> For the complete documentation index, see [llms.txt](https://docs.heeler.com/mrecEO40m5D6bt7Pq5pE/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.heeler.com/mrecEO40m5D6bt7Pq5pE/findings/license-violations.md).
# License Violations
Dependencies whose license isn't allowed by your policy — where each one is, how it got in, and how to record an approved exception.
**License Violations** lists every place a dependency carries a license your organization doesn't allow. It's a separate list from [Open Source (SCA)](/mrecEO40m5D6bt7Pq5pE/findings/open-source-sca.md) because the question is different: SCA asks *is this dependency vulnerable*, and this list asks *are we allowed to ship this at all*.
The rule comes from your [License Policy](/mrecEO40m5D6bt7Pq5pE/administer-and-monitor/program-policy/license-policy.md). A dependency appears here when the license on **the exact version you have pinned** is on that policy's disallowed list — so pinning an older release with a different license is judged on that release, not on whatever the package publishes today.
{% hint style="info" %}
**One row per place, not per package.** The grain is module × package × version. A denied package pulled into six modules is six rows, because each one is a separate thing to fix or approve.
{% endhint %}
## The listing
| Column | What it shows |
| --------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| **Package** | The package name, linking to that version in its module, with the version on a badge beneath. If the row has an approved exception, a **License Overridden** badge sits next to the version — select it to review or edit the exception. |
| **License** | The license Heeler resolved for that version. |
| **Repository** | The repository the module belongs to, with its organization beneath. |
| **Module** | The manifest the dependency was declared in. |
| **Classification** | Icons describing how the dependency got in — **direct** or **transitive**, **first-party** or **third-party**, **private registry**, and **compromised**. A compromised icon links out to the advisory when Heeler knows its ID. |
| **Package Ecosystem** | The package manager the dependency came from. |
| **Introduced** | When the dependency first appeared. |
| **Ticket** | The linked Jira, Linear, or GitHub issue, when one exists. |
One row per place a denied license landed — with the module it was declared in and how the dependency got there.
The list opens sorted by **Introduced**, newest first, so the most recent policy breaks are at the top. **Package**, **Repository**, **Package Ecosystem**, **Introduced**, and **Ticket** are sortable; **License**, **Module**, and **Classification** are not — reach for a filter on those instead.
### Filtering
Standard listing controls apply — filter chips, an **All Filters** drawer, saved views, and column management. See [Filtering and Exports](/mrecEO40m5D6bt7Pq5pE/operate/dashboards/filtering-and-exports.md).
Filter by **License**, **Package**, **Package Version**, **Package Ecosystem**, **Classification**, **Repository**, **Module**, **Organization**, **Service**, **Team**, **Application**, **Date Introduced**, **Has Ticket**, and **License Overrides**. On GitLab, a **Subgroup** filter appears as well.
{% hint style="warning" %}
**Rows with an approved exception are hidden by default.** The **License Overrides** filter starts unset, and unset means *hide anything already overridden* — so the list shows you outstanding work, not decisions you've already made. Set it to **Yes** to see only the overridden rows, which is how you audit past approvals.
{% endhint %}
You can export the filtered list; see [Filtering and Exports](/mrecEO40m5D6bt7Pq5pE/operate/dashboards/filtering-and-exports.md).
## Recording an exception
When a denied license is acceptable in a particular place — an internal tool that never ships, a dependency you've had counsel review — open **Create License Override** from the row's action menu. If the row already has one, the same action reads **Edit License Override**.
An override is keyed to the **module, package, and ecosystem** — not to a single version. Approve `some-package` on one module and every version of it on that module is covered, so a routine version bump doesn't re-raise a decision you already made. The same package on a *different* module is a separate decision.
Each override records a reason, an optional description, and an optional expiry. With an expiry set, the exception lapses on that date and the row returns to the list; without one, it stands until someone removes it.
## Pushing to your tracker
The row action menu can push a violation to **Jira**, **Linear**, or **GitHub** — each appears only when that connection is configured. Once a row is linked, the matching entry becomes **Unlink from Jira** or **Unlink from Linear**.
Tickets are keyed at the same grain as overrides — module, package, ecosystem — so one ticket covers every affected version of that package on that module, and every one of those rows shows the same ticket badge.
## Related
* [License Policy](/mrecEO40m5D6bt7Pq5pE/administer-and-monitor/program-policy/license-policy.md) — which licenses are allowed, denied, and reviewed.
* [Open Source (SCA)](/mrecEO40m5D6bt7Pq5pE/findings/open-source-sca.md) — vulnerability and supply-chain risk in the same dependencies.
* [Dependency (SCA) Guardrails](/mrecEO40m5D6bt7Pq5pE/prevent/pr-guardrails/guardrail-types/dependency-sca-guardrails.md) — stop a denied license at the pull request instead of finding it here.
---
# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.
## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.
Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:
```
GET https://docs.heeler.com/mrecEO40m5D6bt7Pq5pE/findings/license-violations.md?ask=&goal=
```
`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.
