Lockfile licence report
The licence_report tool reads your project's lockfiles and tells you, per dependency, which licence the package declares, its licence class (permissive, weak-copyleft, copyleft, none, unknown) and whether it is usable in closed-source software you sell. It can also write a CycloneDX 1.6 SBOM, an SPDX 2.3 document or a THIRD-PARTY NOTICES file to start from. It is being rolled out and is not yet enabled for every account.
Attribution evidence generated by JustClaw-It from the lockfiles you uploaded. It lists the licence each public package declares in its registry metadata (via deps.dev) at the time of the report. It is attribution evidence, not legal advice, licence clearance or certification; check each licence's terms.
Supported files
package-lock.json (and npm-shrinkwrap.json), pnpm-lock.yaml, yarn.lock (classic and Berry), poetry.lock, uv.lock, requirements.txt (only name==version lines are looked up; other lines are listed as "declared only"), go.mod, go.sum and Cargo.lock.
Formats and costs
| format | what you get | credits |
|---|---|---|
summary | counts per licence class, the packages that are not sellable as closed source (with the reason), unknown, private and pending lists | 0 |
cyclonedx | CycloneDX 1.6 JSON: every package with its purl, licence and the properties jc:licence_class and jc:sellable | 5 |
spdx | SPDX 2.3 JSON | 5 |
notice | THIRD-PARTY NOTICES text, grouped by licence, to review before you ship it | 5 |
One format per call. A document is refunded when the files cannot be parsed or contain no packages. The tool needs an API key or an account sign-in; it does not run keyless. On the website, signed-in accounts can run the free summary at /tools/licence-report.
How licences are classified
- The licence comes from the package's registry metadata via deps.dev, cached for 30 days.
- A dual licence (
MIT OR GPL-3.0-only) is classified by its most permissive option, and the report says so. - Several licences that all apply (
A AND B, or several listed licences) are classified by the most restrictive one. unknown(licence not recognised, or the package was not found) never counts as permissive and is never marked sellable.- Permissive and weak-copyleft packages are marked sellable (weak copyleft with file- or library-level obligations); copyleft, none and unknown are not.
Vulnerabilities
When package advisories are switched on, the summary also counts known advisories per resolved package version (OSV data); Pro accounts get the advisory detail.
Limits
- Up to 4 files per report, 2 MB each, 5,000 packages per report.
- 10 reports a day per account (100 on Pro), counted per UTC day.
- At most 500 live registry lookups per report; the rest are marked "pending — re-run later" (a re-run is served from the cache first).
- Parsing stops after 5 seconds.
Privacy
Your files are parsed in memory and never stored, logged or written to disk. We log only sizes, package counts, ecosystems, duration and credits. Only public package names and versions are looked up at deps.dev. Private packages (file:, link:, workspace:, git and path dependencies, private registries) are listed as "private — not looked up" and are never sent anywhere. We cannot always tell a private-registry package from a public one (pnpm and Yarn lockfiles often record a private registry exactly like the public one): list your private scopes in private_scopes (for example ["@acme", "github.com/acme"], or the field on the web form) and they are never looked up. A requirements.txt that names a non-PyPI index (--index-url, --extra-index-url, --find-links) is treated as private as a whole, and an npm package with no public resolved URL is never looked up.