Lesson 10 · supply

A nested dependency is still shipped

Compatibility depends on the combination and chosen terms.

A permissive top-level package can include a copyleft dependency. That does not by itself prove an incompatible bundle: the release terms, the work boundary and the obligations determine the outcome. A proprietary-only release may fail where a compatible copyleft release can succeed.

Apache 2.0 and GPL 2.0-only have incompatible conditions for the combined-work scenario modeled here. Apache 2.0 can be incorporated into GPL 3.0 works. Direction and exact versions matter; GPL-2.0-or-later may offer a later-version solution.

This supplied dependency offers Apache 2.0 OR MIT. Select an offered compatible branch and retain its requirements. Changing the dependency's license declaration to an unrelated license is not a new grant.

Keep company policy separate. A permissive-only policy can reject a legally compatible GPL combination. Report a policy rejection as policy, not as a universal statement about the law.

Read the primary terms and guidance ↗

Try it: The nested choice

The distributed app is GPL-2.0-only. A transitive library offers Apache-2.0 OR MIT. Select a compatible branch without changing third-party grants.

Before inspecting the result

What does this supplied release need before its modeled requirements are met?

Already meets the requirementsA concrete repairAdditional evidence or a license choice

Project boundary

2 components

Dependency relationships
From → to	Connection	Semantics
app → library	bundle	intimate

Supplied facts

Distribution: binary
Network interaction: No
Intended use: internal
Evaluation date: 2026-10-24
Policy: learning

These facts define the simulation. Evidence declarations stand in for actual corresponding source, relinkable objects and release materials.

Components

Inspect component

Declared license: GPL-2.0-only
Modified files: None
Artifact: code

Third-party grants remain fixed unless this scenario supplies authority to change them.

Project artifacts

Format library 1.0.0

MIT License

Permission is hereby granted, free of charge, to any person obtaining a copy of this software and
associated documentation files (the "Software"), to deal in the Software without restriction, including
without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the
following conditions:

The above copyright notice and this permission notice shall be included in all copies or substantial
portions of the Software.

THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT
LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO
EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER
IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE
USE OR OTHER DEALINGS IN THE SOFTWARE.

Evidence artifact format

Source offers contain “component: id” and “source: https://…” on separate lines. Covered-file offers also list the covered paths. Relinking declarations contain “replace-compatible-library” for dynamic linking or “relink-object-files” for static linking, and “reverse-engineering-permitted”. These declarations model supplied release artifacts.

License reference

permissions: commercial-use, modifications, distribution, private-use
conditions: include-copyright, include-license
limitations: liability, warranty

Read authoritative terms ↗

Expression builder

SPDX expression

Each row is one selectable alternative. AND retains every term in a row.
Alternative	Required licenses
1	MIT AND LGPL-3.0-only
2	Apache-2.0 AND LGPL-3.0-only

Results appear after submission.