Resource · License changes · Checked 30 October 2026
Open-source licence changes: a timeline and your options
Seven vendors tightened their licenses between 2018 and 2024: MongoDB, Confluent, Elastic, Akka, HashiCorp, Redis and Cockroach Labs. Two later added an AGPL option. Releases already shipped keep their old license, so your choices are to stay on the last open release and patch it, move to a fork, accept the new terms, or pay the vendor.
TimelineYour optionsLast open release by productStay on the last open version, patched
Last reviewed
Open source license changes by date
Each row quotes the vendor's own page, linked in the last column and listed under Sources. Dates are the date of the vendor's announcement unless the row says otherwise. This is a reading aid, not legal advice.
| Date | Vendor and product | What changed | Earlier releases and response | Source |
|---|---|---|---|---|
| MongoDB, MongoDB Server | AGPL v3 to the Server Side Public License v1 (SSPL) for all releases on or after this date, including later patch releases of older versions. Section 13 requires anyone who offers the software to third parties as a service to release the source of the whole service. | Versions released before 16 October 2018 stay under AGPL v3. MongoDB's FAQ says internal-only use does not trigger the service clause. | mongodb.com | |
| Confluent, Confluent Platform components | Apache 2.0 to the Confluent Community License for Schema Registry, REST Proxy, ksqlDB and some connectors. The code stays available, but you may not use it to run a SaaS that competes with Confluent. | Apache Kafka stays under Apache 2.0. Earlier Confluent Platform releases stay under Apache 2.0; the FAQ says the new license applies from Confluent Platform 5.1. | confluent.io | |
| Elastic, Elasticsearch and Kibana | Apache 2.0 to a choice of SSPL or the Elastic License, starting with the 7.11 release. | 7.10.2 was the last Apache 2.0 release. AWS announced OpenSearch on 12 April 2021, a fork of Elasticsearch and Kibana 7.10.2 under Apache 2.0. | elastic.co | |
| Akka (Lightbend), Akka | Apache 2.0 to the Business Source License (BSL) 1.1 with an additional usage grant. Akka says the license reverts to Apache 2.0 three years after release, and that a commercial license for production use is free for early-stage companies under US$25 million in annual revenue. | Akka's post does not name the last Apache 2.0 release. Ask the vendor before you pin one. | akka.io | |
| HashiCorp, Terraform and other products | MPL 2.0 to BSL 1.1 for all future releases. Production use stays allowed unless it is a competitive offering to HashiCorp on a hosted or embedded basis. | APIs, SDKs and almost all libraries stay MPL 2.0. Under the license text each BSL release converts to MPL 2.0 four years after publication. The community forked Terraform as OpenTofu in August 2023. | hashicorp.com | |
| Redis, Redis server | BSD-3-Clause to RSALv2 or SSPLv1 (your choice) from Redis 7.4. Redis states that neither license is approved by the Open Source Initiative. | Redis says the change is not retroactive: releases before 7.4 stay under BSD. The Linux Foundation announced Valkey, a BSD fork of Redis 7.2.4, on 28 March 2024. | redis.io | |
| Cockroach Labs, CockroachDB | The free Core edition is retired. From version 24.3 in November 2024 there is one self-hosted Enterprise offering, free for individual developers, students, researchers and businesses under US$10 million in annual revenue. The source stays available. | The new structure applies to new patch releases of versions 23.1 and later, so a pinned older line can still move to the new terms with a patch. | cockroachlabs.com | |
| Elastic, Elasticsearch and Kibana | AGPL added as a third license option. Elastic says it is adding an option and removing nothing, so SSPL and the Elastic License remain. | Elastic titled the announcement "Elasticsearch is open source, again": an AGPL option exists for current releases. | elastic.co | |
| Redis, Redis 8 | AGPLv3 added as a license option starting with Redis 8, next to RSALv2 and SSPLv1. Redis calls AGPL an OSI-approved license. | Redis 7.4 stays on RSALv2 or SSPLv1 only. | redis.io | |
| Broadcom, Bitnami images and charts | Not a license change. Versioned Bitnami images moved to an unsupported Bitnami Legacy archive and the full catalogue is sold as the paid Bitnami Secure Images subscription. Chart and image source code stays on GitHub under Apache 2.0. | Broadcom calls Bitnami Legacy unsupported and temporary, so a pinned tag keeps pulling for now with no promise of fixes, and its CVEs accumulate. | community.broadcom.com |
RabbitMQ is not on this list because its license has not changed: the server stays under MPL 2.0. What changed is who receives patches for series that have left community support, covered in the RabbitMQ license guide. The Redis change in detail is in the Redis license guide, and the Bitnami move in leaving Bitnami.
