I read the licence history of 1,084 open-source projects. 272 changed their licence.

Most of us check a dependency's licence once, on the day we add it. But a licence is a file in git, and it has a history like any other file.

I build Borehole, which reads a repository's git history for technical due diligence. One of the things it reads is the root licence file, commit by commit. Across the 1,084 public projects in its library, 272 changed their licence in a way that changes what users may do. 140 of those narrowed it.

Here's what the changes look like.

The most common move is to the AGPL

Started on	Today	Projects
MIT	AGPL-3.0	25
Apache-2.0	AGPL-3.0	19
GPL-3.0	AGPL-3.0	19

The AGPL is the GPL with one more clause: if users reach a modified version over a network, they're entitled to its source. For a hosted product, serving users counts the way shipping a binary does. That's why it suits companies whose open-source project is also their cloud product. Grafana, Loki and Mimir moved from Apache-2.0 to AGPL-3.0 in 2021. Today 89 of the 272 grant network-copyleft terms, almost all of them AGPL.

Then the move away from open source

51 of the 272 now grant source-available terms: BUSL, SSPL, the Elastic License, the Functional Source License. You can read the code, but use is restricted, usually against anyone offering it as a competing service.

The busiest year was 2023, with 53 changes. On 10 and 11 August 2023, six HashiCorp repositories moved from MPL-2.0 (MIT, for Vagrant) to BUSL-1.1: Terraform, Vault, Consul, Nomad, Packer and Vagrant. Terraform's last open version became OpenTofu.

Redis went from BSD-3-Clause to a choice of RSALv2 or SSPL on 20 March 2024. The last BSD version became Valkey. On 1 May 2025 Redis added AGPL-3.0 as a third choice.

It hasn't stopped. Last month lakeFS (22 September) and ThingsBoard (28 September) both moved from Apache-2.0 to BUSL-1.1.

It goes both ways

Not every change narrows. 132 of the 272 loosened their terms or moved sideways:

• 11 projects that started on AGPL-3.0 are on Apache-2.0 today.
• Cal.com went from MIT to AGPL-3.0 in 2021, and back to MIT on 15 April 2026.
• Bruno moved from MIT to the Business Source License on 1 January 2022, and back to MIT on 5 January. Four days.

Why this matters to you

Code you took under the old licence stays under it. The licence on the version you pinned is the one that applies to you. The licence on main is the one your next upgrade accepts.

So the question isn't only "what's the licence?" It's "what was it when I took it, and has it changed since?" Git answers that in one line:

git log --date=short --format='%ad %h %s' -- 'LICEN[CS]E*' 'COPYING*'

For a dependency, you don't need the files, only the history:

git clone --filter=blob:none --no-checkout https://github.com/usebruno/bruno.git
cd bruno
git log --date=short --format='%ad %h %s' -- 'license*'

2022-09-29 cb0d09d2 feat: mit license
2022-03-22 c7cced58 feat: September 2022 updates
2022-01-05 68c8d636 chore: changed license bsl1.1 to MIT
2022-01-02 9b6e175f chore: fix typo
2022-01-01 92db46c6 chore: change licensing from MIT to BSL 1.1 license
2021-12-30 1b95cda7 chore: updated license

A commit message isn't proof, though. Read the file on each side of the change: git show <sha>^:LICENSE and git show <sha>:LICENSE.

How it's counted

• Only the root licence file counts. A project that added source-available terms for a paid edition in its own files, and kept an open licence for the rest, is listed apart and not counted.
• A change counts when it changes what users may do. Moving from one permissive licence to another, such as BSD-2-Clause to BSD-3-Clause, doesn't count.
• The library isn't a random sample. It's the projects people surveyed, plus ones I added, weighted toward companies that ship open source. Read the shares as "in this library", not "in open source".

The whole list is here, newest first, with each project's licence path and dates.

If you're buying a company, or being bought, I also wrote up what AGPL, BUSL and SSPL each oblige in a deal.

Which relicence caught you out? I'm curious which ones people actually had to act on.