Yes, it can. The GNU FAQ separates two cases. A modified GPL program running on your server is not distributed to users. But a GPL program that your site sends to visitors, often JavaScript, is distributed to them, so its source must be released to them under the GPL. Not legal advice.
Definition: server side versus browser side
The FAQ answers a question about a company running a modified GPLed program on a web site. The GPL permits anyone to make a modified version and use it without distributing it, and a website is a special case of that. The company does not have to release the modified sources. The situation differs under the GNU Affero GPL.
Then the FAQ adds the second case. If the website contains or links to separate GPLed programs that are distributed to the user when they visit the site, often written in JavaScript, the source code for those programs being distributed must be released to the user under the GPL.
Why this surprises web teams
A single page app ships a large bundle to every visitor. If any library in that bundle is GPL, you are conveying copies of it with every page view. The server never needs to be open, but the bundle does.
| Where the GPL code runs | Copy sent to users? | Release duty (GPL) |
|---|---|---|
| Your server, modified | No | None under the GPL |
| Your server, AGPL modified | No copy, but network users | Offer source to users per the AGPL |
| Browser, GPL library in your bundle | Yes | Source for that program to users |
| Mobile app webview loading GPL script | Yes | Same reasoning, since the script is delivered |
How your own code relates to the GPL library, as separate programs or one combined work, is the question to settle with counsel.
A frontend checklist
- Generate a list of every package in the production bundle, not just direct imports.
- Check each license, including those of transitive dependencies. Note GPL, LGPL and AGPL families.
- For any GPL library in the bundle, decide: replace, remove, or comply.
- If you comply, publish the corresponding source for the exact build shipped, with clear instructions.
- Keep license comments intact in minified files when the license asks for notices.
- Recheck on every dependency update. A new transitive package can change the answer silently.
Why a build time rule helps
Frontend dependency trees change often. A rule that fails the build when a copyleft license appears in the bundle catches the problem early, without anyone remembering to look. The gate demo below shows how such a check blocks a pull request.
Try it yourself
Click through the pull request gate and look at how a failed check holds the merge until the finding is resolved. Picture the rule as "no GPL package in the shipping bundle without sign off".
Click through it at your own pace, or open it full screen.
Safeguard's SBOM and dependency scanning list what is in your build, and policies and gates can hold a pull request for review. A free scan is available at gold.safeguard.sh/scan.
Quick check
Do I need to open source my backend if I use a GPL web framework unmodified?
The FAQ says running a GPL program on a server without distributing it does not trigger a release duty. Check whether any GPL code is also sent to browsers.
Why does JavaScript differ from server code?
Because it is delivered to the visitor. That is distribution of a copy.
Does the AGPL change this?
Yes. The FAQ says the AGPL asks modified versions to offer source to users interacting over a network.
Sources
Last reviewed: 19 October 2026.
