nodebb safe for commercial use?npm package · License: GPL-3.0
nodebb is licensed under GPL-3.0. That triggers obligations in 3 of the 5 common shipping models, so whether it is safe for you depends on how you ship.
| How you ship it | Result | Why |
|---|---|---|
| Hosted SaaS | No obligation | GPL-3.0 triggers its obligations on distribution. Your distribution model is hosted SaaS, which is not distribution, so no obligation arises today. Shipping this software later — on-premises delivery, a binary, or a published library — would trigger whole-work source disclosure. |
| Distributed binary / app | Obligation triggered | GPL-3.0 requires that a work incorporating it, when distributed, be licensed as a whole under the same terms with corresponding source made available. Your distribution model is distributed binary or application, which triggers that obligation. |
| Delivered to customer | Obligation triggered | GPL-3.0 requires that a work incorporating it, when distributed, be licensed as a whole under the same terms with corresponding source made available. Your distribution model is software delivered to a customer environment, which triggers that obligation. |
| Internal use only | No obligation | GPL-3.0 triggers its obligations on distribution. Your distribution model is internal use only, which is not distribution, so no obligation arises today. Shipping this software later — on-premises delivery, a binary, or a published library — would trigger whole-work source disclosure. |
| Published library | Obligation triggered | GPL-3.0 requires that a work incorporating it, when distributed, be licensed as a whole under the same terms with corresponding source made available. Your distribution model is a published library, which triggers that obligation. |
Source disclosureSame license
If you only use it at build time, the answer changes.
GPL-3.0 appears as a dev dependency, so it is not part of the artifact you ship. Distribution-triggered obligations do not arise. Tools that emit code into your output, such as code generators, are a separate case worth checking individually.
This page covers one package. Your package-lock.json has many more.
Check your whole manifest →The license was read from the npm registry, then evaluated against each shipping model. Only the declared license is considered; code copied into a project's own source files is not detected by this method.
LicenseGuard reports information derived from published license texts and dependency manifests. It is not legal advice and using it does not create an attorney-client relationship. Results reflect license metadata as declared; they do not identify every obligation or violation. Consult qualified counsel for decisions that matter.