AGPL vs BSL vs Source-Available: Which Self-Hosted Licenses Can You Still Trust in 2026

The license question stopped being academic the moment MinIO’s repository went read-only and HashiCorp put a four-year fuse on Terraform. This guide is built the boring way: I fetched the LICENSE file from each project’s own repository on 2026-10-19 and read the terms, including the parameter block that actually defines HashiCorp’s BSL, the tri-license header in Redis, the FSL text Sentry ships instead of the BSL everyone still attributes to it, and the AGPLv3 §13 clause that decides what you owe when you modify and expose. For each project you get the same three answers — what you may do, what triggers a commercial license, and what happens to a fork. Verified 2026-10-19.

The one-line answer

For running software you did not modify, every license in this article is free of charge and effectively unencumbered. The differences only bite in three situations: you modify the code and let others use it over a network, you sell its functionality to third parties, or the vendor relicenses a future version on you.

Regime	Examples verified here	OSI-approved	Network copyleft	Offering the functionality to third parties
Permissive	Valkey (BSD-3)	Yes	No	Allowed
File-level copyleft	OpenBao, OpenTofu (MPL 2.0)	Yes	No	Allowed
Network copyleft	MinIO, Grafana (AGPLv3)	Yes	Yes, on your modifications	Allowed with a source offer
Business Source License	Terraform, Vault (BUSL 1.1)	No	Contract terms, not copyright	Not if it competes with the licensor
Bespoke source-available	n8n (SUL), Sentry (FSL), Redis options (RSALv2, SSPLv1)	No	Depends on the license	Mostly no

“Can I trust this license?” is the wrong question. These licenses are readable, stable documents, and none of them has a revenue threshold or a hidden royalty. The question that matters is who carries the cost if the vendor changes terms, and the answer is: whoever did not keep a copy of the version they deployed. A relicense binds future releases. It does not reach back and unlicense the tarball on your disk.

How I checked this

Every license claim below comes from the file the project publishes, not from a comparison site. The command is the same one you can run in your own terminal:

curl -s https://raw.githubusercontent.com/minio/minio/master/LICENSE | head -20
curl -s https://raw.githubusercontent.com/redis/redis/unstable/LICENSE.txt | head -8
curl -s https://raw.githubusercontent.com/hashicorp/terraform/main/LICENSE | head -12

Three of the ten projects do not have a file called LICENSE, which is exactly why a naive check fails: Redis, Valkey and Elasticsearch ship LICENSE.txt, COPYING and LICENSE.txt respectively. If you script this, look for all four names.

What I actually saw at the head of each default branch on 2026-10-19:

Project	File read	Header I saw	License
minio/minio	LICENSE @ master	GNU AFFERO GENERAL PUBLIC LICENSE / Version 3, 19 November 2007	AGPLv3
redis/redis	LICENSE.txt @ unstable	tri-licensing model ... (a) RSALv2 ... (b) SSPLv1 ... (c) AGPLv3	Tri-license
hashicorp/terraform	LICENSE @ main	Licensor: International Business Machines Corporation (IBM)	BUSL 1.1
hashicorp/vault	LICENSE @ main	Licensed Work: Vault Version 1.15.0 or later	BUSL 1.1
valkey-io/valkey	COPYING @ unstable	BSD 3-Clause License	BSD-3-Clause
grafana/grafana	LICENSE @ main	GNU AFFERO GENERAL PUBLIC LICENSE / Version 3	AGPLv3
elastic/elasticsearch	LICENSE.txt @ main	triple license under the GNU Affero ... SSPL ... Elastic License 2.0	Triple
openbao/openbao	LICENSE @ main	Mozilla Public License, version 2.0	MPL 2.0
getsentry/sentry	LICENSE.md @ master	Functional Source License, Version 1.1, Apache 2.0 Future License	FSL-1.1-Apache-2.0
n8n-io/n8n	LICENSE.md @ master	Sustainable Use License / Version 1.0	SUL 1.0

None of this is legal advice, and none of it substitutes for reading the file yourself for the exact version you deploy. I am reporting what the files say, not predicting what a court would do with your architecture.

