License guide · Reference
Open-source license compatibility matrix
The question is never “are these two licenses compatible?” in the abstract — it is “can I put this dependency in the thing I am building?” So the columns below are what you are shipping, and the rows are the license on the dependency you want to pull in. Free, no sign-up, and the whole table is on this page.
Updated 6 Aug 2026 · by the depproof team
Knowledge sharing, not legal advice. This is a simplified engineering reference for the common cases. The controlling text is always the license shipped with the component, and the real answer can turn on how you combine the code — dynamic versus static linking, one binary versus separate processes, distribution versus hosting. Use it to find the questions worth asking a qualified legal professional, not to replace one.
Last reviewed 6 Aug 2026. Spotted an error? hello@depproof.com — corrections are welcome and credited.
Pick one to narrow the table to a single column.
| Dependency license ↓ You are building → | Proprietary, distributed | Proprietary SaaS | Permissive OSS | MPL-2.0 | LGPL-3.0 | GPL-2.0 only | GPL-3.0 | AGPL-3.0 |
|---|---|---|---|---|---|---|---|---|
| MIT Permissive | Yes Yes | Yes Yes | Yes Yes | Yes Yes | Yes Yes | Yes Yes | Yes Yes | Yes Yes |
| ISC Permissive | Yes Yes | Yes Yes | Yes Yes | Yes Yes | Yes Yes | Yes Yes | Yes Yes | Yes Yes |
| BSD-2-Clause Permissive | Yes Yes | Yes Yes | Yes Yes | Yes Yes | Yes Yes | Yes Yes | Yes Yes | Yes Yes |
| BSD-3-Clause Permissive | Yes Yes | Yes Yes | Yes Yes | Yes Yes | Yes Yes | Yes Yes | Yes Yes | Yes Yes |
| Apache-2.0 Permissive | Conditional Yes, with obligations — see the note for this license | Yes Yes | Conditional Yes, with obligations — see the note for this license | Conditional Yes, with obligations — see the note for this license | Conditional Yes, with obligations — see the note for this license | No No | Conditional Yes, with obligations — see the note for this license | Conditional Yes, with obligations — see the note for this license |
| MPL-2.0 File-level copyleft | Conditional Yes, with obligations — see the note for this license | Yes Yes | Conditional Yes, with obligations — see the note for this license | Yes Yes | Conditional Yes, with obligations — see the note for this license | Conditional Yes, with obligations — see the note for this license | Conditional Yes, with obligations — see the note for this license | Conditional Yes, with obligations — see the note for this license |
| LGPL-3.0 Weak copyleft | Conditional Yes, with obligations — see the note for this license | Yes Yes | Conditional Yes, with obligations — see the note for this license | Conditional Yes, with obligations — see the note for this license | Yes Yes | No No | Yes Yes | Yes Yes |
| GPL-2.0 only Strong copyleft | No No | Yes Yes | No No | No No | No No | Yes Yes | No No | No No |
| GPL-3.0 Strong copyleft | No No | Yes Yes | No No | No No | No No | No No | Yes Yes | Yes Yes |
| AGPL-3.0 Network copyleft | No No | No No | No No | No No | No No | No No | Conditional Yes, with obligations — see the note for this license | Yes Yes |
| BSL-1.1 Source-available | Not OSS Not open source — vendor terms apply | Not OSS Not open source — vendor terms apply | Not OSS Not open source — vendor terms apply | Not OSS Not open source — vendor terms apply | Not OSS Not open source — vendor terms apply | Not OSS Not open source — vendor terms apply | Not OSS Not open source — vendor terms apply | Not OSS Not open source — vendor terms apply |
| Elastic-2.0 Source-available | Not OSS Not open source — vendor terms apply | Not OSS Not open source — vendor terms apply | Not OSS Not open source — vendor terms apply | Not OSS Not open source — vendor terms apply | Not OSS Not open source — vendor terms apply | Not OSS Not open source — vendor terms apply | Not OSS Not open source — vendor terms apply | Not OSS Not open source — vendor terms apply |
Row by row — what each license actually asks of you
MIT Permissive
Goes anywhere. The only condition is carrying the copyright and permission notice.
ISC Permissive
Functionally equivalent to MIT; the OpenBSD-derived wording is shorter but the effect is the same.
BSD-2-Clause Permissive
Retain the notice in source and in binary documentation. No endorsement clause.
BSD-3-Clause Permissive
As BSD-2-Clause, plus you may not use contributor names to promote your product.
Apache-2.0 Permissive
The one permissive license with a real trap: incompatible with GPL-2.0-only, because its patent and indemnity terms count as added restrictions. Fine with GPL-3.0. Obligations: propagate the NOTICE file and mark changed files.
MPL-2.0 File-level copyleft
Ships inside proprietary products freely. Your changes to MPL-covered files must be published under the MPL; your own separate files stay yours. GPL-compatible unless the file is marked “Incompatible With Secondary Licenses”.
LGPL-3.0 Weak copyleft
Proprietary software may link it and ship, provided the library stays open and users can relink a modified version — dynamic linking is the easy route. Being GPLv3-based, it does not go into a GPL-2.0-only project.
