Nagging Mario's Princess

    webpack-license-plugin
    TypeScript icon, indicating that this package has built-in type declarations

    4.2.2 • Public • Published


    webpack-license-plugin logo
    webpack-license-plugin

    Manage third-party license compliance in your webpack build

    Continuous integration status Code coverage Known vulnerabilities License: MIT Contact on Twitter

    Key FeaturesInstallationHow to useAvailable optionsExamples

    Key features

    This plugin extracts open source license information about all of the npm packages in your webpack output and helps you identify and fix problems with your open source licensing policy.

    This plugin has full test coverage and is tested with webpack 2, 3, 4 and 5. It will help you:

    • Discover every npm package used in your webpack output
    • Find out how it is licensed
    • Cancel builds that include unacceptable licenses
    • Exclude internal packages from being scanned
    • Create a customized inventory (usually called bill of materials) in json, html, csv or other formats

    Installation

    Install webpack-license-plugin as a development dependency to your current project

    npm

    npm install -D webpack-license-plugin

    yarn

    yarn add -D webpack-license-plugin

    How to use

    Use webpack-license-plugin in your webpack configuration by adding it to the plugins array.

    const LicensePlugin = require('webpack-license-plugin')
    
    module.exports = {
      plugins: [
        // there might be other plugins here
        new LicensePlugin()
      ],
    }

    Available options

    Options are given as an Object to the first parameter of the LicensePlugin constructor:

    new LicensePlugin({ outputFilename: 'thirdPartyNotice.json' })

    The available options are:

    Name Description
    additionalFiles Default: {}. Object that defines additional files that should be generated by this plugin based on it's default output (e.g. an html representation of the licenses in addition to the generated json). Keys represent filenames, values are functions that get invoked with the packages array and should return the content written to the additional file. These functions can be async or return a Promise.
    excludedPackageTest A method to exclude packages from the process. It is invoked with packageName (string) and version (string) of every package and should return true to exclude the package.
    licenseOverrides Default: {}. Object with licenses to override. Keys have the format <name>@<version>, values are valid spdx license expressions. This can be helpful when license information is inconclusive and has been manually checked.
    outputFilename Default: oss-licenses.json. Path to the output file that will be generated. Relative to the bundle output directory.
    replenishDefaultLicenseTexts Default: false. When this is enabled, default license texts are taken from spdx.org for packages where no license text was found.
    unacceptableLicenseTest A method to define license identifiers as unacceptable. It is invoked with licenseIdentifier (string) for every package and should return true when the license is unacceptable and encountering it should fail the build.
    includePackages Default: () => []. A method to define packages that should always be included in the output. It must return an array containing the absolute paths of those packages. This function can be async or return a Promise.

    Example with custom options

    This example writes the result to a file named meta/licenses.json in the output directory, fails whenever it encounters one of the given licenses and overrides the license of the package fuse.js@3.2.1.

    const LicensePlugin = require('webpack-license-plugin')
    
    module.exports = {
      // ...
      plugins: [
        new LicensePlugin({
          excludedPackageTest: (packageName, version) => {
            return packageName.startsWith('@internal/')
          },
          licenseOverrides: {
            // has "Apache" in package.json, but Apache-2.0 text in LICENSE file
            'fuse.js@3.2.1': 'Apache-2.0'
          },
          outputFilename: 'meta/licenses.json',
          unacceptableLicenseTest: (licenseIdentifier) => {
            return ['GPL', 'AGPL', 'LGPL', 'NGPL'].includes(licenseIdentifier)
          }
        }),
      ],
    }

    Default output

    The output is a oss-licenses.json file in the webpack build output directory. It contains an array of packages that were found to be part of the webpack output and lists several license-related details for every package:

    Name Description
    name package name
    version package version
    author author listed in package.json (if available)
    repository repository url listed in package.json (if available)
    source package tarball url on npm registry
    license the license listed in package.json. If this is not a valid spdx license expression, this plugin will inform you. You can then inform the package maintainers about this problem and temporarily workaround this issue with the licenseOverrides option for the specific combination of package name and version.
    licenseText the license text read from a file matching /^licen[cs]e/i in the package's root

    Example output file

    [
      {
        "name": "fbjs",
        "version": "0.8.17",
        "repository": "https://github.com/facebook/fbjs",
        "source": "https://registry.npmjs.org/fbjs/-/fbjs-0.8.17.tgz",
        "license": "MIT",
        "licenseText": "..."
      },
      {
        "name": "object-assign",
        "version": "4.1.1",
        "author": "Sindre Sorhus",
        "repository": "https://github.com/sindresorhus/object-assign",
        "source": "https://registry.npmjs.org/object-assign/-/object-assign-4.1.1.tgz",
        "license": "MIT",
        "licenseText": "..."
      },
      {
        "name": "react-dom",
        "version": "16.4.2",
        "repository": "https://github.com/facebook/react",
        "source": "https://registry.npmjs.org/react-dom/-/react-dom-16.4.2.tgz",
        "license": "MIT",
        "licenseText": "..."
      },
      {
        "name": "react",
        "version": "16.4.2",
        "repository": "https://github.com/facebook/react",
        "source": "https://registry.npmjs.org/react/-/react-16.4.2.tgz",
        "license": "MIT",
        "licenseText": "..."
      }
    ]

    Examples

    additionalFiles examples

    When the additionalFiles option is set, the output shown above is passed into the transform function as an array for every additional file configured.

    This way, the output can be formatted to any format you might need and then be written to one or more additional files.

    Package list as CSV

    const LicensePlugin = require('webpack-license-plugin')
    
    const csvTransform = (packages) => {
      const keys = ['name', 'version', 'license']
    
      return [
        '"sep=,"',
        keys.join(','),
        ...packages.map(pckg => keys.map(key => `="${pckg[key]}"`).join(',')),
      ].join('\n')
    }
    
    module.exports = {
      // ...
      plugins: [
        new LicensePlugin({
          additionalFiles: {
            'oss-licenses.csv': csvTransform
          }
        }),
      ],
    }

    Package list and additional summary

    const LicensePlugin = require('webpack-license-plugin')
    
    module.exports = {
      // ...
      plugins: [
        new LicensePlugin({
          additionalFiles: {
            'oss-summary.json': packages => {
              return JSON.stringify(
                packages.reduce(
                  (prev, { license }) => ({
                    ...prev,
                    [license]: prev[license] ? prev[license] + 1 : 1,
                  }),
                  {}
                ),
                null,
                2
              )
            },
          },
        }),
      ],
    }

    Install

    npm i webpack-license-plugin

    DownloadsWeekly Downloads

    27,530

    Version

    4.2.2

    License

    MIT

    Unpacked Size

    1.21 MB

    Total Files

    146

    Last publish

    Collaborators

    • cwer