Node (npm) package licensing

Originally published at http://blog.mp3monster.org on July 5, 2022.

When building Node solutions, even if you’re not going to publish the code to a public repository you’re likely to be using package.json to declare the dependencies for your app. Doing this makes it easier to build and deploy a utility. But if you’re conversant with several languages there is a tendency to just adapt your existing skills to work with others. The downside of this is small tooling nuances can catch you off guard and consume time while figuring them out. The workings of packages with NPM (as shown below) is one possible case.

{ "name": "graph-svr", "version": "1.0.0", "description": "packages needed for this service", "main": "index.js", "type": "module", "scripts": { "start": "node index.js" }, "dependencies": { "@graphql-tools/graphql-file-loader": "^7.3.11", "@graphql-tools/load-files": "^6.5.4", "@graphql-tools/schema": "^8.3.10", "@graphql-yoga/node": "^2.4.1", "apollo-datasource-rest": "^3.5.2", "apollo-server": "^3.6.7", "graphql": "^16.4.0", "graphql-tools": "^8.2.8" }, "author": "Phil Wilkins", "license": "MIT" }

If you create the package.json using npm init to create the initial version of the file, it is fairly common to set values to default. In the case of the license, this is an ISC license. This is easily forgotten. The problem here is twofold:

• Does the license set reflect the constraints of the dependencies and their licenses
• Does the default license reflect the position you want?

Looking at the latter point first, This is important as organizations have matured (and tooling greatly improved) when it comes to understanding how open source licensing can impact. This is particularly important for any organizations leveraging open source as part of their revenue generating activities either ‘as a service’ but also selling software solutions. If you put the wrong license here the license checking tools often protecting code repositories may reject your code, even in internal only use cases (yes this tripped me up).

To help overcome this issue you can install a tool that will analyze the dependencies and optionally their dependencies and report back on your license exposure. This tool is called license-report. Once installed ( npm install -g license-report) we just need to point the tool to the package.json file. e.g. license-report package.json. We can make the results a lot more consumable by outputting the content in a number of formats. For example a simple text value:

From this, you could set your license declaration in package.json or validate that your preferred license won’t conflict,

Originally published at http://blog.mp3monster.org on July 5, 2022.