For GNU licenses, SPDX guidance says to use -only or -or-later rather than a bare ID. The suffix states whether the project accepts only the named version or also any later version. When you read a dependency, the suffix tells you which versions of the license your own distribution may rely on.
What the suffixes say
GPL-2.0-only means version 2 and nothing else. GPL-2.0-or-later means version 2, or any later version the recipient prefers. The same pattern applies to LGPL, AGPL and GFDL.
Older code often says "GPL version 2 or any later version" in prose, which maps to or-later. Code that says only "GPL version 2" with no mention of later versions maps to only. A bare "GPL-2.0" in a package manifest is ambiguous, which is the reason the guidance discourages it.
The plus sign is for other licenses
The SPDX guidance describes a trailing + for non GNU licenses, such as EPL-1.0+ or AFL-2.0+, meaning that version or any later one. It does not use the plus form for GNU licenses. If you see GPL-2.0+ in an older manifest, treat it as a legacy spelling and confirm the intent by reading the source headers.
Why it matters to you
Suppose you combine two components. One is GPL-2.0-only and the other is GPL-3.0-only. Each insists on its own version, so you cannot simply pick one version that satisfies both. This is a known source of friction when mixing GPL versions. Whether a specific combination is permitted is a legal question for your counsel, not something a tag settles.
If either component were or-later, you would have more room, because the recipient may choose a later version. The suffix is the quickest way to spot that room.
How to check a dependency
- Read the manifest license field and see whether it uses an SPDX ID with a suffix.
- Open the license file and any header comments in the source.
- Look for the phrase "or any later version" or its absence.
- Record the result as
onlyoror-laterin your inventory, not as bare GPL. - If the manifest and the headers disagree, ask the maintainers or avoid the component until clarified.
Keep your own tags exact
If you publish code under a GNU license, choose deliberately. Choosing or-later hands future versions of the license to the people who receive your code. Choosing only locks the version you name. Neither is wrong, but the choice should be made on purpose and written down in your files.
Use the tag format in how to add SPDX license identifiers. For choosing a license in the first place, see how to choose an open source license.
Safeguard's SBOM and dependency scanning give you a component inventory to review, and you can try a free scan.
Quick check
Is GPL-2.0 the same as GPL-2.0-only?
Not safely. The bare ID is ambiguous, so SPDX guidance asks for an explicit suffix. Check the source headers to see which was meant.
Does or-later mean I can ignore the original version?
It means the recipient may choose that version or a later one. The original version remains an available option.
Sources
Last reviewed: 19 October 2026.
