Using maven artifacts without going insane over licensing

Question

Every time I try to read or learn about licensing, it ends in a massive headache for me. Hence, I'm asking here, hoping to finally get some peace of mind about this.

Say I have a little program I'm working on. I put it on GitHub and license it under MIT. That is, I create a LICENSE with the legal text and put it in the project root. Now the coding begins.

• Working with mp3s is complicated --> com.mpatric.mp3agic (MIT)
• Java's layout managers are unusable --> com.miglayout.miglayout-swing (BSD 3-clause (or GPL))
• Swing looks bad --> com.formdev.flatlaf (Apache 2.0)

As stated before, my code is on GitHub and I'd like to relase the program as a pre-built package there.

Now what?

Can I (or a maven plugin) just make a file, say THIRD_PARTY, put the artifacts and their licenses there, add the file on GitHub, package it with the program, and everything is fine?
Or do I have to make sure that I use a license for my program that works (i.e. that is "compatible") with all of my dependencies? If so, what would that license be?

Thank you in advance.

EDIT

To clarify, I only use the project as dependencies, i.e. in my pom.xml there's a part that says

<dependencies>
 <dependency>
   <groupId>com.mpatric</groupId>
   <artifactId>mp3agic</artifactId>
   <version>x.x.x</version>
 </dependency>
 ...
</dependencies>

The question is about what to do now, how to do it might be a seperate question depending on the what. Perhaps the question is better phrased as such:

If my project (licensed under A) depends on libraries/artifacts (licensed under B, C, D etc.),
a) do the dependencies influence the choice for the license of my project
b) is distributing something like a THIRD_PARTY file containing info on which dependency uses what license along the source and binaries all I need to do here?

EDIT 2

Turns out that the maven-notice-plugin seems to be for NOTICES only which doesn't seem like something I want right now.

I then tried both the license-maven-plugin and the attribution-maven-plugin They both, in essence, generate files saying "this project (link) uses this license (link)". This is closer to what I want, but looking at other program's THIRD_PARTY files or equivalent thereof, they include the EXACT text of the project's LICENSE file. For example, the mp3agic section would read

Copyright (c) 2006-2013 Michael Patricios http://github.com/mpatric/mp3agic

and not

Copyright (c) <year> <copyright holders>,

which would be my understanding of the phrase "this permission notice shall be included". Seems like I have to download the licenses myself and put them in a directory. A minute of work for each dependency, but that's fine.

Answer 1

You need to differentiate 2 cases: a) you have your code on GitHub, and b) you distribute your code (e.g. executable) including the dependencies, e.g. as pre-built packages.

In case a) you it is sufficient to list the dependencies properly. You need to declare your own license and copyright notice. I recommend (not required) to have SPDX identifiers in each of your files.

In case b) where you are also distributing 3rd party code, you need to include a license.txt file. It is common to have your own license statement at the top and below that you include the required information from the dependencies. An example can be found here. The language in the licenses of your dependencies tells you what to include. You can also split the license file, separating your own and the 3rd party licenses, but I don't recommend that. Having it in one file is easier for the recipients.

If your dependencies have their own direct or transitive dependencies, then you need to also include the information for those. For the dual-licensed code of dependencies please be clear w.r.t. which one license you are selecting out of the available options.

For big projects I have seen license.txt files with several 10s of thousands of lines. To create these you need tools. For your small project with 3 dependencies it likely is most efficient to compile it manually.