No copyleft licenses in proprietary project production dependencies

GPL-3.0 and AGPL-3.0 are strong copyleft licenses: if you distribute software that includes GPL-licensed code as a combined work, you are legally required to release your entire application's source code under the GPL. AGPL extends this obligation to server-side use — running an AGPL-licensed library as part of a SaaS application may trigger source disclosure obligations. This is not a theoretical risk; companies have faced legal action for GPL non-compliance. CWE-1357 covers the risk of using components whose terms you have not adequately evaluated. This check is rated critical because the business consequence — compelled open-sourcing of proprietary code — is irreversible and can fundamentally undermine your competitive position or commercial model.

For each GPL or AGPL dependency, find a permissively-licensed alternative first. If no alternative exists, check whether the package offers a commercial license exception. Automate license compliance in CI:

npx license-checker --production --failOn 'GPL-2.0;GPL-3.0;AGPL-3.0'

Store the approved license allow-list in a .config/license-policy.json and run the check on every build. For LGPL packages (a weaker copyleft), document that they are used without modification — LGPL permits use in proprietary software when the LGPL component remains replaceable.