Apache-2.0 · Permissive
Permissive, but with two things MIT lacks: an explicit patent grant from contributors, and a requirement to carry forward any NOTICE file. Companies wary of patent exposure often prefer it over MIT for that reason.
The same license produces different obligations depending on whether the software is distributed, hosted, or kept internal. This is the distinction most dependency scanners collapse.
| How you ship it | Result | Why |
|---|---|---|
| Hosted SaaS | No obligation | Apache-2.0 section 4 requires retaining copyright notices, a copy of the license, and any NOTICE file. Section 3 grants a patent license from contributors. There is no source-disclosure obligation. |
| Distributed binary / app | No obligation | Apache-2.0 section 4 requires retaining copyright notices, a copy of the license, and any NOTICE file. Section 3 grants a patent license from contributors. There is no source-disclosure obligation. |
| Delivered to customer | No obligation | Apache-2.0 section 4 requires retaining copyright notices, a copy of the license, and any NOTICE file. Section 3 grants a patent license from contributors. There is no source-disclosure obligation. |
| Internal use only | No obligation | Apache-2.0 section 4 requires retaining copyright notices, a copy of the license, and any NOTICE file. Section 3 grants a patent license from contributors. There is no source-disclosure obligation. |
| Published library | No obligation | Apache-2.0 section 4 requires retaining copyright notices, a copy of the license, and any NOTICE file. Section 3 grants a patent license from contributors. There is no source-disclosure obligation. |
AttributionNOTICE filePatent grant
As a build-time dependency it is a different question.
Apache-2.0 appears as a dev dependency, so it is not part of the artifact you ship. Distribution-triggered obligations do not arise. Tools that emit code into your output, such as code generators, are a separate case worth checking individually.
Want to know whether anything in your project is under Apache-2.0?
Check your whole manifest →LicenseGuard reports information derived from published license texts and dependency manifests. It is not legal advice and using it does not create an attorney-client relationship. Results reflect license metadata as declared; they do not identify every obligation or violation. Consult qualified counsel for decisions that matter.