DailyTM is sold under a commercial licence (LICENSE). It depends on third-party open-source packages, which are not covered by that licence and remain governed by their own. This document is the dependency review a sale asks for: it confirms that nothing in the dependency tree forbids including it in a sold product whose source is redistributed to a buyer under closed terms.
Reviewed 2026-08-28 against the committed pnpm-lock.yaml. Regenerate it
after any dependency change:
pnpm licenses list --prod --json
Nothing here is legal advice. It is a record of what the tree actually contains, so the maintainer's lawyer — or the buyer's — is looking at facts rather than guesses.
Summary
722 production packages. Every one is permissive, or is a build-time tool that never reaches a buyer's source tree, or is a dynamically-linked binary whose licence expressly permits this use.
| Licence | Packages | Verdict |
|---|---|---|
| MIT | 592 | Permissive. Attribution only. |
| Apache-2.0 | 58 | Permissive. Attribution, notice of changes, patent grant. |
| ISC | 37 | Permissive. Functionally MIT. |
| BSD-3-Clause | 9 | Permissive. Attribution, no endorsement. |
| BSD-2-Clause | 8 | Permissive. |
| Unlicense | 3 | Public domain dedication. |
| BlueOak-1.0.0 | 2 | Permissive, and plainer English than most. |
| MPL-2.0 | 2 | File-level copyleft — see below. Dev tooling only. |
| MIT AND ISC / MIT and ISC | 2 | Both permissive. |
| Python-2.0 | 1 | Permissive, GPL-compatible. |
| CC-BY-4.0 | 1 | Attribution. Data/documentation, not code. |
| CC0-1.0 | 1 | Public domain dedication. |
| MIT-0 | 1 | MIT without the attribution requirement. |
| 0BSD | 1 | Public domain equivalent. |
| EPL-2.0 | 1 | File-level copyleft — see below. Build tooling only. |
| Apache-2.0 AND LGPL-3.0-or-later | 1 | Prebuilt binary — see below. Standard for every Next.js app. |
| Unknown | 2 | Both Polar. Resolved by inspection — see below. |
No GPL. No AGPL. No SSPL. No Business Source Licence. No "source-available" licence with a competing-use restriction. Those are the four families that would actually stop this product being sold, and none of them is present.
The five that needed a closer look
elkjs@0.11.1 — EPL-2.0
Reached through: prisma → @prisma/studio-core. It is a graph-layout
library used to draw the schema in Prisma Studio.
EPL-2.0 is file-level copyleft: it reciprocates on modifications to its own source files, and explicitly permits distributing it in a larger work under different terms. We do not modify it.
More decisively, it never reaches a buyer's application. It arrives with the
Prisma CLI, is used by pnpm db:studio, and is not imported by any file in
src/. It is not in the Next.js bundle and it is not in the shipped source.
Verdict: no obligation.
lightningcss and lightningcss-win32-x64-msvc@1.33.0 — MPL-2.0
Reached through: better-auth → vitest (peer) → vite. Test tooling.
MPL-2.0 is also file-level copyleft, and its §3.3 expressly permits distributing a Larger Work under different terms. We do not modify it, and it is a development dependency of a test runner — it is not in the production bundle and not in the source a buyer receives as product code.
Verdict: no obligation beyond leaving its own files' notices intact, which we do by not touching them.
@img/sharp-win32-x64@0.35.4 — Apache-2.0 AND LGPL-3.0-or-later
Reached through: Next.js image optimisation. Every Next.js application that
uses next/image has this, on every platform.
sharp itself is Apache-2.0. The LGPL component is libvips, shipped as a
prebuilt shared library that sharp loads dynamically. LGPL §4 permits combining a
work with an LGPL library under any terms, provided the library stays replaceable
— which it is: it is a separate .dll/.so/.dylib in node_modules, and a
buyer can swap it.
We do not statically link it, do not modify it, and do not distribute a modified libvips.
Verdict: no obligation, and identical to the position of every commercial Next.js product.
@polar-sh/better-auth@1.8.4 — reported "Unknown"
pnpm licenses reports Unknown because the license field is absent from its
package.json. The package does ship an Apache License 2.0 file at its
root, verified by reading it.
Verdict: Apache-2.0. Permissive. The missing metadata field is a packaging oversight upstream, not an absence of a grant.
@polar-sh/sdk@0.47.1 — reported "Unknown"
Same cause: no license field in package.json, and this one ships no LICENSE
file either. Its README.md carries an MIT badge linking to
opensource.org/licenses/MIT, and Polar's public repository is MIT-licensed.
Verdict: MIT, on the strength of the README and the upstream repository — but
it is the one grant in this tree that is asserted rather than shipped. Both
Polar packages are optional at runtime: with POLAR_ACCESS_TOKEN unset the
plugin is never registered and no Polar code executes. A buyer who is uneasy
about a grant declared only in a README can remove both packages and lose
nothing but the billing feature.
What this means for a buyer
- You may run, modify, and deploy the whole tree. Every licence present permits it, commercially and without a fee.
- You must keep the attribution notices that arrive inside
node_modules. In practice this happens automatically: you do not editnode_modules, and neither the Next.js bundle nor a Docker image strips a licence file from it. - You owe nothing to us or to any upstream author for running it.
- The restriction on redistributing DailyTM's own source comes from LICENSE, not from anything here. No third-party licence in this tree adds a restriction of its own to the product.
Development-only dependencies
The table above covers --prod. The development tree (ESLint, Prettier,
TypeScript, Playwright, Vitest, Tailwind, Prisma CLI) is MIT, Apache-2.0, ISC,
and BSD throughout. Development tools are not distributed as part of a
deployment, so their obligations do not attach to what a buyer ships — but for
the avoidance of doubt, none of them is copyleft either.