I am building a marketing website using React and the ecosystem around it (Webpack, Babel, etc.). The site is shipped as a minified client-side bundle. NPM tells me there are a gazillion dependencies and sub-dependencies involved, some only during the build step.

Do I have to attribute all dependencies including sub-dependencies and build-only dependencies? How would I attribute OSS that is involved? I wouldn't exactly want to shove this into our customers' faces.

To be honest, I have never seen a giant OSS license disclaimer page on any website built with React or <popular front-end framework> before. Large-scale SaaS companies such as https://stripe.com or https://shopify.com don't list the OSS that is part of their marketing pages products or I at least cannot find it (which is kinda the point of attribution, right?).

Edit: There are no copyleft licenses involved.


You are responsible for complying with all the licenses for the software that you distribute. You're not only giving users a copy of your immediate dependencies, but are giving them a bundle with your entire dependency graph. Software that you only use during the build process doesn't matter though.

This doesn't have to be a big nuisance. E.g. a separate page or dialogue with the license notices might be appropriate. As a rule of thumb, you should attribute third party components wherever you assert your own copyright, because you are not the sole copyright holder for the code you are distributing.

You're absolutely right that such attributions are rather rare in the frontend world. This has multiple factors.

  • Most JavaScript libraries are under rather permissive licenses that merely require license notices to be preserved (in the source), but do not require additional notices directly to the recipient.
  • Historically, JavaScript was distributed as source code (that already included the license notices). This has changed with minification and transpiling, but frontend developer culture has not caught up.
  • Since NPM makes it very easy to assemble huge dependency graphs without ever noticing the involved licenses, many frontend developers are not aware of their rights and obligations.
  • Just because other sites get away with ignoring attribution requirements doesn't mean that it's legal.

The mobile app ecosystem and the native software ecosystem has a far more rigorous license compliance culture. All current browsers ship with many open source components, and provide very good examples for attribution.

“Attribution” here means that you reproduce the copyright and license notices of the involved components, as required by the individual licenses. Some licenses may have additional requirements, e.g. Apache-2.0 requires you to also show the contents of a NOTICE file to users if such a file exists.

  • Thank you for this answer. I've been searching quite long and most of the results coming up was about authoring OSS libraries, not using them for building a proprietary product, which ironically probably is what is being done the most. Can anyone provide some examples of websites that have added a good attribution page so I can take some inspiration from there? Specifically I'm a bit concerned about how much I need to reveal about my dependency graph for security reasons. Sep 16 '21 at 10:16
  • @funkylaundry As I wrote in my answer, I think it's better to look at (native) apps rather than at websites for examples. You probably need to provide license notices for all open-source components that you distribute, i.e. that are part of your frontend. It doesn't matter if it's immediate or transitive dependencies. This is not a security risk: hackers can already analyze the assets that you serve.
    – amon
    Sep 16 '21 at 16:12
  • Yes, I understand that I need to disclose both immediate and transitive dependencies. I know it's technically possible for hackers to analyze dependencies from my bundle. Perhaps I'm naive, but I would not think it would be practically possible once the code is bundled and minimized? But perhaps I'm wrong? Sep 18 '21 at 13:14
  • @funkylaundry Un-minifying some JS is a much easier problem than decompiling a binary, and that's possible as well. In theory WASM allows for stronger obfuscation, but that still doesn't change that users control their browser and all code running in it. If you want to trust code, run it on a backend. In any case, I found a good example of a website with license attributions: Gitea is an open-source Github clone that links a textfile with license notices from every page. This is very good, though I wouldn't necessarily note the version numbers.
    – amon
    Sep 18 '21 at 13:26

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.