropped acorn as a dependency entirely in v3.3.0 (2026-07-03), replacing it with es-module-lexer. Any lockfile still pinned to iitm ≤ 3.2.x will have acorn in the resolved tree [1].

The action needed for jaeger-ui is to ensure import-in-the-middle resolves to ≥ 3.3.0 and regenerate the pnpm-lock.yaml. This is best filed as an issue (or PR) directly in the jaegertracing/jaeger-ui repository, since that's where the UI source and lockfile are maintained.

To reply, just mention @dosu.

---

Docs are dead. Just use Dosu.

[jkowall]

@RishithReddyRR Confirmed. I opened jaegertracing/jaeger-ui#4397 to refresh import-in-the-middle from 3.2.0 to 3.3.3. This removes Acorn from the OpenTelemetry production dependency path and replaces it with es-module-lexer.

One licensing clarification: acorn@8.17.0 is MIT licensed. The AGPL-licensed test262-parser-runner is a development-only dependency in Acorn's source-repository lockfile; it does not ship in the published Acorn package or appear in Jaeger UI's lockfile. Acorn remains in Jaeger UI's development graph through ESLint and Terser, but it is no longer in the production OpenTelemetry path after this change.