I plan on using an EPL 2.0 Library in an Apache License 2.0 project as a dependency for the UI. I won't be modifying the source code but I believe when we do npm install to install the library, the source code is also downloaded.
Would this prevent me from using the EPL 2.0 library and if not do I need to mention the license in each and every file where I use this
EPL v2 is a bit confusing to many, as the definitions are not exactly what would be expected. Nevertheless, it is clear. For example “Contributor“ means a person or entity that Distributes the Program, while “Contribution“ is the act of modifying the Program. Then there are separate definitions for “Derivative Work“ and “Modified Work“ which is not commonly seen in other licenses.
EPL v2 and Apache v2 are not fully compatible in the sense that you cannot re-license unmodified EPL-ed code under the Apache 2 license. However, you can very well have them side-by-side in your project. So what you plan to do (files with EPL v2 code in an Apache 2 project) is perfectly fine.
When you do that, you will have to create a LICENSES.MD file which identifies that you are using this library, the full language of the EPL v2 license, and the source code of the library (or a link to where it can be downloaded). Best practice is to have one licenses.md file for your entire project, where you identify the different parts with their respective licenses (no need to add this note to each and every file of your project).
You may not remove or alter any copyright, patent, trademark, attribution notices, disclaimers of warranty, or limitations of liability (if any) that come with the EPL project.