GPL-2.0 only Strong copyleft
Without the “or later” clause this is the most isolating common license — it cannot move to GPL-3.0. Distribution pulls the whole combined work under the GPL; hosting it as a service does not.
GPL-3.0 Strong copyleft
Distributing a combined work brings the whole thing under the GPL. No network clause — running it as a SaaS is not distribution.
AGPL-3.0 Network copyleft
The only row where “SaaS” is not an escape hatch: offering it over a network triggers source obligations. It can sit alongside GPL-3.0 code, but the AGPL portion keeps its own terms.
BSL-1.1 Source-available
Not an open-source license. Terms are set per-project by the vendor — typically a production-use restriction until a change date, after which it converts to an open license. Read that project’s parameters.
Elastic-2.0 Source-available
Not an open-source license. Broadly permissive except you may not provide the product as a managed service to others, and may not circumvent license keys.
The three traps this table exists to catch
- Apache-2.0 into GPL-2.0-only. The single most common genuine conflict, and it is invisible unless something classifies licenses per component. Apache-2.0 and GPL-3.0 are fine together — the incompatibility is specific to GPL-2.0. Both sides say so in writing: the FSF's license list and the ASF's own GPL-compatibility statement.
- “SaaS means copyleft doesn’t apply.” True for the GPL, LGPL and MPL, whose trigger is distribution. Not true for the AGPL, whose section 13 exists precisely to close that gap.
- Judging by the direct dependencies. Obligations follow the code you ship, not the code you chose. The copyleft component is almost always transitive — several levels below anything in your manifest.
Compatibility is a question about your real tree
A matrix tells you what a pairing means. It cannot tell you which pairings you actually have — that depends on the fully resolved transitive graph of what you ship, which is where the copyleft component nobody chose deliberately tends to be hiding.
- Check your npm dependency licenses — every direct and transitive package, straight from the lockfile.
- Check your Maven dependency licenses — the full transitive tree, with no build.
- MIT vs Apache-2.0 and Apache-2.0 vs GPL-3.0 — two rows of the table read side by side.
- Read the license guides — plain-English pages for each license in the table.
Resolving that tree and labelling every license in it is software composition analysis. depproof does it for Java, JavaScript, Python and Go — direct and transitive, with no build required for Maven — and can fail a build on a license your policy forbids. It runs inside your own network, and it is free for organizations under $1M in revenue.
Sources
Every row links to the canonical text of its own license. The readings that are genuinely contested — rather than simply written down — rest on these:
- FSF — Various Licenses and Comments About Them, the reference for which licenses the FSF considers GPL-compatible.
- Apache Software Foundation — GPL compatibility, the ASF's own account of the GPL-2.0 conflict.
- Mozilla — MPL 2.0 FAQ, on file-level scope and the “Incompatible With Secondary Licenses” notice.
- Open Source Initiative — the Open Source Definition, the basis for calling BSL and Elastic source-available rather than open source.
Where this page and a license text disagree, the license text wins. If you believe a cell is wrong, tell us — hello@depproof.com — and we will fix it and say what changed.
Frequently asked questions
What does license compatibility actually mean?
Two licenses are compatible if you can combine code under both into one work and satisfy every condition of both at the same time. Incompatibility usually means one license demands something the other forbids — the classic case being a copyleft license requiring the whole combined work to be released under its terms while the other license attaches restrictions it does not permit. Compatibility is directional: MIT code can go into a GPL project, but GPL code cannot go into an MIT-licensed one.
Can I use GPL code in a commercial or proprietary product?
You can use it internally without restriction, and you can run it as a hosted service, because neither is distribution. What you cannot do is distribute a proprietary combined work that includes GPL code — doing so requires releasing the whole combined work under the GPL. If the software never leaves your servers, the GPL is not triggered; the AGPL is the variant that closes that gap.
Why is Apache-2.0 incompatible with GPL-2.0?
Apache-2.0 includes patent-termination and indemnification provisions. GPL-2.0 forbids imposing any further restrictions on recipients, and the Free Software Foundation reads those Apache provisions as exactly that. GPL-3.0 was drafted with explicit accommodation for such terms, so Apache-2.0 and GPL-3.0 combine fine. This is version-specific and one of the most commonly missed conflicts in a mixed dependency tree.
Is a source-available license like BSL or Elastic open source?
No. Both restrict use in ways the Open Source Definition does not allow — typically barring you from offering the software as a managed service to third parties. Their terms are set by the vendor, vary per project, and can change between versions, so they cannot be answered by a general compatibility rule. Treat them as commercial licenses you must read individually.
Does license compatibility apply to transitive dependencies?
Yes, and that is where nearly all real problems live. Obligations attach to the code you actually ship, regardless of whether you chose it directly. A permissively-licensed package four levels down can pull in a copyleft component, and nothing in your own manifest will reveal it. Compatibility questions are only answerable against a resolved, full transitive dependency tree.
Is this matrix legal advice?
No. It is a general engineering reference for the common cases, and it deliberately simplifies. Real answers depend on how you combine the code — linking versus separate processes, distribution versus hosting, modification versus verbatim use — and on the exact license text shipped with each component. Use it to find the questions worth asking counsel, not to replace them.
General information, not legal advice; confirm specific decisions with counsel. Free to reference and link — a citation back to this page is appreciated.