Use package / package-lock for acknowledgments?

Question

I wanted to create a site with acknowledgments/attributions for all the packages used in my project (that's even required for the MIT licenses). So I thought about using package.json for that purpose. But as I saw package-lock.json I started doubting which licenses I have to credit?

• Package contains all directly used files
• Package-lock also contains the dependencies of these files.

Answer 1

Ultimately, your project relies on functionality supplied by some package X. It doesn't matter if your code relies on it directly or if it relies on package Y which in turn relies on package X - the bottom line is that without package X, your project wouldn't work.

In short - you need to acknowledge all the packages you're using, whether directly or indirectly, so pacakge-lock.json may be a good place to start.