[R-pkg-devel] Possible open-source license incompatibilities within R packages

[Duncan Murdoch]

On 2025-09-08 10:55 a.m., Ilmari Tamminen wrote:
> I would like to release my R code under GPL-3. The code depends on a package (lme4) that itself uses "GPL >= 2", but which has upstream dependencies (minqa, numDeriv, rbibutils) that are GPL-2 only.  According to what I've read (see below), GPL-2 and GPL-3 are incompatible. Are the GPL-2 upstream licenses a problem for my GPL-3 R code? If so, are there recommended ways of resolving this?

My understanding is that the licenses of other packages are only 
relevant if you are incorporating their code into yours and would like 
to release the combined work.

If your code uses some other package but you are not distributing the 
other package then their license doesn't affect your package.

For example, many packages (including R itself) are written to use 
Windows functions, but since they don't distribute copies of those 
functions the fact that Windows isn't open source doesn't matter.

Duncan Murdoch

> 
> This post is written from the perspective of an R-package user. I am not an R-package developer nor a lawyer. I want to comply with the software licenses with the best available understanding about the topic I have.
> 
> How did I found the issue: I built a container image from my code, then I ran:
> 
> write.csv(installed.packages(fields = "License")[,c(1,10)], "Licenses-of-R-packages.csv")
> 
> After inspecting the above list I found out that the lme4, central to my code, imports the minqa package. The lme4 is licensed under the "GPL-2 | GPL-3 [expanded from: GPL (≥ 2)]" according to CRAN, and the minqa package under "GPL-2". Thus, there might be a license incompatibility. The GPL2 vs GPL3 incompatibility is stated for example here:
> 
> https://www.gnu.org/licenses/gpl-faq.html#v2v3Compatibility
> 
> Also if you select both the GPL2 and GPL3 licenses in the following license tool, it says they are incompatible:
> 
> https://ufal.github.io/public-license-selector/
> 
> Here is one of the graphs trying to simplify the license relations. Notice that there is no downstream-compatibility arrow from the GPLv2 to the GPLv2+.
> 
> https://dwheeler.com/essays/floss-license-slide.html
> 
> Here is another figure lacking the compatibility arrow. On the other hand, there is no red arrow or cross either. The compatibility graph was obtained from the: "Georgia M. Kapitsaki, Nikolaos D. Tselikas, Ioannis E. Foukarakis: An insight into license tools for open source software systems. Journal of Systems and Software 102: 72-87 (2015)".
> 
> https://gkapi.blogspot.com/2016/09/foss-license-compatibilities.html?m=1
> 
> The main question is: are there incompatibilities between the upper stream GPL2 and lower stream "GPL-2 | GPL-3 [expanded from: GPL (≥ 2)]" R packages (minqa vs lme4)? If so, how could I deal with the situation as an R-package user trying to publish my source code under the GPL3? Or could the issue be solved by removing the minqa-based bobyqa optimiser from the lme4 package (a solution not directly in my hands)?
> 
> Lme4 also suggests the GPL2 numDeriv, is this an issue as well? Furthermore, it is notable how the R package installations also install the undirect dependencies by default, even if my code works without them, complicating the topic further. For example, if I rely on an R package licensed to me with GPL3, after the installation my setup (computer or a container image) can be full of other and possibly non-complying R packages. One of them being the GPL2 licensed rbibutils, which becomes installed with the lme4, but the CRAN page of the lme4 does not mention this as a direct dependency.
> 
> Best regards
> ______________________________________________
> R-package-devel using r-project.org mailing list
> https://stat.ethz.ch/mailman/listinfo/r-package-devel