License Guide
Which open-source licenses can you ship?
The reason to check your dependency licenses at all is one question: can we ship this? The answer comes down to the license family and whether you distribute a derivative work. Here’s the plain-English map — permissive, copyleft, and source-available — and how to find each one in your own dependencies.
License obligations are one of six kinds of dependency risk. The AppSec risk guide covers the other five, from known vulnerabilities to malicious packages.
General information, not legal advice. Each page cites the primary license text; for a specific product decision, confirm with counsel.
The distributability spectrum
Every open-source license sits somewhere on a spectrum from “do anything” to “share everything.” This is the decision at a glance — start here, then read the license that applies to you:
| License family | Ship it in proprietary software you distribute? | The catch |
|---|---|---|
| Permissive — MIT, Apache-2.0, BSD | Yes | Attribution; Apache-2.0 adds an explicit patent grant. |
| Weak copyleft — LGPL, MPL-2.0 | Yes, with conditions | Keep the library’s own source open and let users relink a modified version. |
| Strong copyleft — GPL-2.0 / 3.0 | No — not as proprietary | Distributing a combined work means the whole must be offered under the GPL. |
| Network copyleft — AGPL-3.0 | No — and SaaS counts | Serving a modified version over a network triggers source disclosure. |
| Source-available — BSL, Elastic | Depends | Not OSI-approved; a use restriction (often “no competing service”). |
New to the concept? Start with copyleft licenses explained — it’s the distinction the rest of this table turns on.
Need the pairing rather than the family? The license compatibility matrix answers the specific question — can this dependency go into the thing I am shipping? — for MIT, Apache-2.0, BSD, ISC, MPL, LGPL, GPL, AGPL, BSL and Elastic, with the canonical text behind every verdict.
Permissive licenses
MIT
The most permissive license in common use: commercial, proprietary, closed-source — all fine. One obligation, and it’s per-dependency: keep the copyright and permission notice.
Read the guide →Apache-2.0
Permissive, with an express patent grant MIT lacks — plus a NOTICE-file obligation, and the one real trap: it’s incompatible with GPL-2.0-only.
Read the guide →BSD-3-Clause
Effectively MIT plus a no-endorsement clause. The condition that actually catches teams is reproducing the notice in binary distributions.
Read the guide →Copyleft licenses
MPL-2.0 (file-level copyleft)
The narrowest copyleft: only the covered files and your changes to them stay open. Ships inside proprietary products freely — and gets over-banned because of the “copyleft” label.
Read the guide →Copyleft licenses explained
What copyleft actually requires, the weak → strong → network spectrum, and the one question that decides everything: are you distributing a derivative work?
Read the guide →LGPL-3.0 (weak copyleft)
The one most teams needlessly avoid: proprietary software can use an LGPL library if you allow relinking and keep the library’s own changes open.
Read the guide →GPL-3.0 (strong copyleft)
Commercial use is fine; distributing a combined work is the trigger — the whole becomes GPL. No network clause, so a SaaS backend is a different question.
Read the guide →AGPL-3.0 (network copyleft)
GPL plus Section 13: serving a modified version over a network can force source disclosure — which is why it’s the license corporate policies ban most.
Read the guide →Source-available licenses
Business Source License 1.1 (BSL-1.1)
Source-available, not open source. Free for almost every commercial use — the one catch is the “competing service” restriction, and every version flips to open source on its Change Date.
Read the guide →Elastic License 2.0 (ELv2)
Source-available, not open source. Use, modify, and self-host freely; the single real limit is that you can’t offer the software to others as a managed/hosted service.
Read the guide →Head-to-head comparisons
MIT vs Apache-2.0
Both are safe for commercial, closed-source software — the differences are patents and paperwork. The express patent grant, the NOTICE obligation, and the GPL-2.0 trap.
Compare →Apache-2.0 vs GPL-3.0
Permissive versus strong copyleft — the comparison that actually changes what you can ship. Why you can sell GPL software, the two triggers people get wrong, and why compatibility runs only one way.
Compare →Related reading
From “what does it mean” to “where is it”
Knowing what a license requires only matters if you know which of your dependencies carry it. depproof surfaces the license of every dependency — direct and transitive, as part of a software composition analysis scan — so a forbidden or source-available license can’t hide in the tree:
For developers, the npm and Maven license checks find these per repo; for legal and compliance, the depproof hub aggregates license posture across your whole estate.