Open Source Stack Exchange is a question and answer site for people organizing, marketing or licensing open source development projects. It only takes a minute to sign up.
Sign up to join this community
Does a licence for a product such as Express JS take account of the most onerous licence in its dependencies?
We only develop in JavaScript and use NPM for module management; does NPM itself do any checks that a module's licence covers its dependencies?
I am wondering if as a company we only need to be concerned with the top-level licence, or do we need to manually check all the dependencies and sub dependencies?
You distribute your product. Thus you are liable.
Draw whatever conclusion you want. Usually you want to make sure that your product and all the dependencies you use really are under a license which is compatible with what you ship. Just checking the top-level license does not cut it in the least and might make you target of possible copyright infringement claims. That might be much more uncomfortable and expensive than exercising care in choosing dependencies carefully and checking their license status.
The issue becomes possibly clearer when you think about the fact that not all dependencies are necessarily required, but that there can be optional dependencies, providing certain functionality which not everyone needs or wants (for whatever reason, possibly even licensing reasons). One of the best examples for this is ffmpeg or VLC which come with a huge amount of possible plug-ins and dependencies - proprietary and all kind of open-source licensed ones. But you have the choice; one can even compile versions which may not be distributed due to incompatible, mutually-exclusive licenses of the different components.
Typically libraries (and programmes) all have their own licenses, which need not be the smallest common denominator of any libraries they make use of themselves. That allows replacement of dependencies by interface-compatible ones which might offer enhanced functionality, different license etc - giving the users overall more flexibility and choice to fit their needs.
Long story short: you as company will have to exercise the same care and process that any large(r) Linux distribution such as Debian does for the software packages they offer: vetting the installer packages for licenses of the programme and all dependencies contained in the package so that they can deliver correct information. Distributing software for commercial interest, you might want to exercise possibly even greater care than a not-for-profit organization might do where a claim of wilful copyright infringement is harder to make.
Using the NPM module management is certainly a good way or tool to help you checking it and going through the list - but you should not rely on its information as it does not give you any guarantee. Just because someone on the internet said it's ok or whatever license, doesn't mean it is.
You could argue that in theory, if Express, for argument's sake, is licensed under the MIT license, it shouldn't depend on anything that conflicts with that license, but that statement essentially boils down to you trusting their process. At the end of the day, you are distributing a product, so you are accountable for everything you distribute, including transitive dependencies.
