Change:
<!-- Do Not Delete This! featurerequesttemplate --<!-- Please read our Rules of Conduct: --<!-- Please search existing issues to avoid creating duplicates. --<!-- Describe the feature you'd like. --Greetings, I need to know all the dependencies vscode does have, recursively until I hit the transitive closure. I also need to know the version/license of each one of these dependencies. By dependencies I mean any piece of software it does require to run, whether is something you install at the OS level with, a bundled component/library, a nodejs/yarn package, a vscode internal extension, etc. Essentially, I want to know all the dependencies regardless of the "layer" at which these dependencies get used. I suspect the following resources sort of overlap with my request: But not sure if any of them is recursive my nature, and whether the union of all of the them gives me what I want. Would be great if Microsoft can compile a separate file containing all that information. It will help with adoption of vscode within organizations. Thanks. PS: It would be great to have such list for both open-source vscode and the Microsoft build.
By the way, to avoid duplication of work, I would like to share that I have asked earlier same question on StackOverflow: But later on I realized that filing my request here would get more traction. On any case, I will be happy to provide more information if my request is not entirely clear. Thanks in advance
In the VS Code installation directory, you can find two files which list the licenses of the third party software that is distributed with VS Code: and . In the root of this repository, you can find a file called which contains the third party software that is incorporated in this repository.
Hi Alex, Thanks for you reply. Could you also clarify whether, for the case of VS Code, those two files are the transitive closure of the dependencies? Meaning that they cover all recursive dependencies. If they do not, please share up to what level they include. Another question I have is whether these 3 files: should be also considered. They seem to mention stuff that is not present on the files you mentioned. Saludos + regards.
In the VS Code installation directory, the two files and contain the licenses of all third party software distributed with VS Code. Note that the file present in the VS Code installation directory is not equal to the from the root of this repository. Could you please give a specific example of what is missing?
Hello Alex, Thanks for clarifying that the included with VS Code, is a super-set of that included for the OSS repo. I will focus next questions on the VS Code one. Just to finish the point about these dependencies being recursive or not, please confirm the following: say VS Code requires component X, which in turn needs Y which in turn needs Z. So we have a chain of depth 3 for these dependencies: X -Y -Z. The three dependencies X, Y and Z will be mentioned either on or , is that the case? If it is, will this generalize to any depth of the dependency chain? And finally on the example of something missing at , let us take very first entry: { // Reason: The license at // does not include a clear Copyright statement and does not credit authors. "name": "jschardet", "prependLicenseText": [ "Chardet was originally ported from C++ by Mark Pilgrim. It is now maintained", " by Dan Blanchard and Ian Cordasco, and was formerly maintained by Erik Rose.", " JSChardet was ported from python to JavaScript by António Afonso ", " () and transformed into an npm package by ", "Markus Ast ()" ] }, jschardet does not seem mentioned on nor Same thing seem to happen for any other name mentioned on or Perhaps I am misinterpreting the content of those files, but they seem like dependencies to me and hence wondered if they should be considered as well if I want to gather the whole set. Thank you.
Hello Alex, Any further comments? I want to call it a day but those pending question prevent proper sleep :-} Thanks.
jschardet is in , but make sure you're looking at the one for the installed program, rather than the one in this repository. In the Windows system install, for example, the file is in the folder.
You are absolutely right, Alex. I was searching with an editor and that did not bring any result, but grepping did. Still, I can see these 5 dependencies in [] but not on Please also comment about the recursivity question. Thanks again.
Hi, this is Raymond. I think the dependencies listed do form a transitive closure, considering how even shows up in the generated file for . As for the five dependencies, is in the generated file of the latest Insiders. The generated file you are seeing might be for the latest stable version, instead. I noticed that isn't in the generated , but it's also not used in the lockfile. In the best case, that means the notices file generator is trimming libraries that aren't being used in the product. But, is also not in the latest generated notices
Hi Raymond, Thank you for confirming that generated does contain the transitive closure of dependencies, indeed. As for the missing ones, it may be good to re-generate to ensure it does include any missing piece (if any). Cheers
I see that is missing from , thank you for raising that. We will correct this ASAP.
Great, thank you Alex, Raymond and everyone involved. Great support, super responsive.

