When using a dependency with an Apache license but has sub-dependencies under GPL, do I need to open source my own code?

Question

When using a dependency with an Apache license but has sub-dependencies under GPL, do I need to open source my own code?

Based on my own research, it appears I would have to abide by the full line of license terms but I don't totally understand how things like Hadoop could release under Apache 2.0 if they are dependent on "more restrictive" licenses.

Example - Hadoop (https://mvnrepository.com/artifact/org.apache.hadoop/hadoop-common) has dependencies on a variety of Jersey projects which is licensed under CDDL and GPL (https://mvnrepository.com/artifact/com.sun.jersey/jersey-core) and stax.api (https://mvnrepository.com/artifact/javax.xml.stream/stax-api/1.0-2).

Another example - Selenium components (like https://mvnrepository.com/artifact/org.seleniumhq.selenium/htmlunit-driver/2.44.0) has dependencies on a variety of Jetty projects under Apache 2.0 and EPL(https://mvnrepository.com/artifact/org.eclipse.jetty/jetty-http/9.4.20.v20190813).

Answer 1

If the dependency tree of your project somewhere contains a dependency that is only available under the GPL license, then all code in your project and all dependencies must be open-source under a GPL-compatible license and the project itself must be distributed under the GPL license terms.

However, the examples you mention involve dependencies that are dual-licensed. This means that the authors of those dependencies give you a choice between two (or more) licenses and you only have to conform to one of them.

This means that Hadoop, for example, can use Jersey and stax.api both under the CDDL license, which is weakly copyleft and doesn't require larger projects that uses CDDL code to be open-source.