AGPLv3: the network clause, in the license’s own words

The AGPL is GPLv3 plus one extra obligation, section 13. Quoting it from the AGPLv3 text as shipped in MinIO’s LICENSE:

Notwithstanding any other provision of this License, if you modify the
Program, your modified version must prominently offer all users
interacting with it remotely through a computer network (if your version
supports such interaction) an opportunity to receive the Corresponding
Source of your version by providing access to the Corresponding Source
from a network server at no charge, through some standard or customary
means of facilitating copying of software.

Read the trigger conditions carefully, because most AGPL panic skips them:

• “if you modify the Program” — running the unmodified release imposes no source obligation on you. Your Grafana dashboards, your MinIO buckets and your Terraform state are not the Program.
• “your modified version” — the obligation is to offer the source of the software you modified, not the application that talks to it.
• “users interacting with it remotely” — an internal-only deployment with no third-party users has nobody to offer source to. Teams often publish their patches anyway to stay unambiguously compliant; that is a choice, not a requirement.

What the license does not settle is where the boundary of a derivative work sits — for example, whether a plugin loaded into Grafana or a module linked into a Go binary makes your code part of the Program. That is a legal question about your architecture, and it is the one place in this article where I will not pretend the text gives a yes or no.

The practical rule that survives contact with real deployments: AGPLv3 is safe to run unmodified, safe to fork, and requires a source offer the moment you ship your changes to remote users.

BUSL 1.1: four parameter lines, not a license

The Business Source License is a template with blanks. Everything that makes it restrictive or permissive is in the parameter block at the top, which means two projects using “BUSL 1.1” can have completely different terms. Here is HashiCorp’s block for Terraform, verbatim:

Licensor:             International Business Machines Corporation (IBM)
Licensed Work:        Terraform Version 1.6.0 or later. The Licensed Work is (c) 2024
                      IBM Corp.
Additional Use Grant: You may make production use of the Licensed Work, provided
                      Your use does not include offering the Licensed Work to third
                      parties on a hosted or embedded basis in order to compete with
                      IBM Corp.'s paid version(s) of the Licensed Work.
Change Date:          Four years from the date the Licensed Work is published.
Change License:       MPL 2.0

Three things follow from those lines, and they matter more than the license’s reputation:

The base grant is non-production only. The body of BUSL 1.1 grants the right to copy, modify, create derivative works, redistribute and make non-production use. Production use exists only to the extent the Additional Use Grant allows it. For Terraform and Vault, the grant is broad: production use is fine as long as you are not offering the software to third parties on a hosted or embedded basis in order to compete with IBM’s paid versions. The same block spells out that “Hosting or using the Licensed Work(s) for internal purposes within an organization is not considered a competitive offering”, and that “Products that are not provided on a paid basis are not competitive.” Running Terraform to deploy your own infrastructure is squarely inside the grant.

The fuse is per version, and it is a parameter. “Four years from the date the Licensed Work is published” with “Change License: MPL 2.0” means Terraform 1.6.0, published 2023-10-04, becomes MPL 2.0 on 2027-10-04. Vault 1.15.0, published 2023-09-26, becomes MPL 2.0 on 2027-09-26. Every later release has its own four-year clock. And note that BUSL does not require a Change License at all — a licensor can ship the same template with a different expiry or none. “BUSL expires into open source” is only true when the parameters say so.

The licensor changed, the terms did not. The IBM name and the 2024 copyright line are the only trace of the ownership change; the grant text is the same one HashiCorp published in 2023. HashiCorp’s own announcement, dated 2023-08-10, describes the move as “changing its source code license from Mozilla Public License v2.0 (MPL 2.0) to the Business Source License (BSL, also known as BUSL) v1.1 on all future releases of HashiCorp products”, and notes that “HashiCorp APIs, SDKs, and almost all other libraries will remain MPL 2.0.” That last clause is why the forks were legally possible at all: OpenTofu and OpenBao continue from the last MPL-2.0 code, which is why OpenBao’s LICENSE still opens with Copyright (c) 2015 HashiCorp, Inc. above the MPL 2.0 text.

