Disclaimer: I am not a lawyer and this is not legal advice. This is a reading of what license texts plainly say. For any real IP decision, consult a qualified patent attorney.
I built my dependency tree the lazy way, one pip install at a time, every line chosen by a version of me who only cared whether the code ran. Then a patent question landed on me and I realized each of those lines was a decision I had never actually made on purpose.
So now there is a gate, and it takes about thirty seconds before the import goes in.
Identify the license first. The LICENSE file or the SPDX identifier tells you in seconds. If it is MIT, BSD, ISC, or Apache-2.0, you are in safe territory on patent retaliation and you move on. If it is GPL v3, AGPL v3, or LGPL v3, you stop and ask one question: does this component touch any functional area near a patent I hold or might file? If yes, I reach for a permissive alternative instead, and in modern AI work there almost always is one. If no, I write down that judgment and why, because a future me with broader claims will want to revisit it.
Then I log the decision. Package, version, SPDX identifier, the date I checked, one line of rationale. A plain markdown table in the repo is enough. The point was never an elaborate ledger. The point is that the decision was made deliberately and on the record, before adoption, instead of reconstructed under pressure after the fact.
The asymmetry is the whole argument. Thirty seconds before the import is near free. Doing license archaeology while a lawyer reads your lockfile out loud is not. The license is sitting in the repository the entire time. Read it before the install, not before the filing.
Full writeup: The GPL v3 patent trap nobody checks