We use several LGPL third-party library JARs in our product, some of which contain classes with security concerns, which are identified by the OWASP scan during build. We do not require the classes identified by the scan, so would like to remove them from the jar files we distribute. If we do this, does it change anything under the terms of LGPL? LGPL talks about modifying the code, but we are not doing this, just removing classes.
Regardless of how you remove the class, this is a modification of the work under license, and can be done only in full compliance with the license of the libraries.
While this might seem absurd, let me illustrate with a more concrete but hypothetical example why it is so:
Imagine you are the director of a museum. The museum gets the copy of a wonderful statue as gift from a famous sculptor. It’s called “the well balanced justice”.
You decide to expose it, of course with attribution. There’s only a single place left to do so.
Unfortunately the security department says that one leg of the justice symbol now interrupts a laser beam vital to the security of the museum. You decide to remove the leg.
Now the statue is there, with the name of the artist and the title. But it no longer looks balanced. Worse, the artist gets bashed bu the critics for her alleged lack of taste (due to the leg you removed).
This is why copyright is concerned with any changes to copyrighted work: Copyright aim to protect the rights of the owner of the original work. Since LGPL is a license that is based on the principles of copyright laws, even if for free, it still covers changes performed whether on the binary or in the source code.
Disclaimer: This is not legal advice. For legal advice consult a lawyer or a qualified legal advisor in your jurisdiction