6

My project about to launch to public. So I'm preparing open source credit notice page. Since my project is developed in JavaScript, there's lots of node_modules in the development directory.

Here's question. Could I reference the packages only if I directly deepened in my package.json? My project referenced only 25 packages in package.json but there's 300+ packages in my node_modules/ directory.

Some packages like gulp-* is referenced as devDependencies and clearly not included in the final dist of my project. So I think I could omit credit for these packages.

I'm not sure about indirect referenced packages. Let say package A depends on package B and my project depends on only A. In this case my dist contains both A and B. Could I omit credit for package B?

yanhkim
  • 63
  • 5
  • Is this a project that you redistribute as a whole? e.g. do you include the pre-fetched node modules in your redistribution? Check also this on the deps side: http://opensource.stackexchange.com/a/4315/947 – Philippe Ombredanne Apr 02 '17 at 17:58
  • Yes, it's frontend project. So packages are bundled and minimized then redistributed to end user. – yanhkim Apr 03 '17 at 02:22
  • @Zimmi48 I couldn't find that question. Thanks! – yanhkim Apr 03 '17 at 13:30

1 Answers1

5

You added this important comment:

it's frontend project. So packages are bundled and minimized then redistributed to end user.

So the answer to:

Should I credit indirect depended package in my open source credit notice too?

... is a clear YES.

Since you are redistributing your code with directs deps, and with deps of deps, and with deps of deps of deps and ...... you have to comply with the license requirements of all the packages A. I explained in this other answer some of the specifics of dealing with package dependencies:

You need to know:

  • The whole chain of program or package dependencies
  • The purpose and use of each program or package in that chain (test, tool, runtime)
  • Which dependent are shipped and redistributed with your product, application or library vs. which may be installed by your user
  • The license of each dependency in this chain

Anything that would not be redistributed (e.g. devDependencies in the case of npms) does not have to be included.

If there is any code using some copyleft license you may have also source code redistribution requirements. And depending on the licenses and the way you integrate with these copyleft-licensed packages this requirement may extend to the tools used for minification and to possibly your own source code or other packages in the dependencies tree.

Community
  • 1
Philippe Ombredanne
  • 14,441
  • 2
  • 32
  • 87