I am writing a web app based on react framework and I am using npm package manager. Together with transitive dependencies I have about 800 MIT licensed dependencies. To comply with MIT, do I need to include a separate license file for each of those dependencies in my source code? If I use react, should I care about its transitive dependencies' licenses? or to include copyright and permission notice for react package it-self will be enough?

So from what I see, in case I am distributing only my source code without dependencies I shouldn't care about dependencies' licenses. But in case I would provide my web app as a service, not as a source code? Or if I run the app internally for the use of the company I am working for? Do I need to include all those copyrights and permission notices? Also clients are not always willing to install dependencies themselves.

  • Are you distributing all 800 dependencies yourself? Or are you distributing only your own code, and leaving the end developer (user of your source code) to use e.g. NPM to download those dependencies herself? – Brandin Sep 5 '18 at 5:33
  • @Brandin So when I use npm dependencies in my project and I only publish my own code, leaving the developer to download the packages on their own, then I don't care of any dependency licenses? – Peracek Jan 8 '19 at 16:51
  • If you publish only your own code, then you have no licensing obligations. You are free to publish it in any way you choose. However if you copy some of the dependencies into your code and distribute a derivative of that, then you'll have to look at the license of those. – Brandin Jan 8 '19 at 20:11
  • "Also clients are not always willing to install dependencies themselves." - If you ship the dependencies as a convenience to your users, then that is distribution, so you'll have to comply with the license (MIT) by including the appropriate notices with the packages that you are distributing. – Brandin Jan 8 '19 at 20:17

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.