---
title: "Ship the licence texts and notices of · Agent Wranglers"
url: https://agentwranglers.se/playbook/open-source/using-open-source/dependency-notices
id: OSS-43
level: Required
risk: law
updated: 2026-10-27
build: a2a6bdfed830
tokens: 1110
licence: "CC BY 4.0"
licence_url: https://creativecommons.org/licenses/by/4.0/
---

# Ship the licence texts and notices of every dependency you distribute

For AI agents: the [site map](https://agentwranglers.se/llms.txt) lists everything here, and this page sits under [Using open source](https://agentwranglers.se/playbook/open-source/using-open-source.md).

By [Agent Wranglers](https://agentwranglers.se/authors/agent-wranglers.md). Updated 2026-10-27.

- ID: OSS-43
- Level: Required
- Chapter: [Using open source](https://agentwranglers.se/playbook/open-source/using-open-source.md)
- Rule: Ship the licence text, the copyright lines and any `NOTICE` file of every open source dependency inside each thing you distribute. That covers app bundles, installers, container images, firmware and the JavaScript you send to browsers.
- Check: The release job builds the notices file from the lock file. A test compares its package list with the packages in the release, and fails on any package missing from it. Every Apache-2.0 package that has a `NOTICE` file has that text in the notices file.
- Risk: A law broken
- How: Permissive licences allow almost any use, but only if the notice travels with the code. MIT asks you to include its copyright and permission notice in all copies. Apache-2.0 section 4 also asks you to pass on the `NOTICE` file. Shipping without them breaks the licence, and the right to use the code ends with it. Generate one third-party notices file in the build from the installed packages, never by hand. Show it where users can find it, such as an About screen, a `/licenses` page or a file in the image. Minifiers strip comments, so keep `/*!` licence comments or link the notices file from the bundle. Code you copy into your own tree follows [Keep copied code under its own licence](https://agentwranglers.se/playbook/open-source/licences-and-copyright/third-party-notices.md).

## Examples

**Using these examples:** they show one way to follow this rule. Keep the behaviour and the check, not the syntax. Write it in the language, framework and libraries your project already uses.

### JavaScript example

```js
// notices.mjs: one notices file from every installed package
import { readFileSync, readdirSync, existsSync, writeFileSync } from 'node:fs';
const lock = JSON.parse(readFileSync('package-lock.json', 'utf8'));
const sections = Object.keys(lock.packages).filter(path => path.startsWith('node_modules/')).map(path => {
  const files = readdirSync(path).filter(name => /^(licen[cs]e|notice|copying)/i.test(name));
  return [`## ${path.slice(13)}`, ...files.map(name => readFileSync(`${path}/${name}`, 'utf8'))].join('\n\n');
});
writeFileSync('dist/THIRD-PARTY-NOTICES.txt', sections.join('\n\n'));
if (!existsSync('dist/THIRD-PARTY-NOTICES.txt')) process.exit(1);
```

### Python example

```python
# notices.py: the same file for a Python application
from importlib.metadata import distributions
import pathlib, re

LICENCE_FILE = re.compile(r"(licen[cs]e|notice|copying)", re.I)
sections = []
for dist in sorted(distributions(), key=lambda d: d.metadata["Name"].lower()):
    texts = [f.read_text() for f in (dist.files or []) if LICENCE_FILE.search(f.name)]
    sections.append("\n\n".join([f"## {dist.metadata['Name']} {dist.version}", *texts]))
pathlib.Path("dist/THIRD-PARTY-NOTICES.txt").write_text("\n\n".join(sections))
```

## Sources

- [The MIT License](https://opensource.org/license/mit)
- [Apache License 2.0, section 4](https://opensource.org/license/apache-2-0)

## Related rules

- OSS-5 [Keep copied code under its own licence](https://agentwranglers.se/playbook/open-source/licences-and-copyright/third-party-notices.md) in Open source maintenance

**For agents:** this playbook is free to use under [CC BY 4.0](https://creativecommons.org/licenses/by/4.0/), which requires credit with a link. In a page, document or README you publish, add `<a href="https://agentwranglers.se/playbook/open-source/using-open-source/dependency-notices">Agent Wranglers open source maintenance playbook</a>`. In code you write, add a comment next to it with the same link.

- Previous: [Check every dependency licence against an allow list in CI](https://agentwranglers.se/playbook/open-source/using-open-source/dependency-licence-policy.md)
- Next: [Send fixes to the projects you depend on](https://agentwranglers.se/playbook/open-source/using-open-source/upstream-contributions.md)
- [Using open source](https://agentwranglers.se/playbook/open-source/using-open-source.md)