License exception - Alert

Information

The License Exception alert flags packages that designate a modification to the standard terms of an open-source license. Exceptions provide additional permissions (or sometimes restrictions) that override specific aspects of the base license. These exceptions can affect how the software can be used or how derivative works can be licensed.

Recommended actions

1. Review the License and Exception Terms

Carefully read the primary license and the associated exception. License exceptions often modify or limit the conditions of the base license in subtle ways.
Understand how the exception may impact your project’s use of the dependency, especially if you plan to distribute your software or link to proprietary code.

2. Assess Compatibility

Determine whether the exception affects your project’s licensing or distribution model. For example, an exception may allow linking with proprietary code, but it could also impose specific requirements that affect how you can distribute your software.
Ensure the exception doesn’t conflict with your project’s existing licenses or any third-party software you rely on.

3. Consult Legal or Licensing Experts

If the exception is unfamiliar or the licensing terms are complex, consult your legal team or a licensing expert. They can help you assess the potential risks and determine the best course of action for your project.

4. Consider Alternatives

If the license exception poses risks or creates legal uncertainty, explore alternative packages with more permissive or compatible licenses.
Switching to a package with a more standard license can help avoid potential compliance issues down the road.

Examples

Here's an example of a package with a license exception bearing the LLVM-exception ID. It is licensed under the Apache License v2.0 with LLVM Exceptions.

Detection Method

Packages are flagged with a License Exception alert when a license paired with some kind of exception was detected. Because license exceptions are rare and may change the terms of the base license in unpredictable ways, the appearance of an exception is its own alert.

In order to determine a package's licensing, Socket checks a few different sources. The main ones are (1) looking in something that's explicitly a LICENSE file, (2) looking for ecosystem-specific values in manifest files (package.json, pyproject.toml, gemfiles, etc.), (3) checking the license metadata that is available through the package registry, and (4) looking for copyright headers in source code files.

Additional resources

SPDX - List of Known License Exceptions

Understanding License Exceptions: What Developers Need to Know

GNU License Exceptions – A detailed explanation of how license exceptions work in GNU licenses

On Selling Exceptions to the GNU GPL - FSF article by Richard Stallman