Assume somebody writes software and distributes it to customers. Since any dependency under a copyleft license (such as the GPL) would require putting the whole software under a copyleft license, those are carefully avoided by checking license statements of all dependencies and (fully recursively) their dependencies.
Now imagine the following scenario: Dependency A is used, and according to the license statement, it is published under a permissive license (such as MIT, BSD or Apache). Now a contributor C writes some kind of new feature and puts a comment in the source code: "This feature is licensed under the GPL." The main author / maintainer M of dependency A overlooks the comment and approves the pull request. Also, there is no contributor's agreement explicitly stating that all contributions must be put under the license that already applies to A.
- Am I correct to assume that while most of dependency A is under a permissive license, the new feature is under the GPL? This would imply that any software using A must meet all requirements of the GPL?
- For anybody using dependency A, is there a practical way to check for subtleties like this?