I am writing a web app based on react framework and I am using npm package manager. Together with transitive dependencies I have about 800 MIT licensed dependencies. To comply with MIT, do I need to include a separate license file for each of those dependencies in my source code? If I use react, should I care about its transitive dependencies' licenses? or to include copyright and permission notice for react package it-self will be enough?

So from what I see, in case I am distributing only my source code without dependencies I shouldn't care about dependencies' licenses. But in case I would provide my web app as a service, not as a source code? Or if I run the app internally for the use of the company I am working for? Do I need to include all those copyrights and permission notices? Also clients are not always willing to install dependencies themselves.

  • Are you distributing all 800 dependencies yourself? Or are you distributing only your own code, and leaving the end developer (user of your source code) to use e.g. NPM to download those dependencies herself?
    – Brandin
    Sep 5 '18 at 5:33
  • @Brandin So when I use npm dependencies in my project and I only publish my own code, leaving the developer to download the packages on their own, then I don't care of any dependency licenses?
    – Peracek
    Jan 8 '19 at 16:51
  • If you publish only your own code, then you have no licensing obligations. You are free to publish it in any way you choose. However if you copy some of the dependencies into your code and distribute a derivative of that, then you'll have to look at the license of those.
    – Brandin
    Jan 8 '19 at 20:11
  • "Also clients are not always willing to install dependencies themselves." - If you ship the dependencies as a convenience to your users, then that is distribution, so you'll have to comply with the license (MIT) by including the appropriate notices with the packages that you are distributing.
    – Brandin
    Jan 8 '19 at 20:17

If you are running your web app (as a service) on your own server (or a server under your control) regardless if public or in-house, then you are not actually distributing/publishing anything, you are just offering the service. Under the MIT license if you are not distributing the code then you have no obligations. (under AGPL license it would be very different)

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.