Did a dependency's license just change under you?

Paste a baseline snapshot (last known-good) and a current snapshot of your dependency tree's declared licenses, and this reports exactly which packages' license changed since then — not their version, their license. Terraform (→ BUSL-1.1, 2023), Redis (→ SSPL/RSAL, 2024), Elasticsearch (→ SSPL, 2021), and MongoDB (→ SSPL, 2018) all relicensed a widely used open-source project this way, and a routine dependency bump is exactly how each change reached an existing user.

Nothing is uploaded. The text you paste is parsed in this browser and never leaves your device.

1. Paste your baseline and current snapshots

Baseline (last known-good)

Current (this PR / this install)

Ignore these package names (comma-separated, optional — an accepted change you don't want flagged again)

2. What changed

Prefer a CLI, or want this as a CI gate?

Same logic, zero dependencies, one file — and it can capture a snapshot from your local node_modules directly (a browser cannot read your filesystem):

node cli.mjs snapshot --out baseline.json          # commit this once, after review
npm ci                                             # ...time passes, dependencies update...
node cli.mjs snapshot --out current.json
node cli.mjs diff baseline.json current.json       # human-readable, exit 1 if anything changed
node cli.mjs diff baseline.json current.json --json
node cli.mjs diff baseline.json current.json --ignore left-pad,is-odd

Get cli.mjs — Node 18+, nothing to install. It reads only local files: no network call, ever.

Four times this actually happened

Project	From	To	Date	What followed

More: why Dependabot and Renovate don't catch this, and how to wire the CLI into CI, how this compares to manually re-checking each dependency's license by hand, or to FOSSA, a hosted, continuously-scanning alternative with policy enforcement.

Common questions

Why doesn't Dependabot or Renovate already catch this?

They watch for new versions and open a pull request with the version delta and release notes. Neither diffs the license field between what you had and what you're about to get, so a routine version bump can carry a license change straight into a merged PR with nothing flagging it.

Is this legal advice about whether a license change matters to me?

No. It reports a factual difference — the license string changed from A to B — and buckets each into a public, well-known family (permissive, copyleft, source-available) as a skim aid, not a legal opinion. Whether a specific change matters to your specific use is a question for you or your counsel.

What format do the snapshots need to be in?

A JSON array of {name, version, license} objects — exactly what node cli.mjs snapshot writes from a local node_modules folder — or plain CSV with a name/version/license header, which is what pip-licenses --format=json (via a one-line jq conversion) or go-licenses csv already produce. See the docs page for exact commands per ecosystem.

Is my dependency data uploaded anywhere?

No. The browser page parses the snapshots you paste entirely in your own browser and never sends them anywhere. The CLI reads only local files — no network call, ever.