Open source license types in this timeline: permissive, copyleft and source-available
Open source licenses fall into two families. Permissive licenses such as Apache 2.0, BSD and MIT let you use and redistribute the source code, including in proprietary software. Copyleft licenses such as the GPL and AGPL require derivative works to carry the same license. The newer source-available licenses publish the code but restrict some uses, usually offering it as a competing service.
| License | Type | What it allows or requires | Where it appears |
|---|---|---|---|
| Apache License 2.0 | Permissive | Use, modify and redistribute, including inside proprietary products, as long as notices are kept. | Elasticsearch to 7.10.2, Apache Kafka, OpenSearch, Akka before 2022 |
| BSD-3-Clause | Permissive | The same freedoms with a short notice requirement and a clause against using the authors' names to endorse a product. | Redis through 7.2, Valkey |
| MIT License | Permissive | The shortest of the permissive licenses. Not used by the vendors in this timeline, shown as a baseline. | Baseline only |
| Mozilla Public License 2.0 | Weak copyleft | Changes to MPL-licensed files must be shared under the MPL; the rest of a product can stay under other terms. | RabbitMQ, HashiCorp products before August 2023 |
| GNU GPL v3 | Strong copyleft | If you distribute a derivative work, you must release its source code under the GPL. Not used by the vendors in this timeline; the AGPL is the GPL plus a network-use condition. | Baseline only |
| GNU AGPL v3 | Strong copyleft | Like the GPL, derivative works must be released under the same license. The AGPL adds a condition for software that users reach over a network. | MongoDB before October 2018; an option for Elastic since 2024 and Redis 8 since 2025 |
| Server Side Public License v1 (SSPL) | Source-available | MongoDB says it based the SSPL on the GPL v3, with a new section 13: anyone offering the software to third parties as a service must release the source of the whole service. MongoDB and Redis say it is not OSI-approved. | MongoDB, Elastic, Redis |
| Business Source License 1.1 (BSL) | Source-available | Production use under an additional use grant, then conversion to a named open license after a set period. | HashiCorp (to MPL 2.0 after four years), Akka (to Apache 2.0 after three) |
| Elastic License | Source-available | Elastic's own license for Elasticsearch and Kibana, offered next to SSPL since 7.11. | Elastic |
| Redis Source Available License v2 (RSALv2) | Source-available | Per Redis: use, copy, distribute and prepare derivative works, but not commercialise the software or offer it as a managed service. Redis says it is not OSI-approved. | Redis 7.4 and later |
| Confluent Community License | Source-available | Modify and redistribute, but not run a SaaS that competes with Confluent. Confluent says it is not OSI-approved open source. | Some Confluent Platform components |
What a license change does, and does not do
- It applies from a date. Redis says its change is not retroactive and that you may keep using earlier versions indefinitely. MongoDB leaves releases before 16 October 2018 under AGPL. HashiCorp's change covers future releases.
- A release is not the same as a line. MongoDB applies the SSPL to later patch releases of older versions, and Cockroach Labs applies its new terms to new patch releases of 23.1 and later. Pin a specific release, not a version line.
