Contents
Do you need a license for all dependencies?
If you don’t want to confuse package users make sure that all dependencies (both immediate and transitive) have compatible licenses with your package license. Typically dependency licenses should be more permissive or the same level of permissive as your package license.
Can You Use dependency with mpl1.1 license?
But you should not use dependency with MPL1.1 or LGPLv3 license, because they have stronger copyleft. When you need to put bundles or 3rd party source into NPM package, do not forget to list 3rd party licenses and copyrights.
Do you have to have a license for linking?
Linking will be performed by an app developer who will use your package on a build or run stage. If you don’t want to confuse package users make sure that all dependencies (both immediate and transitive) have compatible licenses with your package license.
Do you need to care about the license?
Copyleft or Protective licenses like GPL prevent linking (see above) with proprietary software; the edge case is Network Protective licenses like Affero GPLv3 which triggers by interaction over network; In between of two above are Weakly Protective licenses like MPL which has less restriction for dynamic linking (until library is in its own file)
Which is the easiest way to check NPM dependency licenses?
TL;DR There are different ways of achieving the necessary results. As one pointed out, the fastest and easiest way is (thanks to new features of npm since I wrote this blog post):
What do you need to know about GitHub dependency graph?
From a compliance standpoint, you want to know what licenses your dependencies use, including any restrictions on the use of that dependency. On GitHub, the dependency graph identifies all upstream dependencies and public downstream dependents of a repository or package.
Why do we need dependency management in open source?
When it comes to dependency management, open source software has made things more complex. Built on the foundation of sharing and reusing code, open source software now accounts for 60-80% of all applications’ code base, which means more dependencies to manage. So why do you need visibility into your dependencies anyway?
Why is it so hard to update dependencies?
Another reason outdated dependencies aren’t updated is due to a fear of breaking the build. Dependency management is hard, and applications depend on many libraries. You might have long chains of transitive dependencies or even circular dependencies. Updating one dependency may break another one further down the chain.
How is vendoring used to manage software dependencies?
‘Vendoring’ is the process of moving all third-party code into your internal directory. Not all open source licences allow you to do this, and some vendors will force you to licence your code in the same way as the dependency is licensed. In general, use this approach as a last resort.