Questions tagged [dependencies]

The tag has no usage guidance.

Filter by
Sorted by
Tagged with
3
votes
1answer
59 views

Using maven artifacts without going insane over licensing

Every time I try to read or learn about licensing, it ends in a massive headache for me. Hence, I'm asking here, hoping to finally get some peace of mind about this. Say I have a little program I'm ...
3
votes
1answer
99 views

Do the licenses of dependencies matter if the dependencies are not actually shipped by my software?

I have a github repository that I plan on making public, and I'm in the process of choosing a license for it. It's a Python project that utilizes a number of open source libraries. The code for those ...
3
votes
2answers
77 views

Change of version of Dependency: Does it constitute a Derivative Work?

We are building a product with 100s of OSS dependencies. We want to fully comply with the OSS license terms. Let's assume our product has a direct dependency "DDep_v1" under MPL-2.0 license, ...
1
vote
1answer
39 views

Use package / package-lock for acknowledgments?

I wanted to create a site with acknowledgments/attributions for all the packages used in my project (that's even required for the MIT licenses). So I thought about using package.json for that purpose. ...
0
votes
2answers
128 views

Do I have to worry about software dependency licence management?

Does a licence for a product such as Express JS take account of the most onerous licence in its dependencies? We only develop in JavaScript and use NPM for module management; does NPM itself do any ...
-1
votes
2answers
182 views

How to include licenses of dependencies in commercial closed-source proprietary software?

Our company is developing an enterprise application that is essentially a set of different applications (microservices). Some of these microservices are based on node.js while others are based on ...
1
vote
1answer
104 views

Do I have to provide the build dependencies listed in a package build script to comply with GPLv2?

Problem description: For example in the case of alpine linux, there are APKBUILD scripts which reference the source files, the complete source code can be easily fetched with the abuild fetch command ...
1
vote
1answer
38 views

Should I give attribute to transitive dependencies if I am using a package in binary form?

I am including the PostgreSQL JDBC driver (BSD-2) in my project in binary form (which I got from their website). I copied the license text in my repo, however I found the github repo for the driver ...
13
votes
4answers
3k views

Which licenses give me a guarantee that a software I'm installing is completely open-source, free of closed-source dependencies or components?

I have a question about free vs open source software that's more about practical implications from the user's perspective. I'll explain the mindset first before the actual question, so you can ...
2
votes
0answers
70 views

Do I have to include licenses of my libraries if I don't publish them?

Case 1: I'm currently developing a plugin for GPL Software/ am using the GPL-licensed API to develop the interaction between the plugin and the software. I'm therefore having a dependency added to ...
2
votes
0answers
89 views

Can I bake licensed dependencies (i.e. software under GPL) into a Docker image and keep the project MIT-licensed?

I'm a little new to the nuances of how licensing of software can propagate/affect other pieces of software so sorry if there's anything in the question that doesn't make sense. Basically though, I'm ...
3
votes
1answer
88 views

How can you check if your dependencies comply to their dependencies' licenses?

Like the top answer of this post says, let's say your project uses library M. M uses the MIT license and has dependencies G and A, which use GPLv2 and Apache2 respectively. As a result, M is not ...
1
vote
0answers
23 views

How to evaluate the reach of an open source project when there are 0 projects in its repo dependents?

I am constantly using open source projects during my work. Usually I view the dependents graph to see which other open source projects use it. However How do I gauge the reach of a project such as ...
2
votes
1answer
107 views

When using a dependency with an Apache license but has sub-dependencies under GPL, do I need to open source my own code?

When using a dependency with an Apache license but has sub-dependencies under GPL, do I need to open source my own code? Based on my own research, it appears I would have to abide by the full line of ...
1
vote
1answer
63 views

Is browser a dependency?

An application has a few links, where it needs to open a browser window. Does this mean the browser is a dependency and a liscence for the browser is needed?
0
votes
0answers
35 views

Is it ok to use React Navigation Stack/Drawer in your app when its dependency (@react-native-community/masked-view) does not have a license file?

I would like to use React Navigation in my React Native app which I would like to distribute in the Google Play Store. Both Stack and Drawer implementations of React Navigation have MIT licenses with ...
1
vote
0answers
20 views

What I should consider about licenses when starting a software project? [duplicate]

I'm trying to come up with all the license-related considerations I should think about when starting a software project from scratch. I believe taking into account the licenses of programming ...
1
vote
1answer
63 views

Any lasting licensing implications from previously used, subsequently dropped library dependencies or usage licenses?

I will start off with this excerpt from Qt's legal faq to give some context: 3.13. I have started development of a product using the open source version of Qt, can I now purchase a commercial ...
2
votes
1answer
44 views

Should I show the dependencies that I use

I am developing an open source project, but need to use a library. The library is open source, but I don’t know if I need to tell the user about the dependency. Do I have to show a license of the ...
3
votes
1answer
366 views

Sub-dependencies and code disclosure

I'm using in my code dependencies managed by npm. For example I'm using uglify-js which is using BSD license (which doesn't require code disclosure). But this plugin uses as dependency (so to my ...
2
votes
1answer
283 views

Can I use the EPL-licensed library (Paho) for a proprietary project and NOT disclose the source code of the project?

