[R-pkg-devel] Possible open-source license incompatibilities within R packages

[Ilmari Tamminen]

I would like to release my R code under GPL-3. The code depends on a package (lme4) that itself uses "GPL >= 2", but which has upstream dependencies (minqa, numDeriv, rbibutils) that are GPL-2 only.  According to what I've read (see below), GPL-2 and GPL-3 are incompatible. Are the GPL-2 upstream licenses a problem for my GPL-3 R code? If so, are there recommended ways of resolving this?

This post is written from the perspective of an R-package user. I am not an R-package developer nor a lawyer. I want to comply with the software licenses with the best available understanding about the topic I have.

How did I found the issue: I built a container image from my code, then I ran:

write.csv(installed.packages(fields = "License")[,c(1,10)], "Licenses-of-R-packages.csv")

After inspecting the above list I found out that the lme4, central to my code, imports the minqa package. The lme4 is licensed under the "GPL-2 | GPL-3 [expanded from: GPL (≥ 2)]" according to CRAN, and the minqa package under "GPL-2". Thus, there might be a license incompatibility. The GPL2 vs GPL3 incompatibility is stated for example here:

https://www.gnu.org/licenses/gpl-faq.html#v2v3Compatibility

Also if you select both the GPL2 and GPL3 licenses in the following license tool, it says they are incompatible:

https://ufal.github.io/public-license-selector/

Here is one of the graphs trying to simplify the license relations. Notice that there is no downstream-compatibility arrow from the GPLv2 to the GPLv2+.

https://dwheeler.com/essays/floss-license-slide.html

Here is another figure lacking the compatibility arrow. On the other hand, there is no red arrow or cross either. The compatibility graph was obtained from the: "Georgia M. Kapitsaki, Nikolaos D. Tselikas, Ioannis E. Foukarakis: An insight into license tools for open source software systems. Journal of Systems and Software 102: 72-87 (2015)".

https://gkapi.blogspot.com/2016/09/foss-license-compatibilities.html?m=1

The main question is: are there incompatibilities between the upper stream GPL2 and lower stream "GPL-2 | GPL-3 [expanded from: GPL (≥ 2)]" R packages (minqa vs lme4)? If so, how could I deal with the situation as an R-package user trying to publish my source code under the GPL3? Or could the issue be solved by removing the minqa-based bobyqa optimiser from the lme4 package (a solution not directly in my hands)?

Lme4 also suggests the GPL2 numDeriv, is this an issue as well? Furthermore, it is notable how the R package installations also install the undirect dependencies by default, even if my code works without them, complicating the topic further. For example, if I rely on an R package licensed to me with GPL3, after the installation my setup (computer or a container image) can be full of other and possibly non-complying R packages. One of them being the GPL2 licensed rbibutils, which becomes installed with the lme4, but the CRAN page of the lme4 does not mention this as a direct dependency.

Best regards