Open Source Stack Exchange is a question and answer site for people organizing, marketing or licensing open source development projects. It only takes a minute to sign up.
Sign up to join this community
I'm planning to use this open source project for my commercial product. The project itself is licensed under Apache 2.0 license but when I review the package, I found couple of JS libraries that it uses which are licensed under CC BY-NC-SA.
First of all, is this allowed? And, am I allowed to use the main project in my commercial project?
Yes this kind of licensing is probably allowed, but no, you likely cannot use the software for commercial purposes.
The Apache 2.0 license only applies to that component itself. It is a permissive license that allows combination with software under other licenses, even if that license is copyleft or proprietary. All the Apache license requires is that notices and the license are included.
However, CC BY-NC-SA is a copyleft license. That means any creative work that is derivative of material licensed under CC BY-NC-SA must use the same license. It is also prohibited to use material under this license for commercial purposes. Because of this purpose limitation, it is not considered an open source or free software license. (CC licenses are bad for software anyway because they don't consider issues around making the source code available or providing patent licenses.)
So if you use this dependency tree, you will have to comply with both the Apache 2.0 license (easy, just include their license & notice files) but also the CC BY-NC-SA license (very tricky, no commercial use allowed, must use the same license if you give someone else a copy of your project incl. bundled dependencies, incompatible with other copyleft licenses).
That you did a license audit is very good, precisely because of such problems. The license of a library has little to no bearing on the licenses of the dependencies it might use. There might even be incompatible licenses from your different dependencies. It is best to stick to licenses that are approved by the OSI as Open Source or by the FSF as free software licenses, because such licenses generally ensure that you can safely use them in commercial software (leaving aside issues like that GPL software might be incompatible with a particular business plan, or that many older licenses don't explicitly provide a patent license).