Source-available is not one license. It is at least four

The label hides very different terms. The restriction that matters, quoted from each file:

License	Seen in	The clause that decides your architecture
RSALv2	redis/LICENSE.txt	“You may not make the functionality of the Software or a Modified version available to third parties as a service”
SSPLv1	redis/LICENSE.txt	Offering it as a service requires the “Service Source Code” — the Program plus “management software, user interfaces, application program interfaces, automation software, monitoring software, backup software, storage software and hosting software”
SUL 1.0	n8n/LICENSE.md	“You may use or modify the software only for your own internal business purposes or for non-commercial or personal use”
FSL 1.1	sentry/LICENSE.md	Anything except a “Competing Use” — a commercial product that “substitutes for the Software” or for another product Sentry offers
ELv2	elasticsearch/licenses/ELASTIC-LICENSE-2.0.txt	“You may not provide the software to third parties as a hosted or managed service, where the service provides users with access to any substantial set of the features”

SSPL deserves the extra sentence, because it is routinely described as “AGPL but stricter” and that undersells it. AGPL §13 asks for the source of your modified Program. SSPL asks for the source of everything you use to run it as a service — including the monitoring, backup and hosting layers. That is why SSPL fails the OSI’s definition; Redis’s own announcement says so: “SSPL is not truly open source because the Open Source Initiative clarified it lacks the requisites to be an OSI-approved license.”

MinIO: the license held, the project did not

This is the case that should reset your defaults, and it is not a license story.

The license is unambiguous. minio/minio ships AGPLv3, and it has since 2021: the only two commits that ever touched the LICENSE file are the 2014 initial commit and 0694325 on 2021-04-23, whose diff replaces 202 lines of Apache 2.0 with 661 lines of AGPLv3. MinIO’s blog dates completion to RELEASE.2021-05-11T23-27-41Z and the start of the process to October 2019.

What changed in 2025–2026 is the project’s status, and it is visible in the repository itself:

• The README’s first line is now **THIS REPOSITORY IS NO LONGER MAINTAINED.**
• The GitHub API reports "archived": true, last push 2026-04-24.
• The README states: “The MinIO community edition is now distributed as source code only. We will no longer provide pre-compiled binary releases for the community version.” Legacy binaries “will not receive updates.”
• The replacement is a commercial product line: AIStor Free, AIStor Enterprise Lite and AIStor Enterprise, announced 2025-12-23. The pricing page describes Free as “Full-featured, single-node deployment architecture”, “Free of charge”, and Enterprise Lite as covering “capacity requirements below 400 TiB”.

Answers for MinIO specifically:

• What you may do: run, modify, redistribute and fork under AGPLv3. No revenue threshold, no user cap, no field-of-use restriction.
• What triggers a commercial license: nothing in the license. The pressure is operational — no binaries, no updates, no support unless you buy AIStor. AIStor Free is not AGPLv3; MinIO’s README calls it a “free license” and I did not read its EULA, so treat those terms as unknown until you do.
• What happens to a fork: legally you can fork the AGPLv3 code today. Practically you inherit an object store, which is not a weekend project.

The lesson is uncomfortable and worth stating plainly: an AGPLv3 license you can trust does not make a repository you can rely on. Check archived and pushed_at before you check the license badge.

Redis: the only project in this group that came back

Redis has the most instructive license history of the ten, because you can watch it happen in the repository. At tag 7.2.4 the project has no LICENSE.txt; the license lives in COPYING, which opens Copyright (c) 2006-2020, Salvatore Sanfilippo and is plain BSD-3. At tag 8.0.0, LICENSE.txt opens with the tri-license paragraph:

Starting with Redis 8, Redis Open Source is moving to a tri-licensing model with all new Redis code
contributions governed by the updated Redis Software Grant and Contributor License Agreement.
After this release, contributions are subject to your choice of: (a) the Redis Source Available License v2
(RSALv2);or (b) the Server Side Public License v1 (SSPLv1); or (c) the GNU Affero General Public License v3 (AGPLv3).
Redis Open Source 7.2 and prior releases remain subject to the BSDv3 clause license as referenced
in the REDISCONTRIBUTIONS.txt file.

