We develop an application using npm with several third-party packages. Now we want to release our app to the public. That we have to reference the licenses of the packages should be self-evident. But this third-party packages are also using third-party packages itself. How should we handle this packages? Shall we include all of this "indirectly" used packages in our license notice also, or can we ignore them?


If the licences require you to reference them, then you should reference them all the way down. Your code still contains those other libraries, even if you're not importing them directly.

It's also worth checking that all of them are compatible with the way in which you intend to release your software.

Not all licenses require you to put any acknowledgement in your documentation.

  • 1
    You should also verify that all such packages are indeed required. Aside from reducing your installation size, removing unnecessary packages will make the licence checking that much easier.
    – Kain0_0
    Aug 8 '19 at 7:23

Not the answer you're looking for? Browse other questions tagged or ask your own question.