A GPL finding in a target's code is a question, not a verdict. The first job is to establish facts: which component, how it is linked, whether it is shipped, and under which GPL version. Then there are five practical responses, and which one fits depends on those facts.
Facts to gather first
- The exact license identifier, including the version and the only or later suffix.
- Whether the product is distributed to customers, or only run on the target's servers.
- How the component connects to the rest, in process or as a separate program.
- Whether the target modified it.
- Whether the code is a direct dependency or came in transitively.
The GNU FAQ draws a line between private use, which needs no source release, and conveying copies, which does. A hosted product that never ships binaries is in a different position from an appliance or a desktop installer.
The five responses
- Comply. Release the Corresponding Source for the covered code, add license texts and notices. Works when the exposed code has little competitive value.
- Replace. Swap in a component under a compatible license, or write a replacement. Requires engineering time and testing.
- Isolate. Move the component into a separate program with a communication style the FAQ treats as separate programs. Needs a careful architecture review.
- Relicense. Ask the copyright holder for different terms or an exception. Possible when one entity holds all the rights.
- Remove. Drop the feature that uses it, if the feature is minor.
Choosing
Compliance is cheapest when the component is a peripheral tool and the target never modified it. Replacement is common for libraries linked into a proprietary core. Isolation works only if the boundary is real. Relicensing depends on the rightsholder.
Deal mechanics
Findings often turn into closing conditions, price adjustments or a post closing remediation plan with an owner and a date. Keep the audit report, the evidence and the plan together. Section 8 of GPLv3 describes how a license can be reinstated after a violation stops, which is relevant if past distribution was out of compliance; see the reinstatement post.
Safeguard's SBOM and dependency scanning can produce a component list for a target's repositories during diligence. See the free scan. Legal conclusions should come from counsel.
Quick check
Does a GPL dependency always force a target to release its code?
No. It depends on whether copies are distributed, how the code is combined, and the license version. Establish those facts first.
What is the cheapest fix?
Often compliance for a peripheral, unmodified tool, or replacement for a library linked into a proprietary core.
Sources
This post is general information, not legal advice.
Last reviewed: 19 October 2026.