- Internal use is mostly untouched. The restrictions target hosted or embedded offerings that compete with the vendor. MongoDB's FAQ says internal-only use does not trigger the service clause, and Redis's FAQ says nothing changes for internal or personal use.
- The operational gap is security fixes. Redis says it will backport critical security patches to its BSD-licensed versions until Redis Community Edition 9.0 is released, and that patches after that date come under the new dual license. After that point, fixes for the old line arrive only under the new terms.
Your options after a license change
There are five, and they differ mostly in cost and in how long they keep working. Most estates end up with a mix: stay on one product, fork another, pay for a third.
Option 1
Stay on the last open release and patch it
Keep running the release you have. Someone other than the vendor supplies security fixes for it.
Fits when: The release works, your use is internal, and an upgrade or migration costs more than the risk.
Check first: Which exact release is the last one under the old license, and who ships fixes for it. Vendors may keep backporting for a while, then stop.
Option 2
Move to a community fork
OpenSearch (from Elasticsearch 7.10.2, Apache 2.0), Valkey (from Redis 7.2.4, BSD-3-Clause) and OpenTofu (from Terraform) are maintained under open governance.
Fits when: You want an open license going forward and can absorb a version migration and a client check.
Check first: How far the fork has drifted from the original in APIs, clients and managed-service support since the fork date.
Option 3
Accept the new license
Read the restriction. Most of these licenses target hosting or embedding the software as a service that competes with the vendor.
Fits when: You run the software for your own organisation only. Elastic and Redis now also offer AGPL.
Check first: Your counsel's reading of the exact license text, including any AGPL conditions for software used over a network.
Option 4
Pay the vendor
Buy a commercial license or subscription. Redis, Cockroach Labs and HashiCorp each sell commercial terms.
Fits when: You need features, indemnity or support only the vendor gives, and the price is acceptable.
Check first: Whether the contract covers the version you run, and what happens at renewal.
Option 5
Replace the product
Move to different technology, open source or proprietary, with a license you accept.
Fits when: The change is one of several reasons to leave, and you have a migration budget.
Check first: The cost of a data and application migration, which is usually the highest of the five.
The last open release, by product
Option one depends on knowing which release is the last one under the old license and who patches it. For the four products below, this is where the line falls and what OSSeva patches.
| Product | Where the license line falls | Community fork | OSSeva Patch |
|---|---|---|---|
| Elasticsearch | 7.10.2 is the last Apache 2.0 release. 7.11 and later are SSPL or Elastic License, with AGPL added in August 2024. | OpenSearch, from 7.10.2 | Patched Elasticsearch 7.10.2 and 7.17 |
| Redis | 7.2 and earlier are BSD-3-Clause. 7.4 and later are RSALv2 or SSPLv1, and Redis 8 adds AGPLv3. | Valkey, from 7.2.4 | Patched Redis 6.2 and 7.2; Valkey supported |
| MongoDB | Only releases before 16 October 2018 are AGPL. Every supported line since is SSPL, so there is no recent open line to pin. | No fork covered here | Patched MongoDB 4.2 to 6.0 past end of life |
| Apache Kafka | Not affected: Kafka stays Apache 2.0. Only some Confluent Platform components moved to the Confluent Community License. | Not needed | Patched Kafka 2.8 to 3.9 |
Not a fit for
OSSeva patches the technologies on its supported versions list. Terraform, Vault, CockroachDB and Akka are not on it, and OSSeva does not give legal advice or interpret a license for you. Critical CVEs are patched within 48 hours and High within 7 days on every technology it does cover. The plan is priced per cluster.
Can I keep using the last open-source version?
Yes. A license change applies to releases from a stated date, and the vendors above say so: Redis calls its change not retroactive and says you may keep using earlier versions indefinitely, MongoDB leaves pre-October 2018 releases under AGPL, and HashiCorp's change covers future releases. Two caveats. New patch releases of an older line can fall under the new license, as MongoDB and Cockroach Labs state. And the vendor stops publishing fixes for the old line at some point, so the practical question is who patches it.