Can I use the Eclipse Paho library (licensed under EPL) for a proprietary project and NOT disclose the whole source code of that project? I'm not going to make any changes to Paho code, I just want ...
3
votes
1answer
386 views

Which licenses require that the third-party dependencies used by the licensed software are also open-source?

Some times I step into software that I believe that is fully-open-source, but then I discover that it actually contains a lot of dependencies (either by the same author, or by different authors) for ...
1
vote
0answers
79 views

What is the definition of "use" of an open source software?

Currently I'm going to publish my project on GitHub. It is initialized by some template in Visual Studio and developed with additional nuget packages, but I don't really understand what I did "use" ...
6
votes
1answer
712 views

Copyright of MIT licenced libraries usage within GPL licensed code

My software is completely written in python and has the following architecture of down cascaded dependencies. I plan to share my whole source code (FileA, FileB, FileC) next time in GitHub: FileA: ...
5
votes
1answer
849 views

What is the appropriate way to include third-party libraries copyright notice and permission notice in my project source code?

I am writing a web app based on react framework and I am using npm package manager. Together with transitive dependencies I have about 800 MIT licensed dependencies. To comply with MIT, do I need to ...
4
votes
1answer
1k views

Are we liable for license problems posed by transitive OSS libraries?

We (small team in large organisation, in Germany/EU) have the following situation: we use OSS libraries within our commercial products, licenses are checked and we are sure that we're complying (LGPL,...
0
votes
1answer
54 views

Third-party component licensing obligations, usage and obligations scale

I'm not sure if this question makes sense here although in my point of view it does. Otherwise I would be happy to post it in the right SO. Scope I would like to rise a few scenarios concerning ...
2
votes
1answer
82 views

Code generation, source-only dependencies and GPLv3

I'm building a Java annotation processor and looking for the correct license to use with respect to some requirements (see below). Basically, a user of this tool: depends on it during compilation (...
2
votes
0answers
314 views

Proper place to include the license of a dependency

I'm developing a GPLv3 project, and i need to use both the feather's icon set, licensed with MIT license, and the PyQt5 library with GPL. I don't need to rewrite or extend any content of the these ...
1
vote
1answer
496 views

Get the list of projects which depend on given library

Given that I have an open-source plugin, e.g. sweetalert2. How can I get the list of all open-source projects (on GitHub) with sweetalert2 dependency in package.json? There was similar functionality ...
3
votes
1answer
507 views

GNU Lesser General Public License with signed C# assembly

We have a closed source software written in C# that we sell. All of our assemblies are signed. We want to use a third party assembly, that is published under the GNU Lesser General Public License v2.1....
1
vote
1answer
679 views

Maven jar-with-dependencies - any violation of distribution license?

I have a Java application that uses some Apache common libraries (Apache 2.0 license). I wanted to distribute it as a single fat jar (maven builds a single jar with dependencies packaged in a single ...
5
votes
1answer
2k views

External libraries on GitHub

I have recently started using GitHub, as I was told that it is a good thing to do. However, I am wondering how to upload a certain project that uses external libraries. This project, made using Visual ...
5
votes
1answer
839 views

Release code with MIT dependencies under GPL

I am creating a game and want to release the code under a copyleft license (GPL 2 or 3). So far, so good, but there are multiple MIT-licensed library dependencies. Can I still release my code under ...
2
votes
1answer
167 views

Automated GPL download and installation in BSD project

I have a dependency on GPL-licensed library in the library I maintain. My library is BSD and must remain as such. Wondering if I can automate the download and installation of the GPL dependency in ...
4
votes
1answer
477 views

Should I credit indirect depended package in my open source credit notice too? [duplicate]

My project about to launch to public. So I'm preparing open source credit notice page. Since my project is developed in JavaScript, there's lots of node_modules in the development directory. Here's ...
7
votes
2answers
2k views

Should you give attributions to the libraries your library uses?

Let's say I use a x-library which I've found in GitHub and it uses MIT license. Sure, I could give attribution to it in my apps in the About > Licenses page. But what about the libraries that x-...
5
votes
1answer
312 views

When does a dependency imply a derivative work?

I'm building a program which gets certain info off the net, makes calculations, then sends the info to the net again. I don't program the 'taking off the net' and 'sending to the net' parts though; ...
5
votes
1answer
2k views

NPM - can I use module with MIT license, even if it requires submodule with CC-BY license?

as the title implies, I've installed some npm packages - all of which I've knowingly installed and requested are published under MIT, ISC, Apache 2, or other permissive license. However, some of ...
16
votes
2answers
5k views

What are software dependencies, and what are the implications of FLOSS dependencies for other projects?

How could I best explain software dependencies to a non-software, non-tech person? What are software dependencies, such as package dependencies or linking dependencies? And why does it matter to ...