That third option is the whole story. RSALv2 forbids making the software’s functionality available to third parties as a service; SSPLv1 demands the service source code. But because the same file offers your choice of the three, you can simply take AGPLv3 and the other two restrictions never bind you. Redis 8 is genuinely open source again, in the OSI sense, and the company says so itself: “Adding the OSI-approved AGPL as an additional licensing option for Redis, starting with Redis 8.”

• What you may do: run, modify and redistribute under AGPLv3, or under RSALv2 if you prefer a license with no source-disclosure obligation and you are not making the functionality available to third parties.
• What triggers a commercial license: nothing automatic. Redis Ltd. sells Redis Software and Cloud; the license has no revenue or seat trigger.
• What happens to a fork: it already happened. Valkey, now under the Linux Foundation, forked the last BSD commit and shipped 7.2.5 on 2024-04-16. Its COPYING is BSD-3-Clause, retaining Copyright (c) 2006-2020, Redis Ltd.

One dating trap: “Redis is SSPL” is 2024 knowledge and “Redis is BSD” is 2023 knowledge. Both are wrong in 2026 — Redis 8+ is a choice of three, and Redis 7.2 and earlier remain BSD-3 forever.

Terraform and Vault: BUSL with a four-year fuse

Both projects carry the identical parameter structure (quoted above for Terraform), with Vault’s block naming Vault Version 1.15.0 or later.

• What you may do: everything except competing with IBM’s paid offerings. Production use for your own infrastructure, including inside a company of any size, is explicitly permitted; the grant says internal hosting “is not considered a competitive offering” and that products not offered on a paid basis “are not competitive.” Copying, modifying and redistributing the code is allowed, and non-production use needs no grant at all.
• What triggers a commercial license: offering Terraform or Vault to third parties on a hosted or embedded basis in a way that competes with IBM’s paid versions. A consulting shop running Terraform for clients is a different question from a platform vendor embedding it in a paid product, and the grant’s definition of “competitive offering” is what you have to read.
• What happens to a fork: OpenTofu (MPL 2.0, v1.6.0 on 2024-01-10) and OpenBao (MPL 2.0, 2.0.0 on 2024-07-17, governed by the Linux Foundation’s OpenSSF). Both continue from MPL-2.0 code, not from BUSL code.

If you self-host Terraform or Vault for your own infrastructure, the license is a non-issue and the four-year fuse is a bonus: those versions become MPL 2.0 in 2027 regardless of what IBM does next.

Grafana: AGPLv3 since 8.0, and nobody forked

Grafana is the cleanest test of the claim that copyleft relicensing destroys a community. The repository settles the date: v7.5.0’s LICENSE is Apache 2.0, v8.0.0’s is AGPLv3. Grafana Labs announced the change in April 2021 and describes it as moving “our core open source projects (Grafana, Grafana Loki, and Grafana Tempo) from the Apache License 2.0 to the Affero General Public License (AGPL) v3”, with plugins, agents and certain libraries staying Apache-licensed.

• What you may do: run it, modify it, redistribute it. Self-hosted Grafana for your own team, unmodified, carries no source obligation.
• What triggers a commercial license: modifications exposed to remote users (§13), or features that only exist in Grafana Enterprise, which Grafana Labs sells separately. The AGPL text itself has no commercial trigger, and I did not read the Enterprise license.
• What happens to a fork: no major fork emerged. Grafana remains one of the most widely deployed self-hosted dashboards, and five years of AGPLv3 did not fracture the project or its plugin ecosystem.

The practical consequence: an AGPLv3 dashboard behind your SSO is not a compliance problem. Patching Grafana’s frontend and reselling access to it is.

Elasticsearch: AGPLv3 is an option, not the distribution

Elasticsearch is where a one-line summary does the most damage. The repository’s LICENSE.txt is 669 bytes and says:

Source code in this repository is covered by (i) a triple license under the "GNU
Affero General Public License v3.0 only", "the Server Side Public License, v 1",
and the "Elastic License 2.0", or (ii) an "Apache License 2.0" compatible
license or (iii) solely under the "Elastic License 2.0", in each case, as noted
in the applicable header. The default throughout the repository is a triple
license ... Code that is licensed solely under the "Elastic License 2.0" is
found only in the x-pack folder.

