license check fails PR: GPL dependency pulled in transitively

TL;DR

Find which direct dependency dragged the GPL package in, then get rid of it: upgrade to a version under a permissive license, swap in an alternative, or get explicit legal approval and allowlist it. Copyleft licenses can impose source-disclosure obligations on your whole product, which is why the gate fails closed - and transitive dependencies hide the real license three levels down.

The error

License check failed: GPL-3.0 detected in dependency tree
  pulled in by: [your-direct-dep] -> [transitive-dep] (GPL-3.0)

Fix it

1. Trace the chain. Use your stack's dependency inspector (npm ls, pipdeptree -r, go mod why, or equivalent) on the flagged package. Expected: the direct dependency responsible for pulling it in.

2. Check for a license change upstream. Look at whether a newer version of the transitive package - or of the direct parent - switched to a permissive license. Expected: sometimes a plain upgrade clears the finding with no other changes.

3. If not, replace the direct dependency with an alternative under an approved license, and remove the old one. Expected: re-running the license check reports no disallowed licenses.

4. If the dependency is genuinely unavoidable, get explicit legal approval and add it to the allowlist config with the approval noted. Expected: a documented exception; the check passes without weakening the policy for everything else.

5. Re-run the license check on the PR. Expected: green, with no disallowed licenses in the tree.

Use this when

• A license check fails on GPL, LGPL, or AGPL in the tree
• The report says the license was "pulled in transitively"
• You need to find which dependency introduced the flagged license

Not for this skill when

• The flagged license is actually fine under your policy - tune the allowlist instead
• The scanner misread the license (ambiguous LICENSE file) - verify the package's real license text manually
• The conflict is a proprietary license rather than copyleft - same workflow, but a different legal question

Variant phrasings

• license check GPL dependency transitive
• GPL pulled in transitively how to fix
• dependency license check failed PR
• copyleft license in dependency tree

Why it happens

Most companies ban copyleft licenses in shipped code because of the source-disclosure obligations they can trigger. Package managers resolve transitive dependencies invisibly, so a permissively licensed direct dependency can quietly pull in a GPL-licensed transitive one - and the license gate is the first place anyone notices.

Edge cases

• Dual-licensed packages: pick the permissive option explicitly and record the choice
• Dev-only dependencies often get a policy pass, but confirm yours does before assuming
• License scanners misread ambiguous or multi-license files - always verify against the actual license text for high-stakes decisions
• Allowlists without legal review are how companies inherit obligations they never meant to take on

Provenance

Resolved from the public thread: https://vectle.com/posts/pst_rDCj6T0bdnpi7N8kFJt87A