Am I in danger if a project component is relicensed?

Question

I am currently managing a project, which includes a library that is licensed under the MIT license. My current project is licensed under the Apache 2.0 license.

The maintainers of the library that I am using then relicense their project to a much stronger license, the GPL. I'm not informed of this in anyway: I took the source and included it within my project.

Since I am now using a library that is arguably improperly licensed, and that fails to meet the conditions of the newer GPL, I need to know a few things:

• Would I be in violation of the GPL? Since the included project had been relicensed, would the MIT license still apply?

• Am I under any obligation to then relicense my project under the GPL, despite my copy of the project includes the MIT license? Would I have to update the license file in my copy of the project?

Answer 1

The important thing to know is that they (almost certainly (*)) cannot retroactively change the license of the version that you are using. They can change the license to new versions they release. So, if you want to keep using what you took when it was marked MIT, you are fine. You can even make a fork and invite other like-minded people to enhance and maintain that fork under the MIT license.

Here is the (*). If they are saying that they made a mistake in the first place, and licensed content under the MIT license that they did not have the right to license, then you and everyone else will need to make other arrangements. Since you incorporated it in your Apache work in good faith, you have a lot of room to maneuver in the timing of making those other arrangements.

So, are you in 'danger'? No, you are not in acute danger if you have not copied new source since they applied the new license. Might you need to take action to avoid legal exposure? You might, but only in the (*) case above.

Answer 2

Your options here are

• pin the version of the library you use at the last point where it was licensed as MIT.
• fork the library at the last MIT-licensed commit
• Re-license your own project as GPL

What you can't do is continue to use the latest GPL'd version of the library and release your project under Apache 2.0 (unless the library is LGPL and you meet the linking requirements).

Pinning yourself to a specific version means you need to live with any bugs that existed at that point, and will not have access to new features.

Forking means you now need to fix bugs yourself (without looking at the upstream fixes), and maintain your own fork forever. I discussed some of the problems in my question on forking.

Answer 3

No; you're OK.

It's nigh-on impossible to enforce a new license on old distributions of a project, for this very fact. It was at one point distributed under the MIT license, and there may be people who got their copy of it then and never heard about the license change. The best a project owner can do is to ask nicely if people would mind changing to come into compliance with a difference license, but people are free to say no.

The one exception is if the project maintainers themselves were committing (sensibly or not) copyright violation of someone else's code. If so, they have to relicense to come into compliance with that. You are still committing copyright violation if you keep the old license, but you have a little more legroom to negotiate conditions of changing license, since you weren't the one who caused the violation, and didn't know about it.