Copyright generally arises when original expression is fixed. A public repository makes source visible; it does not by itself grant permission to modify or redistribute that source. Platform permissions and an open-source grant are different instruments.
Identify the version, the holder and the grant before deciding what you can ship. A package manifest with no license field is missing evidence. It is not evidence of the MIT license, and a parent package cannot grant rights to every dependency.
In this project, the holder supplied a version-specific permission file. Record that actual grant and preserve its terms and attribution. If the owner had supplied no permission, the appropriate result would remain unresolved rather than a guessed green check.