Discussion:
] }, { <del> // Reason: Waiting for https://github.com/segmentio/noop-logger/issues/2 "name": "noop-logger", "fullLicenseText": [ "This project is licensed under the MIT license.", "Copyrights are respective of each contributor listed at the beginning of each definition file.", "", "Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions:", "", "The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software.", "", "THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE." ] }, { </del> // Reason: The license at https://github.com/rbuckton/reflect-metadata/blob/master/LICENSE // does not include a clear Copyright statement (it's in https://github.com/rbuckton/reflect-metadata/blob/master/CopyrightNotice.txt). "name": "reflect-metadata",

}, { // Reason: Repository lacks license text. <del> // https://github.com/othiym23/emitter-listener/blob/master/package.json declares BSD-2-Clause. // https://github.com/othiym23/emitter-listener/issues/3 "name": "emitter-listener", "fullLicenseText": [ "BSD 2-Clause "Simplified" License", "Copyright (c) 2018, Forrest L Norvell <ogd@aoaioxxysz.net>", "", "Redistribution and use in source and binary forms, with or without", "modification, are permitted provided that the following conditions are met:", "", "1. Redistributions of source code must retain the above copyright notice, this", "   list of conditions and the following disclaimer.", "2. Redistributions in binary form must reproduce the above copyright notice,", "   this list of conditions and the following disclaimer in the documentation", "   and/or other materials provided with the distribution.", "", "THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND", "ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED", "WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE", "DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR", "ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES", "(INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;", "LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND", "ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT", "(INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS", "SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE." ] }, { // Reason: Repository lacks license text. </del> // https://github.com/tjwebb/fnv-plus/blob/master/package.json declares MIT. // https://github.com/tjwebb/fnv-plus/issues/14 "name": "@enonic/fnv-plus",

] }, { <del> // Reason: This product includes AVC coding technology. MPEG LA LLC requires this notice. "name": "H.264/AVC Video Standard", "fullLicenseText": [ "This product is licensed under the AVC patent portfolio license for the personal", "and non-commercial use of a consumer to (i) encode video in compliance with the AVC standard ("AVC VIDEO")", "and/or (ii) decode AVC video that was encoded by a consumer", "engaged in a personal and non-commercial activity and/or was obtained from a video provider", "licensed to provide AVC video. No license is granted or shall be implied for any other use.", "Additional information may be obtained from MPEG LA LLC. See http://www.MPEGLA.COM.", "", "For clarification purposes, this notice does not limit or inhibit the use of the product", "for normal business uses that are personal to that business which do not include", "(i) redistribution of the product to third parties, or", "(ii) creation of content with AVC Standard compliant technologies for distribution to third parties." ] }, { </del> // Reason: Missing license file "name": "@tokenizer/token", "fullLicenseText": [

}, { "component": { <ins> "type": "other", "other": { "name": "H.264/AVC Video Standard", "downloadUrl": "https://chromium.googlesource.com/chromium/third_party/ffmpeg", "version": "4.4.git" } }, "licenseDetail": [ "This product is licensed under the AVC patent portfolio license for the personal", "and non-commercial use of a consumer to (i) encode video in compliance with the AVC standard ("AVC VIDEO")", "and/or (ii) decode AVC video that was encoded by a consumer", "engaged in a personal and non-commercial activity and/or was obtained from a video provider", "licensed to provide AVC video. No license is granted or shall be implied for any other use.", "Additional information may be obtained from MPEG LA LLC. See http://www.MPEGLA.COM.", "", "For clarification purposes, this notice does not limit or inhibit the use of the product", "for normal business uses that are personal to that business which do not include", "(i) redistribution of the product to third parties, or", "(ii) creation of content with AVC Standard compliant technologies for distribution to third parties." ], "version": "H.264 (08/21)", "isOnlyProductionDependency": true, "license": "OTHER" }, { "component": { </ins> "type": "git", "git": { "name": "nodejs",