LGPL-3.0-only is library copyleft pinned to version 3. Same replaceability rule, with GPLv3 patent and User Product terms, and no later LGPL.
On this page
What it does
GNU LGPL v3.0 only is the version-3 library grant without permission to move to a later LGPL. You read it together with GPLv3, because LGPL-3.0 is additional permissions on that license. Your closed application may link against the library. Copyleft stays on the library itself. Section 4 lists what a Combined Work has to carry. GPLv3 section 6 then adds Installation Information for consumer devices. Qt's open-source edition is the best-known example of this family. Contrast LGPL-3.0-or-later, which lets a recipient take a future LGPL.
Details
For a hosted service, LGPL-3.0-only asks nothing: there is no network clause. For shipped software it behaves like version 2.1 plus Installation Information on a User Product. Pinning only means a recipient cannot elect a later LGPL if the FSF publishes one. App store relink requirements are widely read as hard to satisfy, but that reading is not settled. Take that question to counsel before you build on it.
Pros
- You can link the library from closed code in the way section 4 describes.
- File-level reciprocity is easier to isolate than GPL-style whole-work copyleft.
Cons
- A locked consumer device defeats Installation Information. Decide the license before the hardware design is frozen.
- The source-offer and relink duties are real the moment you distribute binaries that include the library.
What it allows and requires
Choose a category to see the full grant in one scannable list. Permissions show what the license allows, limits show what it withholds, and obligations show the conditions your release process must satisfy.
Permissions
Commercial use
You may ship the code inside a paid product. The license does not restrict commercial use.
Modify
You may change the code, including keeping those changes private, unless a later obligation says otherwise.
Distribute
You may give copies to others. Distribution is what usually turns notice and source duties into real work.
Private use
Use inside your company, including internal forks, does not by itself trigger distribution duties.
Patent use
These licenses typically include a patent grant covering the licensed files. Read the grant before relying on it in a high-stakes deal.
Limits
Hold liable
The authors disclaim warranty. Recipients cannot hold them liable for damages arising from the software, except where law forbids that disclaimer.
Use trademark
The license is not a trademark license. Names, logos and product marks stay with their owners unless a separate grant says otherwise.
Open your product
File- or library-scoped copyleft does not, on its face, force you to open your entire application. Reciprocity stays on the covered files.
Obligations
Include copyright
Keep copyright notices on the covered files you distribute.
Include license
Keep the license text with the covered files, and say that those files are under this license.
Disclose source
Source for the library, including your modifications to it, has to be available to people who received a binary.
Keep replaceable
Recipients must be able to swap in their own build of the library. Dynamic linking is the usual path. Static linking means you also hand over a way to relink.
Installation Information
LGPL-3.0 rides on GPLv3, so a Combined Work in a User Product also owes Installation Information for a changed library.
What LGPL-3.0-only requires when you ship
When you distribute a binary that includes LGPL-3.0-only code, notice still travels with the copy, and the corresponding source has to be available under the same license. Internal use without a copy leaving the company is a different situation. The list below is the shipping work: what a recipient of that binary can demand, and what you record so a buyer can see it.
You are meeting LGPL-3.0 section 4 when your Combined Work names the library, ships both the LGPL-3.0 and GPL-3.0 texts, and shows the copyright notices where a user can see them.
You are meeting the relink condition when the library loads at run time as a separate file, or when you supply object code that lets a user rebuild the combination.
You have handled a consumer device when the buyer gets the Installation Information needed to put their own build of the library on the hardware they bought.
You stay on version 3 when headers, SPDX, and the shipped text all say only, so nobody treats this as a path to a later LGPL.
You have dealt with your own edits when every change you made inside the library goes back out under LGPL-3.0-only when you distribute it, separately from your application code.
The duties named in LGPL-3.0-only
Notice still travels with the copy. On top of that, LGPL-3.0-only names a source duty. These are the conditions in the text. The how-to above is when they become real work.
Include copyright
Keep copyright notices on the covered files you distribute.
Include license
Keep the license text with the covered files, and say that those files are under this license.
Disclose source
Source for the library, including your modifications to it, has to be available to people who received a binary.
Keep replaceable
Recipients must be able to swap in their own build of the library. Dynamic linking is the usual path. Static linking means you also hand over a way to relink.
Installation Information
LGPL-3.0 rides on GPLv3, so a Combined Work in a User Product also owes Installation Information for a changed library.
Things to be aware of
- Firmware teams sign the image and lock the bootloader, which defeats Installation Information. That duty is in this grant, not only in GPL-3.0-only.
- Treating Qt as LGPL-3.0-or-later without reading the edition. If the package pins only, recipients cannot take a future LGPL.
- An iOS build static-links the library and ships with no relink path. Ship a dynamic framework, or pick a differently licensed library before the release branch.
What the GNU LGPL v3.0 only does not do
Search results often flatten GNU LGPL v3.0 only into a slogan. These are the usual misreads. LGPL-3.0-only is a grant with conditions, not a permission to skip the paperwork below.
