rollup-plugin-license
Advanced tools
Rollup plugin to add license banner to the final bundle and output third party licenses
Rollup plugin that can be used to:
Install the plugin with NPM:
npm install --save-dev rollup-plugin-license
Then add it to your rollup configuration:
const path = require('path');
const license = require('rollup-plugin-license');
module.exports = {
plugins: [
license({
sourcemap: true,
cwd: process.cwd(), // The default
banner: {
commentStyle: 'regular', // The default
content: {
file: path.join(__dirname, 'LICENSE'),
encoding: 'utf-8', // Default is utf-8
},
// Optional, may be an object or a function returning an object.
data() {
return {
foo: 'foo',
};
},
},
thirdParty: {
includePrivate: true, // Default is false.
includeSelf: true, // Default is false.
multipleVersions: true, // Default is false.
output: {
file: path.join(__dirname, 'dist', 'dependencies.txt'),
encoding: 'utf-8', // Default is utf-8.
},
},
}),
],
}
The banner file can be a text file and it will be converted to a block comment automatically if needed.
Note that the content will be translated to a lodash template with the following data model:
pkg: The content of the project package.json.dependencies: An array of all the dependencies included in the bundle.moment: The moment object._: The lodash object.data A custom data object, defined in banner options.Here is a valid banner:
Bundle of <%= pkg.name %>
Generated: <%= moment().format('YYYY-MM-DD') %>
Version: <%= pkg.version %>
Dependencies:
<% _.forEach(dependencies, function (dependency) { %>
<%= dependency.name %> -- <%= dependency.version %>
<% }) %>
Since version 0.10.0, it is possible to customize banner style using the commentStyle option:
license({
banner: {
commentStyle: 'regular', // The default
content: {
file: path.join(__dirname, 'LICENSE'),
},
},
})
Following options are available:
regular: "classic" comment block is used (this is the default), for example:/**
* This is the `regular` style.
*/
ignored: a comment block with prefix ignored by minifiers, for example:/*!
* This is the `ignored` style.
*/
slash: banner is prepended using "slash" comments, for example://
// This is the `slash` style.
//
none: nothing done, be careful to prepenbd a banner already "commented".Since version 0.3.0, banner can be a simple string that will be used directly:
const license = require('rollup-plugin-license');
module.exports = {
plugins: [
license({
banner: `Copyright <%= moment().format('YYYY') %>`,
}),
],
}
If you want to add some options to banner (such as the comment style to use), and still define it as a string (insead of pointing to a file), you can also define the banner like this (since version 0.11.0):
const license = require('rollup-plugin-license');
module.exports = {
plugins: [
license({
banner: {
content: `Copyright <%= moment().format('YYYY') %>`,
commentStyle: 'ignored',
},
}),
],
}
Until version 0.10.0, banner file was defined as:
const path = require('path');
const license = require('rollup-plugin-license');
module.exports = {
plugins: [
license({
banner: {
file: path.join(__dirname, 'LICENSE'),
encoding: 'utf-8',
},
}),
],
};
This format has been deprecated with version 0.11.0 and removed with version 1.0.O, and the banner file should be defined inside banner.content entry:
const path = require('path');
const license = require('rollup-plugin-license');
module.exports = {
plugins: [
license({
banner: {
content: {
file: path.join(__dirname, 'LICENSE'),
encoding: 'utf-8',
},
},
}),
],
};
A file containing a summary of all dependencies can be generated automatically using the following options:
license({
thirdParty: {
output: path.join(__dirname, 'dist', 'dependencies.txt'),
includePrivate: true, // Default is false.
