find GPL with Bomdesk
This opens a sample lockfile already filtered to copyleft and restricted licences. One package is GPL, one is LGPL. Press Scan to fill in the licences the file leaves out.
- Paste package-lock.json or drop the file.
- Press Scan and read the copyleft rows first.
- Open a row to see how the licence expression was read.
- Decide with your legal contact what each one means for how you ship.
What to know
Copyleft licences ask that changes, and in some cases the program that includes the code, be shared under the same terms. Bomdesk sorts them into weak (LGPL, MPL, EPL: mostly the library itself), strong (GPL: the combined program) and network (AGPL: also when users reach it over a network). The sample shows a GPL-licensed editor build and an LGPL native library.
Two things change the picture and the page shows both. First, an OR gives you a choice: a package licensed GPL-3.0-or-later OR MIT is usable under MIT, so it is listed as permissive. Second, a dev-only dependency that never ships is marked dev, and the Pro policy tool can ignore it. How the code is linked and distributed matters for the final answer, which this page cannot judge.
A package whose licence cannot be identified is listed as Unknown, not as safe. Click any row to see how its licence expression was read and which SPDX identifiers it contains, so you can check the reading yourself before it goes into a report.
Updated · Cosmovex
Questions
Does GPL in node_modules mean my app must be GPL?
Not automatically. It depends on whether the code is distributed with your app, how it is combined, and the exact licence. Ask your legal contact; this page tells you where to look.
Why is a GPL OR MIT package marked permissive?
Because the licence lets you choose MIT. The raw expression is still shown on the row.
Are dev dependencies included?
They are listed and tagged dev. The Pro policy can ignore them.
Does AGPL differ from GPL here?
AGPL adds an obligation for software that users reach over a network, which is why it has its own class. Check with your legal contact how your product is delivered.
The free plan covers everything on this page. Bomdesk Pro ($19, paid once) is described on the Bomdesk page.
