You can ship proprietary software that links to an LGPL library, but not for free of conditions. LGPLv3 section 4 asks for a notice, license copies, and one of two routes: a relinkable package or a suitable shared library mechanism. Dynamic linking helps with the second route. It does not erase the first set of duties.
What the license allows
Section 4 lets you convey a Combined Work, meaning your application linked with the library, under terms of your choice. The catch is that those terms must not block modifying the library portions or reverse engineering to debug such modifications.
So a closed application is fine. A license clause forbidding users from swapping the library or debugging that swap is not.
The obligations list
When you convey the combined work, section 4 asks you to:
- give a prominent notice that the library is used and covered by the license;
- ship a copy of the GNU GPL and the LGPL text;
- include the library's copyright notice if your program displays notices at run time, with a pointer to the license texts;
- choose between the two options in 4d.
The two options in 4d
Option 4d0 means you convey the Minimal Corresponding Source and the Corresponding Application Code under the license, in a form that lets users relink the application with a modified version of the library. This is the route teams take for static linking.
Option 4d1 means using a suitable shared library mechanism. The text says a mechanism qualifies if it uses at run time a copy of the library already present on the user's system, and works correctly with a modified, interface compatible version of that library.
The GNU FAQ puts the practical point plainly: linking dynamically to a library already on the user's computer does not require you to convey the library's source, while shipping the library yourself does.
What this means for packaging
- A desktop installer that bundles the library next to your binary is conveying the library, so its source and notices come with it.
- A container image that includes the library conveys it too.
- Static linking pushes you to 4d0, which usually means providing object files or equivalent relink material.
A short checklist
- List every LGPL package in your SBOM, and mark how each is linked.
- Decide per package: shared mechanism or relink package.
- Add the notices and license texts to your third party notices file.
- Check that your end user terms do not forbid modifying or debugging the library.
Safeguard's SBOM and dependency scanning give you the package list in step 1. Try the free scan. How a given product is linked still needs an engineer to confirm.
Quick check
Is dynamic linking to an LGPL library always safe?
It is one way to meet section 4d1, but you still owe the notice and license copies, and the mechanism must use a copy already on the user's system.
Can my application stay proprietary?
Yes, as long as your terms do not prevent modification of the library or reverse engineering for debugging those modifications.
Sources
This post is general information, not legal advice.
Last reviewed: 19 October 2026.