},
})
Starting with version 0.12.0, you can have more control by defining output as an object, for example:
license({
thirdParty: {
includePrivate: false,
output: {
file: path.join(__dirname, 'dist', 'dependencies.txt'), // Path of the license report
encoding: 'utf-8', // default is UTF-8
// Template function that can be defined to customize report output
template(dependencies) {
return dependencies.map((dependency) => `${dependency.name}:${dependency.version} -- ${dependency.license}`).join('\n');
},
},
},
})
Note that the template option can also be a lodash template:
license({
thirdParty: {
includePrivate: false,
output: {
file: path.join(__dirname, 'dist', 'dependencies.txt'),
// Lodash template that can be defined to customize report output
template: `
<% _.forEach(dependencies, function (dependency) { %>
<%= dependency.name %>:<%= dependency.version%> -- <%= dependency.license %>
<% }) %>
`,
},
},
})
For example, it can be relatively easy to produce a JSON output instead of a text file:
license({
thirdParty: {
includePrivate: false,
output: {
file: path.join(__dirname, 'dist', 'dependencies.json'),
template(dependencies) {
return JSON.stringify(dependencies);
}
},
},
})
By default, the "self" package is ignored (by "self", we mean the package being built), but startint with version 3.4.0, you can force inclusion using the includeSelf option:
license({
thirdParty: {
includeSelf: true,
output: {
file: path.join(__dirname, 'dist', 'dependencies.json'),
template(dependencies) {
return JSON.stringify(dependencies);
}
},
},
})
Starting with version 0.13, it is possible to ensure that dependencies does not violate any license restriction. For example, suppose you want to limit dependencies with MIT or Apache-2.0 licenses, simply define the restriction such as:
license({
thirdParty: {
allow: '(MIT OR Apache-2.0)',
},
})
Note that the allow value here should be a valid SPDX pattern (more information here).
The allow option here will print a warning to the console for all license violation. Note that, if you want more control, it can also be defined as function:
license({
thirdParty: {
allow(dependency) {
return dependency.license === 'MIT';
},
},
})
The function defined here allow only MIT licenses, and will print a warning for anything else.
Finally, if emitting a warning is not enought for you, you can also choose to fail the build:
license({
thirdParty: {
allow: {
test: 'MIT', // Or a function that should returns `true` or `false`
failOnUnlicensed: true, // Fail if a dependency does not specify any licenses, default is `false`
failOnViolation: true, // Fail if a dependency specify a license that does not match given requirement, default is `false`
},
},
})
Starting with version 3.1.0, you can also use the multipleVersions option to track dependencies in different version as a different dependency.
It can be particularly useful in case a dependency changed its license between two versions.
Note that this option is false by default (mainly to keep backward compatibility).
license({
thirdParty: {
includePrivate: false,
multipleVersions: true,
output: {
file: path.join(__dirname, 'dist', 'dependencies.txt'), // Path of the license report
encoding: 'utf-8', // default is UTF-8
template(dependencies) {
return dependencies.map((dependency) => `${dependency.name}:${dependency.version} -- ${dependency.license}`).join('\n');
},
},
},
})
includePrivate flag (see comment).multipleVersions option is correctly validated (#1682)thirdParty.multipleVersions option (#1528)LICENCE or LICENSE files (PR), thanks @codepunkt!output configuration (see #379).thirdParty.encoding option.NULL character (see #1).sourceMap option (use sourcemap option in lowercase) to keep it consistent with rollup.cwd option to specify custom working directory (optional option).commenting dependency.sourcemap option).sourcemp is used instead of the "global" one in rollup options.moment).magic-string).MIT License (MIT)
If you find a bug or think about enhancement, feel free to contribute and submit an issue or a pull request.
FAQs
Rollup plugin to add license banner to the final bundle and output third party licenses
The npm package rollup-plugin-license receives a total of 61,751 weekly downloads. As such, rollup-plugin-license popularity was classified as popular.
We found that rollup-plugin-license demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
Bybit's $1.46B hack by North Korea's Lazarus Group pushes 2025 crypto losses to $1.6B in just two months, already surpassing all of 2024's $1.49B total.
Security News
OpenSSF has published OSPS Baseline, an initiative designed to establish a minimum set of security-related best practices for open source software projects.
Security News
Michigan TypeScript founder Dimitri Mitropoulos implements WebAssembly runtime in TypeScript types, enabling Doom to run after processing 177 terabytes of type definitions.