Most developers have read the words "MIT License" at least a hundred times and couldn't explain what they actually permit or require. That is fine until the day someone in Legal asks you to audit the licenses in a product you are about to ship, or until you open-source your work and discover it is tangled up with a copyleft library. Open-source licenses are legal contracts that grant rights to use, modify and redistribute code — with conditions.
MIT is as permissive as it gets: you can use, copy, modify, publish and sell the software with no restrictions beyond including the copyright notice and license text. A NOTICE file listing the MIT dependencies you ship satisfies your obligations. BSD 2-Clause and 3-Clause are nearly identical to MIT. ISC License is MIT-equivalent and heavily used in the npm ecosystem.
Apache License 2.0 is permissive but adds an explicit patent grant from contributors (protecting you from patent claims) and a patent retaliation clause (your license terminates if you sue for patent infringement related to the software). It also requires including the NOTICE file from Apache-licensed components in your distribution. Apache 2.0 is generally preferred over MIT for commercial use because of the patent grant; it is compatible with GPL 3.0 but not GPL 2.0.
LGPL applies to libraries and requires the LGPL library remain modifiable by the end user. You can use an LGPL library in a proprietary application if users can replace the LGPL component (typically dynamic linking), but modifications to the LGPL library itself must be published under LGPL. Mozilla Public License 2.0 (MPL-2.0) is file-level copyleft: modifications to MPL-licensed files must be shared, but you can combine them with proprietary code.
GPL 2.0 and GPL 3.0 are the "viral" licenses: any software that incorporates GPL-licensed code and is distributed to users must be distributed under the GPL as well, with source code. The critical caveat: network use is not distribution under GPL — running GPL software as a SaaS does not trigger copyleft. AGPL closes this loophole: if your SaaS uses an AGPL library, users accessing it over the network must receive the AGPL source. Many commercial organisations have an explicit policy against AGPL dependencies.
Generate a NOTICE file for every permissive dependency you ship — this is a legal requirement, not optional. Audit before you ship: the time to discover a GPL library deep in your transitive tree is before the customer agreement is signed. Track license changes: Redis moved from BSD to SSPL; Elasticsearch moved from Apache 2.0 to Elastic License. DepWarden categorises every license via SPDX and generates a NOTICE file automatically from your manifest or lockfile scan.