May I and should I include my dependencies in the jar i publish online?

Question

I'm developing a java project that I'd eventually like to publish and make open source.

To make a executable jar file I use the maven-assembly-plugin. This includes my dependencies in the jar, which makes it easy to deploy as the user (currently only me) doesn't have to add the dependency jars in a different lib/ folder or something along those lines. For my personal use I don't think there should be any issue there.

Once I publish my project, how should I go about this?

I found many questions talking about how to accomplish a executable jar (on stackoverflow), but none talking about the fact whether I should or shouldn't publish it.

My main questions are the following:

1. Is it legal to republish the dependencies in the jar directly in the same form as the maven-assembly-plugin produces the jar or do I have to include the licenses manually (e.g. Apache License 2.0) if my whole project is licensed under some more restrictive license?
2. Is it good practice to republish the dependencies or should I let each user build their own version based on the pom.xml? In my opinion, aside from the legal aspect (if question 1 would be answered with yes or for self-authored dependencies where licensing is not an issue), it feels like a redundant copy of the dependency just for the sake of simplicity for the end user. Not sure if I should feel good about this.
3. If question 1 and question 2 would be answered with yes, can I put the runnable jar on maven central (or github packages etc.) or only on my own personal website/ as an artifact in a github release?

I'm not entirely sure if this question is on-topic here, but I found other questions related to licensing and questions related to maven, so I figured a combination should fit as well. If I'm wrong feel free to mark as off-topic and please leave me a comment which tells me in which stackexchange network this would be on-topic.

Answer 1

1. You may by all means distribute third-party dependencies in your jar file provided you comply with all their licences. This can be done in your release notes or in a separate file on licensing which lists all the included dependencies and their licences, with links to the licences and, if you are inclined, their source code to forestall anyone asking you for it.

2. Whether this is good practice really depends on your target user. If you anticipate your package to be used by Java developers, you can leave the dependencies out with the expectation that they can figure out how to resolve them. If your package will be used by non-programmers, it is best to make installation as simple as possible and bundling the dependencies could be very helpful.

3. Anecdotally, I have published a jar file that included its dependencies within it, but the dependencies were all written by me and part of the same project. In practice, my decision would be based in part on how much the jar file grows with the dependencies, although I can’t provide a threshold size.