{"id":6113,"date":"2026-03-25T10:59:03","date_gmt":"2026-03-25T14:59:03","guid":{"rendered":"https:\/\/redmonk.com\/sogrady\/?p=6113"},"modified":"2026-03-26T00:25:32","modified_gmt":"2026-03-26T04:25:32","slug":"open-source-licensing-2026","status":"publish","type":"post","link":"https:\/\/redmonk.com\/sogrady\/2026\/03\/25\/open-source-licensing-2026\/","title":{"rendered":"The State of Open Source Licensing in 2026"},"content":{"rendered":"<p>As far back as 2012, a RedMonk colleague was <a href=\"https:\/\/x.com\/monkchips\/status\/247584170967175169\">asserting<\/a> that we were living in a \u201cpost-open source world,\u201d meaning a world in which open source had been so successful that the very things that underpinned it &#8211; open source software licenses, for one &#8211; were <a href=\"https:\/\/redmonk.com\/sogrady\/2018\/05\/11\/taking-open-source-for-granted\/\">taken for granted<\/a> and thus, ignored. This hypothesis was supported by various datapoints ranging from GitHub\u2019s acknowledgement that <a href=\"https:\/\/github.blog\/open-source\/open-source-license-usage-on-github-com\/\">less than 20%<\/a> of the repositories it hosted carried open source licenses to the repeated poor behavior of large companies that should know better <a href=\"https:\/\/redmonk.com\/sogrady\/2017\/09\/26\/facebooks-bsd-patents\/\">brazenly<\/a> and <a href=\"https:\/\/x.com\/sogrady\/status\/1681467730929565701\">cavalierly<\/a> misusing the term open source.<\/p>\n<p>That unfortunate apathy notwithstanding, assertions that open source \u201c<a href=\"https:\/\/www.infoworld.com\/article\/2338846\/the-open-source-licensing-war-is-over.html\">doesn\u2019t really matter<\/a>\u201d have <a href=\"https:\/\/redmonk.com\/sogrady\/2023\/08\/03\/why-opensource-matters\/\">never been<\/a> any more defensible than saying climate change doesn\u2019t matter because the average citizen pays it little mind. While the industry is undergoing tectonic shifts due to the incredible advances in AI, and there are multiple lines of <a href=\"https:\/\/bsky.app\/profile\/pchestek.fosstodon.org.ap.brid.gy\/post\/3mge4gszyyz32\">potentially intractable questions<\/a> about how open source licenses apply in this new era, the fact is that open source software is still being produced, and licensing decisions made around them are still being made strategically &#8211; see Swamp\u2019s <a href=\"https:\/\/github.com\/systeminit\/swamp?tab=License-1-ov-file\">license choice<\/a>, as but one example.<\/p>\n<p>All of which means that it\u2019s important to periodically take stock of the open source licensing landscape, to step back and evaluate its trends and tease apart what those might suggest about our industry and the choices its making moving forward. One of the last times we did this was in 2017, when the best available data was from Black Duck.<\/p>\n<p><a href=\"http:\/\/redmonk.com\/sogrady\/files\/2026\/03\/01_black_duck_2009_2017-1.png\"><img loading=\"lazy\" decoding=\"async\" src=\"http:\/\/redmonk.com\/sogrady\/files\/2026\/03\/01_black_duck_2009_2017-1-1024x546.png\" alt=\"\" width=\"1024\" height=\"546\" class=\"aligncenter size-large wp-image-6120\" srcset=\"https:\/\/redmonk.com\/sogrady\/files\/2026\/03\/01_black_duck_2009_2017-1-1024x546.png 1024w, https:\/\/redmonk.com\/sogrady\/files\/2026\/03\/01_black_duck_2009_2017-1-300x160.png 300w, https:\/\/redmonk.com\/sogrady\/files\/2026\/03\/01_black_duck_2009_2017-1-768x409.png 768w, https:\/\/redmonk.com\/sogrady\/files\/2026\/03\/01_black_duck_2009_2017-1-1536x819.png 1536w, https:\/\/redmonk.com\/sogrady\/files\/2026\/03\/01_black_duck_2009_2017-1-2048x1092.png 2048w, https:\/\/redmonk.com\/sogrady\/files\/2026\/03\/01_black_duck_2009_2017-1-480x256.png 480w, https:\/\/redmonk.com\/sogrady\/files\/2026\/03\/01_black_duck_2009_2017-1-1176x627.png 1176w\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/a><\/p>\n<p>To bring that up to date, we\u2019ve compared and contrasted historical data from sources no longer extant (Black Duck), sources that are still available but have undergone significant, disruptive transitions in the dataset (the GitHub Archive), and current, active sources (deps.dev &#8211; a superset of software package repositories). A few caveats before proceeding:<\/p>\n<ul>\n<li>As noted above, in the largest single source of this data, the overwhelming majority of projects &#8211; likely 80% or more &#8211; do not carry licenses and are thus not represented in this analysis. Given that the cost of producing software is approaching zero thanks to step function changes in code assist abilities, this delta will likely only increase.