When you ship components under MIT, BSD and Apache 2.0 together, the notices add up. Each component keeps its own copyright line and license text, and any Apache NOTICE file attributions must be carried too. One combined notices file, organised by component, is the usual way to do it.
What each license wants shipped
| License | Notice duty when you distribute |
|---|---|
| MIT | The copyright notice and permission notice in all copies or substantial portions |
| BSD 3-clause | Notice, conditions and disclaimer in source, and in documentation or other materials for binaries |
| Apache 2.0 | A copy of the license, preserved notices, and NOTICE file attributions in one of three places |
These come from the license texts published by OSI and Apache. Nothing here says they conflict. Permissive licenses stack because each one only asks you to keep its own text.
Build the combined file
- Collect the list. Take every third party component that ships in the artifact, direct and transitive.
- Pull the text for each. Use the actual license file from the package, not a generic template, because the copyright line differs per project.
- Add NOTICE contents. For Apache components that include a NOTICE file, copy its attribution text under the component's name.
- Group and label. Heading per component with name, version, license identifier, then text.
- Ship it. Include the file in the release artifact, or show it on an about screen in an app.
- Regenerate on change. Updating a dependency can change its copyright years, text or NOTICE content.
Mistakes that cause gaps
- Using one MIT text for every MIT package. The copyright line is part of the notice.
- Leaving out transitive dependencies. They ship too.
- Shipping the file in the repo but not in the build.
- Forgetting packages vendored into the source tree. See vendored code and submodules blind spots.
A note on size
A notices file for a typical application can be long. That is fine. It is a text file, it can be compressed, and it can be served from an about page so long as it reaches recipients where the license expects.
If your situation involves unusual distribution, such as embedded devices, ask your counsel. This post is practical guidance and not legal advice.
Quick check
Can I paste all notices under one MIT text?
No. Keep each project's copyright line with its license text.
Do dev dependencies need notices?
Only if they are included in what you distribute. Check what actually ships.
Safeguard's SBOM and dependency scanning can list the components that ship, which is step one.
Sources
Last reviewed: 19 October 2026.
