What is the open source component request form template?
Open-source libraries save enormous amounts of time, but each one brings a licence, a maintenance burden and its own vulnerabilities. Organisations that ship software usually want to know what's being added, under what terms, and who will keep it up to date.
This form records the component, version, ecosystem and project link, the product it's for, what it does and the alternatives considered. It asks how the component will be used and included, whether it will be modified and which licence applies. GPL-family licences show a note that a licence review is needed, and a missing licence explains why that's a problem.
The last page covers latest release date, maintenance status, known vulnerabilities and how they were checked, transitive dependencies, a scan report or SBOM, and the team's commitment to keep it updated. It helps gather the facts for a review; it isn't legal advice on licence obligations.
- Best for
- Engineering, security and legal teams approving third-party code
- Filled in by
- The developer who wants to add the component
- Time to complete
- About 5-8 minutes
- Includes
- Usage and distribution questions, licence list with copyleft and no-licence notes, vulnerability follow-up, SBOM upload and upkeep commitment
Who uses a open source component request form?
- Approving a new library for a product that ships to customers
- Recording licence decisions for an audit or due diligence
- Reviewing components before they enter a regulated product
- Checking a library's security health before adoption
- Building an inventory of approved open-source components
- Requests to use a container image from a public registry
Questions on this open source component request form
25 questions over 3 pages · includes file upload, conditional questions, multiple pages, consent checkbox.
1 Component
- Requested by*
- Email*
- Team
- Component name*
- Version*
- Package ecosystem* npm · PyPI · Maven or Gradle · NuGet · Go modules · Cargo · RubyGems · Composer · Container image · Other
- Source repository or project page*
- Product or service it will be used in*
2 Use & licence
- What will it be used for?*
- Alternatives considered
- How will it be used?* Included in software we distribute (app, device, download) · In a service we host for customers · Internal tool only · Build, test or development only
- Will we modify its source code?*
- How is it included? Package dependency · Source copied into our code · Separate program or container · Not sure
- Licence* MIT · Apache-2.0 · BSD (2- or 3-clause) · ISC · MPL-2.0 · LGPL · GPL-2.0 · GPL-3.0 · AGPL-3.0 · Public domain or Unlicense · Dual or commercial licence · No licence found
- Licence name and link* asked only when it applies
3 Health & security
- Date of the latest release
- Maintenance status* Actively maintained · Occasional updates · Unmaintained or archived · Not sure
- Known vulnerabilities in the requested version* None found · Found, but fixed in this version · Unresolved vulnerabilities
- Which vulnerabilities, and why is it still acceptable?* asked only when it applies
- How did you check?
- Number of transitive dependencies (approx.)
- Needed by
- Scan report or SBOM
- Approving manager or tech lead
- Upkeep*
The open source component request form, page by page
1 Component
The requester, email and team come first. Component name, version, package ecosystem, source repository and the product it will be used in are required.
2 Use & licence
What will it be used for? is required, with alternatives considered. The developer says how it will be used (in distributed software, a hosted service, an internal tool or only for build and test), whether the source will be modified and how it's included.
The Licence dropdown lists common licences. Choosing an LGPL, GPL or AGPL licence shows a note that copyleft licences may require sharing source and need a licence review, and No licence found explains that there's normally no permission to use the code. Other asks for the licence name and link.
3 Health & security
Latest release date and maintenance status describe the project's health. Known vulnerabilities in the requested version is required; unresolved vulnerabilities require advisory IDs and why it's still acceptable. How it was checked, transitive dependencies, a needed-by date, a scan report or SBOM and the approving manager follow, and the requester agrees to keep the component up to date and include required licence notices.
Make the template yours
- Add your organisation's list of pre-approved licences to the cover text
- Route copyleft licence requests to legal by adding their address to notifications
- Add a field for the internal package registry or mirror location
- Remove ecosystems your teams don't use
- File approvals into a vault folder that serves as your component inventory
Tips for a better open source component request form
- Request a specific version, not "latest"
- Check the licence of the version you're using; licences sometimes change between versions
- Look at transitive dependencies too, not just the top-level package
- Prefer actively maintained projects with recent releases
- Keep licence notices in your product's third-party notices file
Every response becomes a PDF in your vault
Each request is saved as a PDF in your FileIt vault with any scan report attached, so there's a record of when and why a component was approved.
Export the Responses table to CSV to keep an inventory of requested components, versions and licences.
- Start from this template. It opens in the FileIt Forms designer — change any question, add pages, set the rules for when questions appear.
- Share it. Turn on a public link, or send it to people by email, each with their own link. They don’t need a FileIt account.
- Get the answers as PDFs. Each response is saved as a PDF in the vault folder you choose, with uploaded files attached — and listed in a Responses table you can export to CSV.
Open source component request form: frequently asked questions
Is this open source component request template free?
Yes. It's included in the FileIt Forms app on every account, including the free plan, and every question can be edited, removed or added to in the form designer.
Does the form check the licence or scan for vulnerabilities?
No. The developer provides the licence and vulnerability information, and can upload a scan report or SBOM from your own tools.
Is this legal advice on open-source licences?
No. The notes are general prompts. Licence obligations depend on how the code is used and distributed, so ask your legal team for anything unclear.
Why does it ask how the component is used?
Many licence obligations depend on whether software is distributed, provided as a service or used internally, so reviewers need to know.
Do we need a request for every minor version update?
That's your policy decision. Many teams only require a new request for new components or licence changes.
Do developers need a FileIt account to fill it in?
No. Anyone with the form's link can submit it without creating an account. You can also email personal links to specific people.