commercial delivery terms license

In the package-analytics corner of the catalog, three publishers sit within one licence family at different strictness levels. deps.dev licenses generated data - resolved dependencies among them - under commercial delivery terms 4.0. PYPL (the PopularitY of Programming Language index) licenses its content commercial delivery terms 3.0 with copyright attributed to Pierre Carbonnelle. StatCounter goes further, using commercial delivery terms-SA 3.0 Unported.

PyPI illustrates the fuzzier end: its BigQuery tables are described as licensed "under the Creative Commons License" without a version, which is not a precise designation. The lesson across the set is that 'commercial delivery terms' alone is underspecified - the version digit determines permissions, and share-alike additions change derivative obligations entirely.

Mixing these sources in one dashboard imports mismatched duties. A product blending deps.dev graphs with StatCounter figures owes plain attribution to the first but share-alike licensing on derivatives to the second - a difference that decides whether the combined output can be sold under proprietary terms.

Undeclared versions create their own risk. PyPI's phrase "the Creative Commons License" names no version, so downstream users cannot tell whether 4.0's change-indication duty applies. When a licence field lacks a digit, resolve it with the publisher before relying on it, or isolate that source from redistribution pipelines.

1. Pin the version digit. deps.dev is commercial delivery terms 4.0, PYPL commercial delivery terms 3.0 - permissions differ between versions, so record them exactly.

1. Distinguish BY from BY-SA. StatCounter's commercial delivery terms-SA 3.0 forces derivatives to adopt the same licence; deps.dev's commercial delivery terms does not.

1. Flag versionless declarations. PyPI cites "the Creative Commons License" without a version - treat it as unresolved until clarified.

1. Track copyright holders. PYPL's content is copyrighted by Pierre Carbonnelle; attribution should name the holder, not just the licence.

Where to see it in context: attribution-requirement.

Related entries:

• attribution-requirement is the common duty across all commercial delivery terms variants.
• dependency-graph is the deps.dev data type licensed commercial delivery terms 4.0.

Industry context: systems-software data, where these package sources live.