- LGPL-3.0-only does not force you to open your whole application. The reciprocal duty stays on the library, under version 3.
- It does not drop Installation Information because you used the LGPL instead of the GPL. On a User Product that duty still rides in from GPLv3.
How LGPL-3.0-only differs from nearby licenses
These licenses are often confused with LGPL-3.0-only, but their release duties differ. Each row summarizes what the license requires when you ship. Open the linked page for the full checklist.
- LGPL-3.0-only
- LGPL-3.0-only is library copyleft pinned to version 3. Same replaceability rule, with GPLv3 patent and User Product terms, and no later LGPL.
- LGPL-3.0-or-later
- Weak copyleft written as a delta on GPLv3. Consumer devices also owe installation information for a changed library.
- LGPL-2.1-only
- LGPL-2.1-only is library copyleft pinned to version 2.1. Users must be able to replace the library. There is no upgrade to LGPL-3.0.
- GPL-3.0-only
- GPL-3.0 keeps the source duty on distributed binaries and adds a patent grant, an anti-lockdown rule for consumer devices, and a cure period.
Common questions about GNU LGPL v3.0 only
Answers to common questions about what GNU LGPL v3.0 only requires, when its duties apply, and what evidence belongs with a release.
What is the GNU LGPL v3.0 only?
GNU LGPL v3.0 only is the version-3 library grant without permission to move to a later LGPL. You read it together with GPLv3, because LGPL-3.0 is additional permissions on that license. Your closed application may link against the library. Copyleft stays on the library itself. Section 4 lists what a Combined Work has to carry. GPLv3 section 6 then adds Installation Information for consumer devices. Qt's open-source edition is the best-known example of this family. Contrast LGPL-3.0-or-later, which lets a recipient take a future LGPL.
What does LGPL-3.0-only require when you ship a product?
You are meeting LGPL-3.0 section 4 when your Combined Work names the library, ships both the LGPL-3.0 and GPL-3.0 texts, and shows the copyright notices where a user can see them. You are meeting the relink condition when the library loads at run time as a separate file, or when you supply object code that lets a user rebuild the combination. You have handled a consumer device when the buyer gets the Installation Information needed to put their own build of the library on the hardware they bought. You stay on version 3 when headers, SPDX, and the shipped text all say only, so nobody treats this as a path to a later LGPL. You have dealt with your own edits when every change you made inside the library goes back out under LGPL-3.0-only when you distribute it, separately from your application code.
Does hosting a product that uses LGPL-3.0-only trigger extra duties?
Hosting alone usually does not trigger the source duty for LGPL-3.0-only. Shipping a binary, a container, or an on-prem build does. Notice still travels with any copy you hand over.
Can I keep my application closed if I use LGPL-3.0-only?
LGPL-3.0-only is library-scoped copyleft. Your application can stay closed if recipients can replace the library with their own build. Static linking makes that expensive. The library itself still ships with corresponding source and notices. Confirm the linking story on the component, then record it.
What is corresponding source for LGPL-3.0-only?
Corresponding source is the source a recipient needs to build and run the same binary, including scripts and interface files the license names. Hosting a repository URL can be an offer. The offer has to match what you actually shipped. SourceTrust records that a person on your team confirmed the offer. It does not publish your source and does not host a mirror.
How is LGPL-3.0-only different from GNU LGPL v3.0 or later?
LGPL-3.0-only asks this: LGPL-3.0-only is library copyleft pinned to version 3. Same replaceability rule, with GPLv3 patent and User Product terms, and no later LGPL. GNU LGPL v3.0 or later asks this: Weak copyleft written as a delta on GPLv3. Consumer devices also owe installation information for a changed library. Open the GNU LGPL v3.0 or later page for what that license requires when you ship. Do not treat the SPDX ids as interchangeable because the short names look similar.
Where do I record LGPL-3.0-only for a buyer?
The catalog marks LGPL-3.0-only as copyleft, so a source offer item lands in Distributed binary and Mixed. An LGPL linking item lands in Library or SDK, Distributed binary and Mixed. There is no separate checklist item for Installation Information. The fetcher compares the shipped text with the declared id. SourceTrust does not inspect your device build.
Where do I record LGPL-3.0-only for a buyer?
The catalog marks LGPL-3.0-only as copyleft, so a source offer item lands in Distributed binary and Mixed. An LGPL linking item lands in Library or SDK, Distributed binary and Mixed.
There is no separate checklist item for Installation Information. The fetcher compares the shipped text with the declared id.
SourceTrust does not inspect your device build. Read /docs/mobile-app-licenses when you ship an app store binary.
See also
The hub is the pillar for this cluster. Sibling licenses are the other spokes. Product FAQ links explain how SourceTrust records the duty, not the license text itself.
Practical guidance for procurement review, not legal advice. Confirm high-stakes use with counsel.