Open Source Licenses
Understanding software licenses is critical for compliance. This guide explains the most common licenses and why Stacktower may flag certain dependencies in your project.
Showing 17 of 17 licenses
Quick Reference
Free to use, modify, and distribute. Generally safe for commercial use.
Can use in proprietary software, but modifications to the library must be shared.
Derivative works must be released under the same license. Review carefully.
Not open source or has significant restrictions. May require commercial license.
Permissive Licenses
Minimal restrictions. You can use, modify, and distribute in both open source and proprietary projects. Generally only require attribution.
MIT License
MITOne of the most permissive and popular open source licenses. Allows almost unrestricted use, modification, and distribution.
- •Can be used in commercial projects
- •Can be modified and distributed
- •Only requires attribution (keep the copyright notice)
- •No warranty provided
Click to view full license details
Apache License 2.0
Apache-2.0A permissive license with explicit patent grants. Popular in enterprise and cloud-native projects.
- •Can be used in commercial projects
- •Includes explicit patent rights grant
- •Requires attribution and change documentation
- •Provides trademark protection for the project
Click to view full license details
BSD 3-Clause License
BSD-3-ClauseA permissive license similar to MIT but with an additional clause preventing use of the project name for endorsement.
- •Can be used in commercial projects
- •Requires attribution
- •Cannot use project name for promotion without permission
- •No warranty provided
Click to view full license details
BSD 2-Clause License
BSD-2-ClauseThe simplified BSD license, nearly identical to MIT. Removes the non-endorsement clause.
- •Can be used in commercial projects
- •Requires attribution
- •Very minimal restrictions
Click to view full license details
ISC License
ISCA simplified permissive license equivalent to MIT/BSD. Popular in the Node.js ecosystem.
- •Functionally equivalent to MIT
- •Shorter and simpler wording
- •No restrictions on use
Click to view full license details
Unlicense
UnlicenseDedicates code to the public domain. No restrictions whatsoever.
- •Public domain dedication
- •No attribution required
- •No restrictions on use
- •May not be recognized in all jurisdictions
Click to view full license details
Python Software Foundation License
PSF-2.0A permissive license used by Python and many Python projects. Similar to BSD with explicit permission grants.
- •Can be used in commercial projects
- •Allows modification and redistribution
- •Requires retention of copyright notice
- •Commonly used by Python core packages
Click to view full license details
Weak Copyleft Licenses
Allow proprietary use but require sharing modifications to the licensed component. Scope is limited (file-level or module-level).
GNU Lesser General Public License v2.1
LGPL-2.1Allows linking to LGPL libraries without requiring your code to be open source, but modifications to the library itself must be shared.
- •Can be used in proprietary software via dynamic linking
- •Modifications to the library must be open sourced
- •Must allow users to replace the LGPL component
- •More permissive than GPL for library usage
Why we flag this: Modifications to LGPL code must be released. Static linking may trigger copyleft requirements.
Click to view full license details
GNU Lesser General Public License v3.0
LGPL-3.0Updated version of LGPL with additional protections. Still allows proprietary use via linking.
- •Same linking freedoms as LGPL-2.1
- •Additional anti-tivoization clause
- •Must provide installation instructions
- •Patent retaliation clause included
Why we flag this: Modifications must be shared. Anti-tivoization may affect embedded/IoT deployments.
Click to view full license details
Mozilla Public License 2.0
MPL-2.0A file-level copyleft license. Only modified files need to be open sourced, not your entire project.
- •Copyleft applies only to modified MPL files
- •Can be combined with proprietary code
- •Must share source of modified MPL files
- •Compatible with GPL
Why we flag this: Changes to MPL-licensed files must be released under MPL. Review which files you're modifying.
Click to view full license details
Eclipse Public License 2.0
EPL-2.0Similar to MPL with module-level copyleft. Popular in the Java/Eclipse ecosystem.
- •Module-based copyleft scope
- •Can be combined with proprietary code
- •Must share source of modified EPL modules
- •Patent grants included
Why we flag this: Modifications to EPL modules must be shared. Ensure clear module boundaries.
Click to view full license details
Copyleft Licenses
Strong copyleft requires derivative works to use the same license. Using these in proprietary software can create significant legal obligations.
GNU General Public License v2.0
GPL-2.0Strong copyleft license requiring derivative works to also be GPL. Does not include explicit patent grants.
- •Derivative works must be open sourced under GPL
- •Source code must be made available
- •No explicit patent grants (unlike v3)
- •"Or later" clause allows upgrading to GPL-3.0
Why we flag this: Any software that includes GPL-2.0 code must be released under GPL-2.0. This may affect your ability to keep code proprietary.
Click to view full license details
GNU General Public License v3.0
GPL-3.0Updated GPL with patent protection and anti-tivoization. The strongest commonly-used copyleft license.