<\/p>\n<\/li>\n<li>\n<p>There is no single source of truth for the industry. Some datasets as mentioned are no longer available. Others like the GitHub Archive have undergone changes over the years making consistent measure hard to impossible. And none of them have insight into the full spectrum of software written and relied upon behind enterprise firewalls.<\/p>\n<\/li>\n<li>\n<p>Much like with RedMonk\u2019s Programming Language Rankings, then, this analysis should be considered an evaluation of the data that\u2019s available rather than a full fidelity representation of the licensing reality.<\/p>\n<\/li>\n<\/ul>\n<p>Those limitations acknowledged, there are nevertheless some interesting takeaways from the data that is available. Here are the key themes worth noting for open source licensing in 2026.<\/p>\n<h1>The Rise of Permissive Licensing<\/h1>\n<p><a href=\"http:\/\/redmonk.com\/sogrady\/files\/2026\/03\/03_growth_of_permissive.png\"><img loading=\"lazy\" decoding=\"async\" src=\"http:\/\/redmonk.com\/sogrady\/files\/2026\/03\/03_growth_of_permissive-1024x551.png\" alt=\"\" width=\"1024\" height=\"551\" class=\"aligncenter size-large wp-image-6122\" srcset=\"https:\/\/redmonk.com\/sogrady\/files\/2026\/03\/03_growth_of_permissive-1024x551.png 1024w, https:\/\/redmonk.com\/sogrady\/files\/2026\/03\/03_growth_of_permissive-300x161.png 300w, https:\/\/redmonk.com\/sogrady\/files\/2026\/03\/03_growth_of_permissive-768x413.png 768w, https:\/\/redmonk.com\/sogrady\/files\/2026\/03\/03_growth_of_permissive-1536x826.png 1536w, https:\/\/redmonk.com\/sogrady\/files\/2026\/03\/03_growth_of_permissive-2048x1102.png 2048w, https:\/\/redmonk.com\/sogrady\/files\/2026\/03\/03_growth_of_permissive-480x258.png 480w, https:\/\/redmonk.com\/sogrady\/files\/2026\/03\/03_growth_of_permissive-1166x627.png 1166w\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/a><\/p>\n<p>Noted <a href=\"https:\/\/redmonk.com\/sogrady\/2014\/11\/14\/open-source-licenses\/\">here<\/a> well over a decade ago, the industry has been amidst a long term shift away from more restrictive, copyleft-style licenses to more permissive alternatives. The precise ratio of copyleft to permissive licenses has depended on the year and the particular sample surveyed, but they all have shown a marked shift away from copyleft licenses.<\/p>\n<p>It\u2019s difficult to pinpoint the exact point in time that we moved from a copyleft majority licensing environment to a permissive one, but a reasonable estimate is that the industry unknowingly crossed that chasm at some point between 2014 and 2017.<\/p>\n<p>To some degree, this was inevitable, as copyleft\u2019s absolute dominance from a licensing standpoint can be appropriately understood as being at least in part an artifact of the overwhelming popularity of copyleft projects such as Linux and MySQL. Greater license diversity was always likely, if not inevitable.<\/p>\n<p>One interesting question is whether, as so often happens in industry, the pendulum will begin to swing back towards copyleft. With the caveat that there are odd small sample size issues with recent GitHub Archive data, there is some evidence to suggest this. Permissive licenses have ticked down from a high of 82% in 2022 to 73% in 2025. Again, this could simply be a sampling issue &#8211; the packaging data from deps.dev indicates no similar shift &#8211; but it\u2019s worth watching if only because of the recent return from a few major projects to the AGPLv3 in particular which will be discussed more momentarily.<\/p>\n<h1>License Distribution by Package Ecosystem<\/h1>\n<p><a href=\"http:\/\/redmonk.com\/sogrady\/files\/2026\/03\/05_ecosystem_breakdown-1.png\"><img loading=\"lazy\" decoding=\"async\" src=\"http:\/\/redmonk.com\/sogrady\/files\/2026\/03\/05_ecosystem_breakdown-1-1024x465.png\" alt=\"\" width=\"1024\" height=\"465\" class=\"aligncenter size-large wp-image-6124\" srcset=\"https:\/\/redmonk.com\/sogrady\/files\/2026\/03\/05_ecosystem_breakdown-1-1024x465.png 1024w, https:\/\/redmonk.com\/sogrady\/files\/2026\/03\/05_ecosystem_breakdown-1-300x136.png 300w, https:\/\/redmonk.com\/sogrady\/files\/2026\/03\/05_ecosystem_breakdown-1-768x349.png 768w, https:\/\/redmonk.com\/sogrady\/files\/2026\/03\/05_ecosystem_breakdown-1-1536x698.png 1536w, https:\/\/redmonk.com\/sogrady\/files\/2026\/03\/05_ecosystem_breakdown-1-2048x930.png 2048w, https:\/\/redmonk.com\/sogrady\/files\/2026\/03\/05_ecosystem_breakdown-1-480x218.png 480w, https:\/\/redmonk.com\/sogrady\/files\/2026\/03\/05_ecosystem_breakdown-1-1200x545.png 1200w\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/a><\/p>\n<p>Before looking at license traction as a whole, it\u2019s worth examining community-level differences and drivers. This is based on data extracted from deps.dev, and looks at the license distribution across seven major package repositories.