Check licences through the whole graph, not the manifest
Licence incompatibility is predominantly a transitive property, so a check scoped to declared direct dependencies misses the majority of it — direct incompatibility rates ranged from 2.3% to 20.8% across seven registries while the indirect exposure sat underneath.
Do this firstPin every dependency to an exact version
Walk the resolved graph, not the manifest, and compare every licence against the one you ship under.
The reason to automate rather than review is depth. Nobody reads four hops down, the graph changes with every resolution, and the incompatibility that matters is usually introduced by a package your team has never heard of.
Two honest limits. This is a static comparison of declared licences: it does not establish that anyone was ever harmed, sued, or forced to relicense, and no study found here measures that. And when nine previously unknown incompatibilities were reported to maintainers, five were fixed — so even detection plus notification does not reliably produce remediation.
The decoy
Reviewing the licences of your direct dependencies. It is the review everyone actually does and it misses most of the exposure: 61.3% of license incompatibilities in one ecosystem-wide analysis came from transitive dependencies, and 6.62% of packages in another registry were violating the licence of an indirect dependency.
Evidence
- Understanding and Remediating Open-Source License Incompatibilities in the PyPI Ecosystem — II7.27% of package releases carried a licence incompatibility, and 61.3% of those were caused by transitive dependencies. When nine previously unknown incompatibilities were reported directly to maintainers, five were confirmed and fixed.
- License Incompatibilities in Software Ecosystems — IIDirect incompatibility rates ranged from 2.3% in one registry to 20.8% in another. Copyleft exposure is overwhelmingly indirect: direct incompatibilities from one strong copyleft licence peaked at 0.04%, while 6.62% of packages in another registry were violating that licence via an indirect dependency.
Last reviewed 2026-08-19.