LGPL 3.0 section 4 lets you convey a Combined Work under terms of your choice, as long as the terms do not restrict modifying the library or reverse engineering to debug such changes, and you meet listed duties: notices, license texts, and either relinkable code or shared library linking. Not legal advice.
The text in plain words
Section 4 says you may convey a Combined Work under terms of your choice that, taken together, effectively do not restrict modification of the portions of the Library contained in it and reverse engineering for debugging such modifications, if you also do each of the following.
| Item | What it asks |
|---|---|
| a | Give prominent notice with each copy that the Library is used in it and that the Library and its use are covered by the license |
| b | Accompany the work with a copy of the GNU GPL and the LGPL license document |
| c | If the work displays copyright notices during execution, include the Library's notice and a pointer to the license copies |
| d | Either convey the Minimal Corresponding Source and the Corresponding Application Code in a form that lets the user recombine or relink with a modified Library, or use a suitable shared library mechanism for linking |
| e | Provide installation information, in certain cases |
I only retrieved the opening of item e, so read the full text for its conditions.
Static versus shared linking
Item d offers two paths. With a suitable shared library mechanism, the program uses a copy of the library already on the user's computer at run time and still works with a modified, interface compatible version. With the other path, you provide what is needed to relink the application with a modified library. This is why mobile apps and statically linked binaries get closer attention than server side dynamic use.
Turning it into inventory records
- Record the library, version and LGPL version.
- Record how it is linked: shared or static.
- Record where it ships and whether you modified it.
- Keep the license texts and the notices in your notices file. See third party notices file.
- If linking is static, decide how relinking will be supported, with counsel.
Where teams get surprised
Packaging changes the picture. A library used dynamically in a service may be fine in your tier policy, while the same library bundled statically in a mobile app deserves review. Container base images carry LGPL libraries as well, as covered in listing licenses inside a container image. For wider copyleft questions see what a no copyleft clause means technically.
What investors want to hear
A good answer: here is each LGPL component, how it is linked, where it ships, and who approved. A weak answer: we think it is fine.
Safeguard's SBOM and dependency scanning list LGPL components in builds so you can review them. How you link and ship them is your engineering decision, and counsel checks the obligations.
Quick check
Does LGPL force us to open source our application?
Section 4 allows conveying a Combined Work on your own terms if the listed conditions are met, including allowing modification of the library and relinking or shared linking. Check your facts with counsel.
Is a hosted service using an LGPL library conveying?
The related GPLv3 definitions say network interaction with no copy transferred is not conveying. The LGPL builds on those terms. Confirm with counsel.
Sources
Last reviewed: 19 October 2026.