<\/p>\n<p>As is evident, these repositories &#8211; like the data more broadly &#8211; tend to skew permissive. There are notable issues with certain repositories &#8211; in NuGET, the .NET package repository, more than half the packages have licenses that don\u2019t map to SPDX identifiers and are thus unclassifiable. The npm package repository, meanwhile, skews heavily towards the ISC license as npm init historically defaulted to it. Maven\u2019s Java focus, meanwhile, left it solidly in Apache\u2019s orbit.<\/p>\n<p>It\u2019s worth noting, however, that these packages generally reflect deployed code, and as will be shown momentarily, the deployed code shows higher rates of permissive license usage than copyleft. That being said, also as we\u2019ll come back to, npm\u2019s weight in this sample &#8211; being roughly 3X more than the other repos combined &#8211; is overrepresented.<\/p>\n<h1>Apache vs MIT<\/h1>\n<p><a href=\"http:\/\/redmonk.com\/sogrady\/files\/2026\/03\/02_gh_archive_trends_2011_2025-scaled.png\"><img loading=\"lazy\" decoding=\"async\" src=\"http:\/\/redmonk.com\/sogrady\/files\/2026\/03\/02_gh_archive_trends_2011_2025-1024x504.png\" alt=\"\" width=\"1024\" height=\"504\" class=\"aligncenter size-large wp-image-6121\" srcset=\"https:\/\/redmonk.com\/sogrady\/files\/2026\/03\/02_gh_archive_trends_2011_2025-1024x504.png 1024w, https:\/\/redmonk.com\/sogrady\/files\/2026\/03\/02_gh_archive_trends_2011_2025-300x148.png 300w, https:\/\/redmonk.com\/sogrady\/files\/2026\/03\/02_gh_archive_trends_2011_2025-768x378.png 768w, https:\/\/redmonk.com\/sogrady\/files\/2026\/03\/02_gh_archive_trends_2011_2025-1536x756.png 1536w, https:\/\/redmonk.com\/sogrady\/files\/2026\/03\/02_gh_archive_trends_2011_2025-2048x1008.png 2048w, https:\/\/redmonk.com\/sogrady\/files\/2026\/03\/02_gh_archive_trends_2011_2025-480x236.png 480w, https:\/\/redmonk.com\/sogrady\/files\/2026\/03\/02_gh_archive_trends_2011_2025-1200x591.png 1200w\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/a><\/p>\n<p>The two primary beneficiaries of the rise of permissive licensing have been the Apache Software License and the MIT. In part because of its patent termination provisions that attempt to minimize the possibility of patent infringement litigation, Apache has tended to be the preference for commercial open source usage versus the MIT license which does not mention patents at all.<\/p>\n<p>Both licenses dramatically improved their share of usage over the past two decades, but following the creation of the CNCF which favored Apache licenses in 2015 and the introduction of popular Apache licensed projects like TensorFlow in the same year and PyTorch the year after in 2016, Apache\u2019s share of distribution began climbing in 2017 to a peak in this dataset of around 30% in 2022. This corresponded with a slight but noticeable  decline in MIT\u2019s share over that  time, suggesting that the growth of the one came at least indirectly at the expense of the other.<\/p>\n<p>In 2023, however, this trend reversed in dramatic fashion, and Apache usage dropped dramatically while MIT spiked. In all likelihood, this is an artifact of oddly smaller sample sizes post-2022, culminating in a dramatically smaller 2025 sample RedMonk is still seeking explanations for as we perform our regular biannual programming language ranking.