Licensing clarification for Pagefind 1.5.2 browser WASM and pagefind_microjson

[ochipin]

Hello, and thank you for maintaining Pagefind.

We are developing HuPongo, a commercial, closed-source GUI application for Hugo.

Our desktop application downloads the official, unmodified Pagefind Extended 1.5.2 binary and runs it as a separate process using --service. We do not link Pagefind into our application's executable.

Our users then publish the generated static website, including Pagefind's JavaScript and WebAssembly search assets.

We would like to clarify the licensing requirements for those browser-side assets. We noticed that:

• pagefind_web/Cargo.toml declares MIT, but depends on pagefind_microjson = "0.1.4".
• pagefind_web/src/lib.rs imports and uses pagefind_microjson::JSONValue.
• The Cargo.toml in the published pagefind_microjson 0.1.4 crate declares GPL-3.0-only.

Could you please clarify:

1. Can the browser WASM shipped with Pagefind 1.5.2 be redistributed under MIT terms alone? Is there an additional permission or licensing clarification covering this dependency?
2. If GPL requirements apply to that WASM, what notices and corresponding source should website publishers provide? Is there an official source archive or recommended procedure we can use?

We are asking specifically about distributing the browser search program, separately from our GUI application's source code and the website authors' own content.

We may be misunderstanding the licensing metadata and would appreciate clarification.

Thank you!

[Vituartzz]

I checked the published crates and the repo. Your reading of the dependency chain is right, and I couldn't find anything granting an exception.

What's there

• pagefind_web/Cargo.toml declares license = "MIT" and depends on pagefind_microjson = "0.1.4", which is used in src/lib.rs, src/filter.rs and src/filter_index.rs. So it's compiled into the browser WASM (pagefind_web itself isn't published on crates.io; it only ships inside the build).
• pagefind_microjson 0.1.4 on crates.io is GPL-3.0-only, points to rspencer01/microjson, and is published by bglw. The CHANGELOG (v1.0.x) says "Changed microjson git dependency to a pagefind_microjson crate dependency (for now) — Please update microjson #421". So it's a republish of upstream, not a relicensed fork.
• Upstream rspencer01/microjson has a GPL-3.0 LICENCE file, and every microjson release on crates.io is GPL-3.0-only.
• Searching the repo for "GPL" and "microjson" only turns up Please update microjson #421 (about updating the dependency). There's no notice, issue or discussion with an exception or an explanation of the combination.

So, as published, the 1.5.2 browser WASM contains GPL-3.0-only code. The MIT label on pagefind_web covers Pagefind's own code, not that dependency.

Who can resolve it

Only the copyright holders can. Either the microjson author offers it under a permissive license, or Pagefind swaps the dependency (it's a small JSON parser used for filters). An issue on Pagefind that references #421 is probably the quickest way to get @bglw's position on record, and a maintainer statement is what your review needs anyway.

If you need to ship before that

GPL-3.0 §6(d) covers serving object code from a "designated place" such as a website. You offer equivalent access to the Corresponding Source, which can live on a different server (including a third party's) as long as there are clear directions next to the object code. Since your users publish the unmodified upstream build, the corresponding source is the Pagefind v1.5.2 tag plus the pagefind_microjson 0.1.4 crate source, together with the GPL-3.0 text.

Not legal advice, as you said — worth running past whoever does your license review.