Dependencies installed via package managers

Question

Is there any difference to provide for instance a npm package.json or to provide all the packages source code in the source code repository of the software project? What's the impact if the project has a free or open or propietary license?

I usually look at a GitHub repository -> Insights -> Dependency Graph and most of the times I see a reference to a file that lists dependencies but they are not provided in the source code repository. It has some relation with dynamic links or derivative works?

Answer 1

Yes, there is a difference.

If you mention a dependency in package.json (or a similar file that gets used by a mackage manager),

• you only need to have the right to download & use the dependency, not the right to redistribute it. That latter right is usually not granted for proprietary software.
• you can automatically get the latest released version of the dependency

If you include the source code in your own repository

• you can only do that for dependencies that allow redistribution
• you can make changes to the dependency and use them before those changes are officially released
• you won't get unexpected upgrades of the dependency
• you need to arrange your repository in such a way that it is clear which code is yours and which comes from a dependency (that possibly uses a different license)

For the licensing options you have for your own code, it doesn't make a difference if the dependencies have their source code in the same repository or if they are downloaded via a package manager.