8

I am writing a web app based on react framework and I am using npm package manager. Together with transitive dependencies I have about 800 MIT licensed dependencies. To comply with MIT, do I need to include a separate license file for each of those dependencies in my source code? If I use react, should I care about its transitive dependencies' licenses? or to include copyright and permission notice for react package it-self will be enough?

So from what I see, in case I am distributing only my source code without dependencies I shouldn't care about dependencies' licenses. But in case I would provide my web app as a service, not as a source code? Or if I run the app internally for the use of the company I am working for? Do I need to include all those copyrights and permission notices? Also clients are not always willing to install dependencies themselves.

Improve this question
4
  • Are you distributing all 800 dependencies yourself? Or are you distributing only your own code, and leaving the end developer (user of your source code) to use e.g. NPM to download those dependencies herself?
    – Brandin
    Sep 5, 2018 at 5:33
  • @Brandin So when I use npm dependencies in my project and I only publish my own code, leaving the developer to download the packages on their own, then I don't care of any dependency licenses?
    – Peracek
    Jan 8, 2019 at 16:51
  • If you publish only your own code, then you have no licensing obligations. You are free to publish it in any way you choose. However if you copy some of the dependencies into your code and distribute a derivative of that, then you'll have to look at the license of those.
    – Brandin
    Jan 8, 2019 at 20:11
  • "Also clients are not always willing to install dependencies themselves." - If you ship the dependencies as a convenience to your users, then that is distribution, so you'll have to comply with the license (MIT) by including the appropriate notices with the packages that you are distributing.
    – Brandin
    Jan 8, 2019 at 20:17

2 Answers 2

Reset to default
4

If you are running your web app (as a service) on your own server (or a server under your control) regardless if public or in-house, then you are not actually distributing/publishing anything, you are just offering the service. Under the MIT license if you are not distributing the code then you have no obligations. (under AGPL license it would be very different)

Improve this answer
2
  • Just to be clear: If a source-code file is MIT licensed, then its compiled version is as well. If you dont directly distribute the compiled file, then you dont need to state the author? Example: A SCSS file is licensed, and i compile it to CSS, and serve it with my web-app. This requires stating author, since i distribute the compiled file. But a licensed server-side file, that I compile and run, but not distribute, does not require this. That's the difference, right?
    – Jeppe
    Feb 23, 2022 at 10:37
  • 2
    @Jeppe If the file remains on the server (is not distributed or served (like html or css) to the client) then you do not need to state the copyright and license of the MIT-licensed file. It does not hurt though if you provide kind attribution to the authors of the code you are using.
    – Martin_in_AUT
    Feb 24, 2022 at 18:27
0

I think the answer is - it depends.

If you are using a SPA technology (e.g. - Angular), technically your code is downloaded per user's browser and should be listing/addressing any OS software/libraries being used that have an OS License. Fortunately with something like Angular, there is something built into the cli tools that generate a 3rdpartylicenses.txt file that gets deployed with the web app so it's accessible and can be viewed by your users.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.