Is there any difference to provide for instance a npm package.json or to provide all the packages source code in the source code repository of the software project? What's the impact if the project has a free or open or propietary license?
I usually look at a GitHub repository -> Insights -> Dependency Graph
and most of the times I see a reference to a file that lists dependencies but they are not provided in the source code repository. It has some relation with dynamic links or derivative works?