{
  "id": 19640440,
  "title": "We ship 400 KB of MIT-licensed JavaScript to every visitor and not one copyright notice with it",
  "url": "https://urgent.news/2026/11/12/we-ship-400-kb-of-mit-licensed-javascript-to-every-visitor-and-not",
  "topic": "tech",
  "section": "Tech",
  "published": "2026-11-12T11:01:29.000Z",
  "source": {
    "name": "Dev.to",
    "slug": "dev-to",
    "url": "https://dev.to/daniel_pertu/we-ship-400-kb-of-mit-licensed-javascript-to-every-visitor-and-not-one-copyright-notice-with-it-2jc1"
  },
  "original_language": "en",
  "account": "PubTrivia, a Next.js application, transmits 400 KB of MIT-licensed JavaScript to each visitor without including any copyright notice. The application has 50 direct dependencies, with 23 of those dependencies installed at different versions. The deployment process consists of 23 packages and three licenses, with four direct dependencies. The largest dependency, postgres@3.4.9, is a public domain dedication with no conditions attached. Despite having a large number of dependencies and licenses, only five rows in the audit indicate the presence of transitive dependencies, and these require no decisions from the developers. The visitor's browser receives 79 public pages with 32 JavaScript chunks, but there are no license headers or attribution to be found. The only attribution that appears is a copyright string in a font table, which is not displayed by browsers.",
  "summary": "PubTrivia is a Next.js app with 50 direct dependencies: 33 runtime and 17 development. That is a deliberately boring list. pnpm licenses list disagrees about the size of the problem: $ pnpm licenses list --json | jq 'to_entries | map({licence: .key, n: (.value | length)}) | sort_by(-.n)' licence packages MIT 511 Apache-2.0 36 ISC 22 BSD-2-Clause 11 BSD-3-Clause 8 BlueOak-1.0.0 5 MPL-2.0 3…",
  "key_points": [
    "PubTrivia transmits 400 KB of MIT-licensed JavaScript to each visitor",
    "Application has 50 direct dependencies with 23 installed in different versions",
    "No copyright notice or attribution included in 79 public pages"
  ],
  "editors_take": "The absence of license headers in the transmitted JavaScript chunks suggests a breakdown in attribution practices that leaves developers vulnerable to non-compliance despite using permissive open-source software.",
  "illustration": null,
  "coverage": {
    "outlets": 1,
    "also_reported_by": []
  },
  "ai_generated": true,
  "disclaimer": "Summaries, key points and the editor’s take are written by software from other outlets’ reporting and may contain errors — always check the linked original."
}