Clarify Apache-2.0 attribution for Adobe @internationalized/* dependencies

[lorof]

I'm opening this as an issue because it may affect package/license metadata or third-party notices. Please feel free to move this to Discussions if that is more appropriate.

Hi! I noticed that some Reka UI components rely on Adobe @internationalized/* packages, such as @internationalized/date and @internationalized/number.

From what I understand, these packages are part of Adobe React Spectrum / React Aria and are licensed under Apache-2.0. I wanted to ask whether Reka UI needs to include any explicit attribution, license notice, or third-party notices for these dependencies in the repository or published package.

This is not meant as a report of a confirmed license violation — I just wanted to clarify the expected handling for downstream license compliance.

Thanks for your work on Reka UI!

[zernonia]

Thanks for the careful question — and no worries, this is a reasonable thing to check.

Short version: there's nothing required here, but happy to explain why.

@internationalized/date and @internationalized/number are Apache-2.0, and Reka UI uses them as ordinary runtime dependencies — they're listed in package.json, not vendored into our source, and our build externalizes them rather than bundling their code into our published output. So when you install reka-ui, your package manager pulls those packages directly from npm, each with its own Apache-2.0 LICENSE included.

Apache-2.0's attribution requirements (Section 4) apply when you redistribute the licensed code. Since we don't bundle/redistribute it — and the packages don't ship a NOTICE file to propagate — there's no obligation for Reka UI to add a license copy or third-party notice on their behalf. MIT (our license) and Apache-2.0 are also compatible, so downstream users are fine. (For reference, the date/calendar logic we ported is from melt-ui, MIT-licensed — not from Adobe's code.)

If we ever start inlining their source into the published bundle, we'd revisit this. For now, no action needed on the compliance front. Thanks again for flagging it!

_{🤖 Findings verified against the codebase with Claude (Claude Code).}