Open source isn't always open: a developer's guide to license changes

For most of a decade, "open source" on the label was enough. Then came the relicensing wave: Elasticsearch to SSPL in 2021, HashiCorp moving Terraform and Vault to BUSL in 2023, Redis dropping BSD in 2024 — and a counter-wave of forks (OpenSearch, OpenTofu, Valkey, OpenBao) backed by foundations. In 2025, Redis partially reversed course, returning under AGPLv3. If you build on infrastructure, license literacy is now part of the job.

The licenses you'll actually encounter

Permissive (MIT, Apache-2.0, BSD). Use it, fork it, sell it. The overwhelming majority of tools in this directory — ripgrep, Playwright, Docusaurus — sit here, and for users these licenses carry essentially no risk.

Copyleft (GPL, AGPL). Free to use; modifications you distribute must stay open. AGPL extends that to software offered over a network, which is why cloud vendors avoid it — and why projects like Grafana and now Redis chose it. For a company using these tools internally, the obligations are lighter than the fear suggests. For a company reselling them as a service, they bite.

Source-available (BUSL, SSPL, FSL, ELv2). You can read and usually use the code, but with restrictions — typically a ban on offering the software as a competing managed service. BUSL adds a twist: code converts to a true open-source license after a delay (usually four years). Sentry's FSL converts after two. These are not open source by the OSI definition, but for most end users they function like it.

What relicensing actually means for you

The practical risks are narrower than the headlines, but real:

1. You run the tool as an internal service — almost always fine under every license above.
2. You embed it in a product you ship — copyleft and source-available terms both need legal review.
3. You offer it as a managed service — this is the case the new licenses exist to prevent.
4. You depend on the ecosystem — the subtle one. A license change fractures communities: plugins, Stack Overflow answers, and hiring pools split between the original and the fork.

How to evaluate license risk before adopting

• Check who holds the copyright. Projects owned by a foundation (CNCF's Prometheus, the Linux Foundation's OpenBao) effectively can't be relicensed; projects where a single vendor holds a CLA can be, overnight.
• Watch for the warning signs. A vendor taking large funding rounds while its cloud competitors grow is the classic setup. CLAs that assign copyright are the mechanism.
• Know your fork options in advance. Valkey (Redis), OpenTofu (Terraform), and OpenSearch (Elasticsearch) all reached production quality within a year, with major-cloud backing. A credible fork is your insurance policy — note whether one exists.
• Treat "source-available" honestly. If you just need to read the code and run it internally, FSL/BUSL tools are usually fine. Flag them in your dependency inventory anyway; terms differ in details that matter later.

In this directory, we label each tool's license on its page — including the awkward ones — and we update listings when licenses change, because a listing that says "open source" about a BUSL project isn't a simplification. It's wrong.