<\/p>\n<p>It\u2019s also possible that it\u2019s in part a reflection of the aforementioned outsized significance of JavaScript as a language and npm as a repository, as the latter favors MIT and hosts by far the most packages. Which brings us in turn to:<\/p>\n<h1>The Packaging Filter<\/h1>\n<p><a href=\"http:\/\/redmonk.com\/sogrady\/files\/2026\/03\/04_packaging_filter-1.png\"><img loading=\"lazy\" decoding=\"async\" src=\"http:\/\/redmonk.com\/sogrady\/files\/2026\/03\/04_packaging_filter-1-1024x551.png\" alt=\"\" width=\"1024\" height=\"551\" class=\"aligncenter size-large wp-image-6123\" srcset=\"https:\/\/redmonk.com\/sogrady\/files\/2026\/03\/04_packaging_filter-1-1024x551.png 1024w, https:\/\/redmonk.com\/sogrady\/files\/2026\/03\/04_packaging_filter-1-300x161.png 300w, https:\/\/redmonk.com\/sogrady\/files\/2026\/03\/04_packaging_filter-1-768x413.png 768w, https:\/\/redmonk.com\/sogrady\/files\/2026\/03\/04_packaging_filter-1-1536x826.png 1536w, https:\/\/redmonk.com\/sogrady\/files\/2026\/03\/04_packaging_filter-1-2048x1102.png 2048w, https:\/\/redmonk.com\/sogrady\/files\/2026\/03\/04_packaging_filter-1-480x258.png 480w, https:\/\/redmonk.com\/sogrady\/files\/2026\/03\/04_packaging_filter-1-1166x627.png 1166w\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/a><\/p>\n<p>One interesting exercise to consider is what deltas if any there might be between hosted source code and packaged code about to be deployed. In general, the differences tend to be minimal, but one obvious distinction is in the aforementioned outperformance of ISC. A historical default for npm, it is dramatically over-represented in the deps.dev dataset, being 31X more common there than on GitHub &#8211; a natural consequence of npm\u2019s immense presence.<\/p>\n<p>Both GPL licenses, for their part, are much more common on GitHub &#8211; 34X more common in the case of version 2 &#8211; than in deps.dev, which is predictable given the latter\u2019s overwhelming preference for permissive rather than than copyleft licenses.<\/p>\n<p>As a side note, while reading this chart: the \u201cUnlicense\u201d above is not a typo for \u201cUnlicensed,\u201d it\u2019s an <a href=\"https:\/\/en.wikipedia.org\/wiki\/Unlicense\">actual license<\/a> that says, essentially, users can do whatever they want they want with the code. It&#8217;s more or less public domain for source code.<\/p>\n<h1>Source Available Licenses<\/h1>\n<p>One last question when surveying the state of licensing in 2026 is the degree to which non-open source, source available or hybrid licenses such as the BSL or SSPL are in circulation. The short answer to this is that these licenses are not measurable in a statistically significant way. They remain extremely uncommon and are not trending.<\/p>\n<p>While they are not relevant statistically, however, they remain for the time being strategically relevant because of the projects that carry them (e.g. MongoDB, Terraform, etc). While there have been notable returns to open source licenses from source available alternatives &#8211; Elastic and Redis, for example, returned to an OSI approved license in the AGPL &#8211; the long term future of source available licensing will not be determined by a quantitative analysis such as this.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>As far back as 2012, a RedMonk colleague was asserting that we were living in a \u201cpost-open source world,\u201d meaning a world in which open source had been so successful that the very things that underpinned it &#8211; open source software licenses, for one &#8211; were taken for granted and thus, ignored. This hypothesis was<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"spay_email":"","footnotes":"","jetpack_publicize_message":"","jetpack_is_tweetstorm":false},"categories":[61],"tags":[],"class_list":["post-6113","post","type-post","status-publish","format-standard","hentry","category-open-source"],"jetpack_featured_media_url":"","jetpack_publicize_connections":[],"jetpack_sharing_enabled":true,"_links":{"self":[{"href":"https:\/\/redmonk.com\/sogrady\/wp-json\/wp\/v2\/posts\/6113","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/redmonk.com\/sogrady\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/redmonk.com\/sogrady\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/redmonk.com\/sogrady\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/redmonk.com\/sogrady\/wp-json\/wp\/v2\/comments?post=6113"}],"version-history":[{"count":0,"href":"https:\/\/redmonk.com\/sogrady\/wp-json\/wp\/v2\/posts\/6113\/revisions"}],"wp:attachment":[{"href":"https:\/\/redmonk.com\/sogrady\/wp-json\/wp\/v2\/media?parent=6113"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/redmonk.com\/sogrady\/wp-json\/wp\/v2\/categories?post=6113"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/redmonk.com\/sogrady\/wp-json\/wp\/v2\/tags?post=6113"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}