Do I need to respect licences of dependencies of dependencies?

Question

I'm using in my code dependencies managed by npm. For example I'm using uglify-js which is using BSD license (which doesn't require code disclosure). But this plugin uses as dependency (so to my project it's sub-dependency) e.g. source-map which is using Mozilla License (which requires code disclosure). The question is: I'm I safe to not disclose my code? Do I need to care about sub-dependencies licenses or not?

---

_{This is a canonical question. New questions asking effectively the same thing as this question may be closed as a duplicate of it.}

Answer 1

You are required to comply with all the licenses that apply to the different code parts that make up your project, including the licenses on transitive dependencies (dependencies of dependencies and deeper). If there is a transitive dependency with a license that states that all source code of the entire project must be available (like the GPL license does), then you are required to make sure that all source code actually is available.

But, a requirement for have the source code available does not necessarily mean that it must be available from your repository or server, unless the license explicitly states so.

Most licenses allow that if you use the software unchanged (which would be the case if you use a package manager to retrieve an official release), then you can refer your users to the location where you would retrieve the source code of that package from.

For your direct dependencies, it will normally be enough that you include a link to their repository and/or homepage in your documentation. This is a good thing to do even if the source-code disclosure doesn't mandate it.
For transitive dependencies, you can either treat them as direct dependencies (I would recommend this for dependencies with a strong copyleft license, unless they are coming in through a dependency that already has such a license), or check that there is a path through the sites/repositories of your dependencies to their source code.