I wanted to create a site with acknowledgments/attributions for all the packages used in my project (that's even required for the MIT licenses). So I thought about using package.json for that purpose. But as I saw package-lock.json I started doubting which licenses I have to credit?

  • Package contains all directly used files
  • Package-lock also contains the dependencies of these files.

Ultimately, your project relies on functionality supplied by some package X. It doesn't matter if your code relies on it directly or if it relies on package Y which in turn relies on package X - the bottom line is that without package X, your project wouldn't work.

In short - you need to acknowledge all the packages you're using, whether directly or indirectly, so pacakge-lock.json may be a good place to start.

  • Thanks for your effort!
    – MoPaMo
    Jun 27 at 14:32

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.