In general, when I make my code dependent on library, do I have to check its dependencies licenses or library license is the only one to be checked on my side?
Can I be assused of using MIT library that internally violates its own dependency license?
When you are distributing an application or library, then you are responsible for ensuring that the requirements of all involved licenses are fulfilled. This includes the licenses of all transitive dependencies.
As an example, if your application uses a library M that is distributed under the MIT license and which in turn uses library G that is distributed under the GPLv2 license. In that case, you must ensure that the entire application can be distributed under the terms of the GPLv2 license. This means that you cannot use library A that is distributed under the Apache 2.0 license, because that license is not compatible with the GPLv2.
In the same vein, if library M uses both library G and library A, the library M can not be legally distributed and can not be used in your application either. And as library M can not be legally distributed in this case, then derivative works, like your application, also cannot be legally distributed.
M itself (without the libraries G and A) would probably not cause any legal problems: Because the code you distribute is neither GPL- nor Apache-licensed, you can't violate one of the two licenses in this case. However, you would probably have to re-write library G and/or A to use library M legally.
Mar 7, 2019 at 14:36