GPL-3.0-only · Strong copyleft
Strong copyleft, with added anti-tivoization and patent-retaliation terms over v2. Like v2, its obligations attach to distribution, not to operating a hosted service.
The same license produces different obligations depending on whether the software is distributed, hosted, or kept internal. This is the distinction most dependency scanners collapse.
| How you ship it | Result | Why |
|---|---|---|
| Hosted SaaS | No obligation | GPL-3.0-only triggers its obligations on distribution. Your distribution model is hosted SaaS, which is not distribution, so no obligation arises today. Shipping this software later — on-premises delivery, a binary, or a published library — would trigger whole-work source disclosure. |
| Distributed binary / app | Obligation triggered | GPL-3.0-only requires that a work incorporating it, when distributed, be licensed as a whole under the same terms with corresponding source made available. Your distribution model is distributed binary or application, which triggers that obligation. |
| Delivered to customer | Obligation triggered | GPL-3.0-only requires that a work incorporating it, when distributed, be licensed as a whole under the same terms with corresponding source made available. Your distribution model is software delivered to a customer environment, which triggers that obligation. |
| Internal use only | No obligation | GPL-3.0-only triggers its obligations on distribution. Your distribution model is internal use only, which is not distribution, so no obligation arises today. Shipping this software later — on-premises delivery, a binary, or a published library — would trigger whole-work source disclosure. |
| Published library | Obligation triggered | GPL-3.0-only requires that a work incorporating it, when distributed, be licensed as a whole under the same terms with corresponding source made available. Your distribution model is a published library, which triggers that obligation. |
Source disclosureSame license
As a build-time dependency it is a different question.
GPL-3.0-only appears as a dev dependency, so it is not part of the artifact you ship. Distribution-triggered obligations do not arise. Tools that emit code into your output, such as code generators, are a separate case worth checking individually.
Want to know whether anything in your project is under GPL-3.0-only?
Check your whole manifest →LicenseGuard reports information derived from published license texts and dependency manifests. It is not legal advice and using it does not create an attorney-client relationship. Results reflect license metadata as declared; they do not identify every obligation or violation. Consult qualified counsel for decisions that matter.