The licenses element in a Maven POM names the license or licenses that apply directly to that project. It has a name, a URL, a distribution value and optional comments. It does not describe the project's dependencies, and the name is free text, so scanners must normalize it before applying a policy.
What the element contains
The Maven POM reference says the section lists the legal documents under which the project may be used, and should cover only licenses that apply directly to the project, not those of its dependencies. Each license has a name, a URL where the text lives, a distribution value, and comments. Distribution is either repo, meaning it can be downloaded from a Maven repository, or manual, meaning it must be installed by hand. The reference recommends an SPDX identifier as the name.
Why free text causes trouble
The name field is not validated. In practice you will meet spellings like Apache License, Version 2.0, The Apache Software License 2.0 and Apache-2.0 for the same thing. A policy engine that matches exact strings will treat them as different.
| Problem | Example | Fix |
|---|---|---|
| Many spellings of one license | Several Apache 2.0 names | Normalize to SPDX ids |
| Name and URL disagree | MIT name, GPL URL | Read the license text |
| Several license entries | Dual license | Decide OR versus AND, record it |
| Empty element | No licenses listed | Check parent POM, then repository |
| Parent POM inheritance | License set only in the parent | Resolve the effective POM |
Check the effective POM
A child module may inherit licenses from its parent. Use the effective POM when you read a dependency's metadata, since the raw file can look empty.
Steps
- Resolve your full dependency tree, including transitive artifacts. See how to list transitive dependencies.
- Read each artifact's effective POM licenses and normalize names to SPDX identifiers.
- When there are multiple entries, record whether you treat them as a choice or a requirement, after reading the license text.
- Send empty or unmappable entries to manual review.
Also watch for packaging that merges several libraries into one artifact. A shaded or uber JAR can contain classes from many projects, each with its own license, while the POM of the wrapper lists only one. When you ship a merged artifact, inventory what went into it, not just its coordinates.
Safeguard scans Maven dependencies and generates SBOMs, and you can try a free scan on a public repository.
Quick check
Does a POM list the licenses of its dependencies?
No. The element covers licenses that apply directly to the project itself.
What does the distribution value mean?
Repo means the project can be downloaded from a Maven repository, and manual means it must be installed manually.
Sources
- Apache Maven, POM Reference, Licenses: https://maven.apache.org/pom.html#Licenses
Last reviewed: 19 October 2026.
