Write a short, specific note: name the package and version, say what you could not find, ask which license applies and whether they can add a LICENSE file, and thank them. Post it as a public issue so the answer helps others. If no reply arrives, plan to replace the package.
Why ask at all
Without a license, the default is that the author keeps all rights. GitHub's documentation says that without one no one may reproduce, distribute or create derivative works. A maintainer often meant the code to be open and simply forgot the file. A one line answer fixes it for everyone.
Issue template
Title: Please add a LICENSE file
Body:
Hi, thanks for maintaining example-lib.
We would like to use version 2.4.1 in our product, but we could not find
a license in the repository or the published package. Could you confirm
which license applies, and add a LICENSE file to the repository and a
license field to the package metadata?
If you prefer a standard license, the SPDX list has short identifiers
such as MIT or Apache-2.0.
Thank you.
Adjust the names. Keep the tone friendly and short.
Tips on tone
- Do not demand. You are asking a favor.
- Do not argue about legal theory in the issue.
- Do not paste a long license comparison. Offer to open a pull request that adds the file if they name the license.
- Never assume a license on their behalf.
Private message cases
If the repo has no issue tracker, look for a contact in the package metadata or the project site. Keep the message the same, and save the reply as evidence.
If there is no reply
Set a date, for example two weeks. Then pick one:
- Pin to a version that has a clear license, if one exists.
- Switch to an alternative package.
- Write the functionality yourself, if it is small.
- Keep the package out of shipped software and record why.
Record the outcome
Keep a copy of the message, link to the issue, the reply and the date. When the answer comes, record the SPDX identifier and the version it applies to, since a later release may differ.
This post is practical guidance and not legal advice.
Quick check
Is a maintainer's reply in an issue enough?
It is useful evidence. A LICENSE file in the repository is better, so ask for that too.
Can I pick a license for them?
No. Only the rights holder can grant a license.
Safeguard's dependency scanning can show which packages in your tree need this follow up.
Sources
Last reviewed: 19 October 2026.
