Automation is of course very helpful. But my point wasn't about transitive deps (directly). The point is about pulling something new into your project. At the

Automation is of course very helpful. But my point wasn't about transitive deps (directly). The point is about pulling something new into your project. At the point you include something that something needs to tell you the license for itself and for all its dependencies. If it doesn't that's already fishy in its own rights (and you should turn back or start investigating for real). You need to look at the provided license lists of course. Yes, I see more and more projects that don't list licenses for their deps. But that's usually already a license volition on its own! You can't use something like that, it's obviously problematic. Having some tools that download random stuff form the internet may be OK when you're doing something for yourself. But at the moment you want to publish that something you're obligated to check the licenses. That's a know thing. If you don't that's very shoddy work, and actually you could get sued for all resulting damages. So no matter what it's actually impossible to include code with a problematic license, given no botchers were involved anywhere deeper in the chain. And here we're at the core of what I've said: It's completely baffling to me how something like that could possibly happen. At least as long as I try to believe that no complete idiots work in the industry, people who aren't even capable of reading, and don't know even the most basic things about the job they try to do. People that therefore shouldn't be allowed to touch anything as they could create great danger for their surroundings and for themself! But OK, maybe I just have to accept that the software industry is not different to this here: https://www.youtube.com/watch?v=FfyPLTIn2D8 https://www.youtube.com/watch?v=FfyPLTIn2D8