License Guide
Which open-source licenses can you ship?
The reason to check your dependency licenses at all is one question: can we ship this? The answer comes down to the license family and whether you distribute a derivative work. Here’s the plain-English map — permissive, copyleft, and source-available — and how to find each one in your own dependencies.
General information, not legal advice. Each page cites the primary license text; for a specific product decision, confirm with counsel.
The distributability spectrum
Every open-source license sits somewhere on a spectrum from “do anything” to “share everything.” This is the decision at a glance — start here, then read the license that applies to you:
| License family | Ship it in proprietary software you distribute? | The catch |
|---|---|---|
| Permissive — MIT, Apache-2.0, BSD | Yes | Attribution; Apache-2.0 adds an explicit patent grant. |
| Weak copyleft — LGPL, MPL-2.0 | Yes, with conditions | Keep the library’s own source open and let users relink a modified version. |
| Strong copyleft — GPL-2.0 / 3.0 | No — not as proprietary | Distributing a combined work means the whole must be offered under the GPL. |
| Network copyleft — AGPL-3.0 | No — and SaaS counts | Serving a modified version over a network triggers source disclosure. |
| Source-available — BSL, Elastic | Depends | Not OSI-approved; a use restriction (often “no competing service”). |
New to the concept? Start with copyleft licenses explained — it’s the distinction the rest of this table turns on.
Need the pairing rather than the family? The license compatibility matrix answers the specific question — can this dependency go into the thing I am shipping? — for MIT, Apache-2.0, BSD, ISC, MPL, LGPL, GPL, AGPL, BSL and Elastic, with the canonical text behind every verdict.
Permissive licenses
MIT
The most permissive license in common use: commercial, proprietary, closed-source — all fine. One obligation, and it’s per-dependency: keep the copyright and permission notice.
Read the guide →Apache-2.0
Permissive, with an express patent grant MIT lacks — plus a NOTICE-file obligation, and the one real trap: it’s incompatible with GPL-2.0-only.
Read the guide →BSD-3-Clause
Effectively MIT plus a no-endorsement clause. The condition that actually catches teams is reproducing the notice in binary distributions.
Read the guide →Copyleft licenses
MPL-2.0 (file-level copyleft)
The narrowest copyleft: only the covered files and your changes to them stay open. Ships inside proprietary products freely — and gets over-banned because of the “copyleft” label.
Read the guide →Copyleft licenses explained
What copyleft actually requires, the weak → strong → network spectrum, and the one question that decides everything: are you distributing a derivative work?
Read the guide →LGPL-3.0 (weak copyleft)
The one most teams needlessly avoid: proprietary software can use an LGPL library if you allow relinking and keep the library’s own changes open.
Read the guide →GPL-3.0 (strong copyleft)
Commercial use is fine; distributing a combined work is the trigger — the whole becomes GPL. No network clause, so a SaaS backend is a different question.
Read the guide →AGPL-3.0 (network copyleft)
GPL plus Section 13: serving a modified version over a network can force source disclosure — which is why it’s the license corporate policies ban most.
Read the guide →Source-available licenses
Business Source License 1.1 (BSL-1.1)
Source-available, not open source. Free for almost every commercial use — the one catch is the “competing service” restriction, and every version flips to open source on its Change Date.
Read the guide →Elastic License 2.0 (ELv2)
Source-available, not open source. Use, modify, and self-host freely; the single real limit is that you can’t offer the software to others as a managed/hosted service.
Read the guide →Head-to-head comparisons
MIT vs Apache-2.0
Both are safe for commercial, closed-source software — the differences are patents and paperwork. The express patent grant, the NOTICE obligation, and the GPL-2.0 trap.
Compare →Apache-2.0 vs GPL-3.0
Permissive versus strong copyleft — the comparison that actually changes what you can ship. Why you can sell GPL software, the two triggers people get wrong, and why compatibility runs only one way.
Compare →Related reading
From “what does it mean” to “where is it”
Knowing what a license requires only matters if you know which of your dependencies carry it. depproof surfaces the license of every dependency — direct and transitive, as part of a software composition analysis scan — so a forbidden or source-available license can’t hide in the tree:
For developers, the npm and Maven license checks find these per repo; for legal and compliance, the depproof hub aggregates license posture across your whole estate.