Is there any difference to provide for instance a npm package.json or to provide all the packages source code in the source code repository of the software project? What's the impact if the project has a free or open or propietary license?

I usually look at a GitHub repository -> Insights -> Dependency Graph and most of the times I see a reference to a file that lists dependencies but they are not provided in the source code repository. It has some relation with dynamic links or derivative works?

1 Answer 1


Yes, there is a difference.

If you mention a dependency in package.json (or a similar file that gets used by a mackage manager),

  • you only need to have the right to download & use the dependency, not the right to redistribute it. That latter right is usually not granted for proprietary software.
  • you can automatically get the latest released version of the dependency

If you include the source code in your own repository

  • you can only do that for dependencies that allow redistribution
  • you can make changes to the dependency and use them before those changes are officially released
  • you won't get unexpected upgrades of the dependency
  • you need to arrange your repository in such a way that it is clear which code is yours and which comes from a dependency (that possibly uses a different license)

For the licensing options you have for your own code, it doesn't make a difference if the dependencies have their source code in the same repository or if they are downloaded via a package manager.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.