Detailing the problem
The package in question, matomo/device-detector, requires developers to share their derivative code publicly (LGPL v3). This conflicted with Dotkernel's contractual obligations to keep client code business and enterprise friendly, and risked legal issues.
The solution
Dotkernel decided to discard the use of third-party packages licensed under LGPL v3. The matomo/device-detector package had been used in dotkernel/dot-user-agent-sniffer to identify the user agent and use the results in internal reports.
All of Dotkernel's packages are licensed under MIT, which has no restrictions on the source code other than keeping the license and copyright notice in a file within each package. Other non-restrictive licenses deemed acceptable (used by some dependencies instead of MIT) include Apache-2.0, BSD-2-Clause, BSD-3-Clause, ISC, MPL-2.0 and OSL-3.0.
The resolution
Starting with version 3.4.0, the dotkernel/dot-user-agent-sniffer package must follow the LGPL v3 license. The admin application will not use the features from matomo/device-detector, but will contain instructions on how to add the package for developers who intend to use it.
Important note
Any application using dotkernel/dot-user-agent-sniffer with a version lower than 3.4.0 is still a legal liability. Dotkernel will not abandon the issue, and is looking into a solution to bring back the device detector functionality in the future under a less restrictive license. For now, dotkernel/dot-user-agent-sniffer is not included in any Dotkernel application by default.
Frequently Asked Questions
Why did Dotkernel need a workaround for this package? +
An analysis found that matomo/device-detector was licensed under LGPL v3, which requires sharing derivative code publicly. Since Dotkernel projects use MIT, the more restrictive license would have to apply to the whole application, conflicting with contractual obligations to keep client code business friendly.
Where was the LGPL v3 package being used? +
In Dotkernel's dot-user-agent-sniffer package, to identify the user agent and use the results in internal reports.
What solution did Dotkernel adopt? +
Discarding the use of third-party LGPL v3 packages. All Dotkernel packages are MIT licensed, and other acceptable non-restrictive licenses include Apache-2.0, BSD-2-Clause, BSD-3-Clause, ISC, MPL-2.0 and OSL-3.0.
What changed in dot-user-agent-sniffer as a result? +
Starting with version 3.4.0 it must follow LGPL v3. The admin application will not use matomo/device-detector's features, but will document how to add it for developers who want it.
Is it still risky to use an older version of dot-user-agent-sniffer? +
Yes - any application using a version lower than 3.4.0 is still a legal liability. Dotkernel will not include the package in its applications by default while it looks for a less restrictive replacement.