LGPL-3.0-only · Library-level copyleft
Weak copyleft built on GPL-3.0 with a linking exception. The practical question is almost always static versus dynamic linking, since static linking triggers the relinking obligation.
The same license produces different obligations depending on whether the software is distributed, hosted, or kept internal. This is the distinction most dependency scanners collapse.
| How you ship it | Result | Why |
|---|---|---|
| Hosted SaaS | No obligation | LGPL-3.0-only requires publishing modifications to the library itself, but under dynamic linking that obligation does not extend to the code that calls it. |
| Distributed binary / app | No obligation | LGPL-3.0-only requires publishing modifications to the library itself, but under dynamic linking that obligation does not extend to the code that calls it. |
| Delivered to customer | No obligation | LGPL-3.0-only requires publishing modifications to the library itself, but under dynamic linking that obligation does not extend to the code that calls it. |
| Internal use only | No obligation | LGPL-3.0-only requires publishing modifications to the library itself, but under dynamic linking that obligation does not extend to the code that calls it. |
| Published library | No obligation | LGPL-3.0-only requires publishing modifications to the library itself, but under dynamic linking that obligation does not extend to the code that calls it. |
Source disclosureAttribution
As a build-time dependency it is a different question.
LGPL-3.0-only appears as a dev dependency, so it is not part of the artifact you ship. Distribution-triggered obligations do not arise. Tools that emit code into your output, such as code generators, are a separate case worth checking individually.
For compiled languages such as Go and Rust, dependencies are normally linked statically, which alters what LGPL-3.0-only asks of you.
| How you ship it | Result | Why |
|---|---|---|
| Hosted SaaS | Needs review | LGPL-3.0-only requires that recipients be able to replace the library with a modified version. Under static linking this normally means shipping object files or equivalent relinking material. Static linking was assumed here, so this case needs individual review. |
| Distributed binary / app | Needs review | LGPL-3.0-only requires that recipients be able to replace the library with a modified version. Under static linking this normally means shipping object files or equivalent relinking material. Static linking was assumed here, so this case needs individual review. |
| Delivered to customer | Needs review | LGPL-3.0-only requires that recipients be able to replace the library with a modified version. Under static linking this normally means shipping object files or equivalent relinking material. Static linking was assumed here, so this case needs individual review. |
| Internal use only | Needs review | LGPL-3.0-only requires that recipients be able to replace the library with a modified version. Under static linking this normally means shipping object files or equivalent relinking material. Static linking was assumed here, so this case needs individual review. |
| Published library | Needs review | LGPL-3.0-only requires that recipients be able to replace the library with a modified version. Under static linking this normally means shipping object files or equivalent relinking material. Static linking was assumed here, so this case needs individual review. |
Want to know whether anything in your project is under LGPL-3.0-only?
Check your whole manifest →LicenseGuard reports information derived from published license texts and dependency manifests. It is not legal advice and using it does not create an attorney-client relationship. Results reflect license metadata as declared; they do not identify every obligation or violation. Consult qualified counsel for decisions that matter.