GPL and LGPL in a JavaScript bundle
Bundling, minifying and shipping to someone else’s machine counts as distribution. That is the moment the GPL family starts to matter.
This page explains how these licences are commonly read. It is not legal advice; for a product decision with money on it, ask a lawyer who handles open source.
Why bundling changes things
On your own server, GPL code mostly stays your business. When you ship a browser bundle, an Electron app, a React Native app or an on-prem build, the code goes to someone else’s machine. That is distribution, and the GPL applies to it. Bundlers make it worse: webpack or Vite merges modules into one file, which makes it hard to argue that the GPL part is a separate program.
| Licence | What it usually asks when you distribute | licensegate distributed |
|---|---|---|
| GPL-2.0 / GPL-3.0 | The combined work under the GPL, with source available to recipients | block |
| LGPL-2.1 / LGPL-3.0 | Users must be able to replace the library. Keep it separate, keep its notice. | review |
| MPL-2.0 | Changes to MPL files stay MPL; your own files can stay closed | review |
| GPL with a linking exception | Treated like weak copyleft | review |
| MIT, BSD, ISC, Apache-2.0 | Keep the copyright notice and licence text | ok |
Check before you ship
npx -y https://licensegate.org/dl/licensegate.tgz --mode distributed --prod --notices THIRD_PARTY_NOTICES.txtThe notices file collects the licence text of every production dependency. Most permissive licences require you to include that text with your app, so ship it in your About screen or next to the binary.
Libraries published to npm
If you publish a package, use --mode library. A GPL dependency forces your users into the GPL, which is rarely what a library author wants.