I am building a marketing website using React and the ecosystem around it (Webpack, Babel, etc.). The site is shipped as a minified client-side bundle. NPM tells me there are a gazillion dependencies and sub-dependencies involved, some only during the build step.

Do I have to attribute all dependencies including sub-dependencies and build-only dependencies? How would I attribute OSS that is involved? I wouldn't exactly want to shove this into our customers' faces.

To be honest, I have never seen a giant OSS license disclaimer page on any website built with React or <popular front-end framework> before. Large-scale SaaS companies such as https://stripe.com or https://shopify.com don't list the OSS that is part of their marketing pages products or I at least cannot find it (which is kinda the point of attribution, right?).

Edit: There are no copyleft licenses involved.


You are responsible for complying with all the licenses for the software that you distribute. You're not only giving users a copy of your immediate dependencies, but are giving them a bundle with your entire dependency graph. Software that you only use during the build process doesn't matter though.

This doesn't have to be a big nuisance. E.g. a separate page or dialogue with the license notices might be appropriate. As a rule of thumb, you should attribute third party components wherever you assert your own copyright, because you are not the sole copyright holder for the code you are distributing.

You're absolutely right that such attributions are rather rare in the frontend world. This has multiple factors.

  • Most JavaScript libraries are under rather permissive licenses that merely require license notices to be preserved (in the source), but do not require additional notices directly to the recipient.
  • Historically, JavaScript was distributed as source code (that already included the license notices). This has changed with minification and transpiling, but frontend developer culture has not caught up.
  • Since NPM makes it very easy to assemble huge dependency graphs without ever noticing the involved licenses, many frontend developers are not aware of their rights and obligations.
  • Just because other sites get away with ignoring attribution requirements doesn't mean that it's legal.

The mobile app ecosystem and the native software ecosystem has a far more rigorous license compliance culture. All current browsers ship with many open source components, and provide very good examples for attribution.

“Attribution” here means that you reproduce the copyright and license notices of the involved components, as required by the individual licenses. Some licenses may have additional requirements, e.g. Apache-2.0 requires you to also show the contents of a NOTICE file to users if such a file exists.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.