Is SSPL open source?
Not by the Open Source Initiative's definition. MongoDB's FAQ says the SSPL is not OSI approved, and Redis's 2025 AGPL post says the OSI clarified that SSPL lacks the requisites to be approved. The same post says MongoDB and Elastic adopted SSPL to protect their businesses from cloud providers that sell the software as a service.
Does a license change restrict internal use?
The vendors say it mostly does not. MongoDB's FAQ says internal-only use does not trigger SSPL section 13. Redis's FAQ says nothing changes for end users who run new releases for internal or personal use. HashiCorp's BSL grants production use except for competitive offerings, and the license text says internal use within an organisation is not a competitive offering. Your counsel should read the exact text.
What is the difference between the BSL and AGPL?
The Business Source License is source-available: use is allowed under an additional use grant, and each release converts to a named open license after a set period. HashiCorp's text converts to MPL 2.0 four years after a release is published, and Akka says three years to Apache 2.0. The AGPL is an OSI-approved copyleft license with conditions for software used over a network.
What are the alternatives after a vendor changes its license?
Stay on the last open release and patch it, move to a community fork such as OpenSearch, Valkey or OpenTofu, accept the new license if your use is internal, pay the vendor, or replace the product. The five options are compared above.
Does OSSeva patch software after a license change?
For the technologies on its supported versions list, yes: for example Redis 6.2 and 7.2, Elasticsearch 7.10.2 and 7.17, MongoDB 4.2 to 6.0 and Kafka 2.8 to 3.9. Critical CVEs are patched within 48 hours and High within 7 days. OSSeva does not give legal advice, and Terraform, Vault, CockroachDB and Akka are not on its list.
Can an open source project change its license?
The holder of the copyright can release new versions under new terms, and a vendor that owns the code or holds contributor agreements can do it alone. Redis, for example, requires contributors to accept a contributor license agreement. Releases already published under an open source license stay available under it. Whether a particular project can relicense depends on who holds the copyright, which is a question for counsel.
What is the difference between permissive and copyleft licenses?
Permissive licenses such as Apache 2.0, BSD and MIT let you use and redistribute the code, including in proprietary products, if you keep the notices. Copyleft licenses such as the GPL and AGPL require derivative works to be released under the same license. The AGPL extends that to software users reach over a network. The source-available licenses in the timeline are neither: they publish the code but restrict some uses.
Sources, checked 30 October 2026
- MongoDB: Server Side Public License FAQ
- Confluent: License Changes for Confluent Platform (14 Dec 2018)
- Confluent: Confluent Community License FAQ
- Elastic: licensing change announcement (14 Jan 2021)
- AWS: Introducing OpenSearch (12 Apr 2021)
- Akka: Why we are changing the license for Akka (7 Sep 2022)
- HashiCorp: HashiCorp adopts Business Source License (10 Aug 2023)
- HashiCorp: Business Source License 1.1 text
- OpenTofu manifesto
- Redis: Redis adopts dual source-available licensing (20 Mar 2024)
- Linux Foundation: Valkey launch (28 Mar 2024)
- Cockroach Labs: enterprise license announcement (15 Aug 2024)
- Elastic: Elasticsearch is open source, again (29 Aug 2024)
- Redis: Redis is now available under the AGPLv3 open source license (1 May 2025)
- Broadcom: How to prepare for the Bitnami changes (18 Aug 2025)
- RabbitMQ: release information and support timelines
Every date and clause above comes from these pages. Where a vendor page does not state a fact, such as the last Apache 2.0 release of Akka, the table says so. Next review by 18 January 2027.
Get a quote
Stay on the last open version, patched.
Tell us the product and release you pin. A 15-minute discovery call, then a quote priced per cluster, not per core.
Prefer to talk or read more first?