- •All derivative works must be GPL-3.0
- •Explicit patent grants and retaliation clause
- •Anti-tivoization prevents hardware restrictions
- •Must provide installation instructions
Why we flag this: Full copyleft: your entire project may need to be GPL-licensed. Anti-tivoization affects hardware products.
Click to view full license details
GNU Affero General Public License v3.0
AGPL-3.0GPL-3.0 extended to network use. If you run AGPL software as a service, you must share your source code.
- •All GPL-3.0 requirements apply
- •Network use triggers copyleft ("SaaS loophole" closed)
- •Must provide source to users accessing via network
- •Strongest copyleft license in common use
Why we flag this: Critical: Running AGPL code as a web service requires releasing your entire application source code. Many companies prohibit AGPL dependencies.
Click to view full license details
Restricted / Source-Available Licenses
Not OSI-approved open source. May allow viewing source but restrict commercial use.
Server Side Public License
SSPL-1.0MongoDB's license requiring cloud providers to open source their entire stack. Not OSI-approved.
- •Based on AGPL but more restrictive
- •Requires open-sourcing management/orchestration layers
- •Designed to prevent cloud provider competition
- •Not considered open source by OSI
Why we flag this: Not OSI-approved. Extremely broad copyleft requirements may require open-sourcing your entire infrastructure stack.
Click to view full license details
Business Source License
BUSL-1.1Source-available license that converts to open source after a time period. Restricts production use.
- •Source code is visible but not open source
- •Production use may require a commercial license
- •Converts to open source license after specified period
- •Terms vary by project
Why we flag this: Not open source. Production use typically requires a commercial license. Check the specific terms.
Click to view full license details
Commons Clause
Commons-ClauseAn addendum that restricts "selling" the software. Added on top of other licenses.
- •Restricts commercial sale of the software
- •Added to existing open source licenses
- •Definition of "sell" can be ambiguous
- •Not OSI-approved when added
Why we flag this: Restricts commercial use. The combination is no longer considered open source.
Click to view full license details
Obligations Comparison
What each license requires you to do. * = required in some cases.
| License | Attribution required | Disclose source | Same license (derivative works) | State changes | Patent grant | Network use triggers copyleft |
|---|---|---|---|---|---|---|
| MIT | — | — | — | — | — | |
| Apache-2.0 | — | — | — | |||
| BSD-3-Clause | — | — | — | — | — | |
| BSD-2-Clause | — | — | — | — | — | |
| ISC | — | — | — | — | — | |
| Unlicense | — | — | — | — | — | — |
| PSF-2.0 | — | — | — | — | — | |
| LGPL-2.1 | * | * | — | — | — | |
| LGPL-3.0 | * | * | — | — | ||
| MPL-2.0 | * | * | — | — | ||
| EPL-2.0 | * | * | — | — | ||
| GPL-2.0 | — | — | ||||
| GPL-3.0 | — | |||||
| AGPL-3.0 | — | |||||
| SSPL-1.0 | — | |||||
| BUSL-1.1 | * | — | — | — | — | |
| Commons-Clause | * | — | — | — | — |
License Compatibility
Can you mix licenses? Generally, permissive licenses (MIT, Apache, BSD) can be combined freely. Mixing GPL with permissive code means the combined work may need to be GPL. MIT + GPL = GPL. Apache-2.0 + GPL-3.0 = compatible. Consult legal counsel for your specific case.
Permissive + Permissive: Yes. MIT, Apache-2.0, BSD, ISC can be combined. Keep all attribution notices.
Permissive + GPL: The resulting work becomes GPL. You must release under GPL and provide source.
GPL + LGPL: Can be combined. LGPL is designed to work with GPL.
AGPL: Strongest copyleft. Network use triggers source disclosure. Many companies prohibit AGPL.
Frequently Asked Questions
- Does using a GPL library make my entire project GPL?
- It depends. If you link to the library (statically or dynamically) and distribute your software, the GPL may require you to release your code under GPL. Using it only at build time (e.g., a compiler) is often treated differently. Consult legal counsel.
- What counts as a derivative work?
- There is no universal definition. Generally, modifying the licensed code, or combining it with your code in a way that creates a single program, can create a derivative work. Simple aggregation (separate programs) may not. Legal interpretation varies.
- Do build-time-only dependencies matter?
- Often no. Tools like compilers, linters, or bundlers that run only during build and are not included in your distributed output typically do not create a derivative work. The result may be different if the build tool's code is incorporated into your output.
- What if a package has no license?
- Unlicensed code is not legally safe to use. Copyright applies by default, so you need explicit permission. Contact the author or avoid the dependency.
- What does dual licensing mean?
- Some projects offer the same code under two licenses (e.g., GPL for open source, commercial for proprietary use). You choose which terms apply to you. Examples: MySQL, Qt.
Disclaimer
This guide is for informational purposes only and does not constitute legal advice. License interpretation can be complex and may vary by jurisdiction. For specific compliance questions, consult with a qualified legal professional. Stacktower's license detection is automated and may not capture all edge cases or custom license terms.