Three facts, in order of importance:

1. The AGPLv3 option exists and covers the default code. Elastic announced it on 2024-08-29 (“we will be adding AGPL as another license option next to ELv2 and SSPL in the coming weeks”) and v8.16.0 shipped on 2024-11-12 with the triple header. The claim “AGPLv3 since 8.16” is correct for the source.
2. x-pack is not AGPLv3. It is Elastic License 2.0 only, and ELv2 forbids providing the software “to third parties as a hosted or managed service, where the service provides users with access to any substantial set of the features or functionality of the software.” Anything you actually want from the paid feature set lives there.
3. The distribution is still ELv2. Elastic’s licensing FAQ is explicit: “Our releases will continue to be under the Elastic License.” If you pull Elastic’s binaries, you have not received AGPLv3 software — you have received ELv2 software. To take the AGPLv3 option you build from source.

• What you may do: build from source and use the AGPLv3-covered code under AGPLv3; use the released binaries under ELv2 (free of charge, with the managed-service restriction).
• What triggers a commercial license: offering a hosted or managed search service on ELv2 code, or using x-pack features beyond the free tier.
• What happens to a fork: OpenSearch, Apache 2.0, 1.0.0 on 2021-07-13 — forked from the last Apache-licensed code after the 2021 SSPL change, and the fork AWS backs.

Sentry and n8n: the bespoke licenses, and one correction

Sentry is routinely listed as a BSL project. It is not, and the file is unambiguous:

# Functional Source License, Version 1.1, Apache 2.0 Future License

## Abbreviation

FSL-1.1-Apache-2.0

Sentry’s own history, from its announcement on 2023-11-17: BSD-3, then the BSL ten years later, then the FSL, which it wrote and published. The FSL is BSL-shaped but simpler: no Additional Use Grant at all, just a “Permitted Purpose” defined as anything other than a Competing Use, and a fixed conversion. From the license:

We hereby irrevocably grant you an additional license to use the Software under the Apache License, Version 2.0 that is effective on the second anniversary of the date we make the Software available.

So each Sentry release becomes Apache 2.0 two years after publication, automatically, with no action from you. Two years is half the BSL default, and Sentry says that was deliberate.

n8n uses the other bespoke variant, the Sustainable Use License, and its LICENSE.md is a compound document rather than a single grant: files with .ee. in the name or a .ee directory are excluded from the SUL and require “a valid n8n Enterprise License” under LICENSE_EE.md. The rest is SUL 1.0, whose limitation is the strictest in this article:

You may use or modify the software only for your own internal business purposes or for non-commercial or personal use. You may distribute the software or provide it to others only if you do so free of charge for non-commercial purposes.

• What you may do: run either one internally, for your own business, at no cost.
• What triggers a commercial license: building a product that substitutes for Sentry, or offering n8n to third parties as part of a commercial service. Both licenses aim at the same target — someone reselling the functionality — and both leave internal use alone.
• What happens to a fork: legally fine, but a fork of FSL code is still FSL until the two-year clock runs out per release; a fork of n8n inherits a .ee carve-out you cannot use.

What actually happens to a fork

Every restrictive relicense in this group produced a fork, and the timing is consistent enough to plan around:

Relicensing	Fork	Fork license	First stable release
Elastic, 2021 (Apache → SSPL/ELv2)	OpenSearch	Apache 2.0	1.0.0, 2021-07-13
HashiCorp, 2023-08-10 (MPL → BUSL)	OpenTofu	MPL 2.0	1.6.0, 2024-01-10
HashiCorp, 2023-08-10 (MPL → BUSL)	OpenBao	MPL 2.0	2.0.0, 2024-07-17
Redis, March 2024 (BSD → RSALv2/SSPL)	Valkey	BSD-3-Clause	7.2.5, 2024-04-16
Grafana, Apr 2021 (Apache → AGPLv3)	none	—	—

Two patterns are worth internalizing. First, forks arrive in months, not years, and they fork the last permissively licensed commit — which is why the fork’s LICENSE still carries the original author’s copyright and why the original vendor cannot stop it. Second, an AGPL relicense does not produce a fork, because AGPLv3 leaves the community’s rights intact; the Grafana row is empty for a reason.

The catch for a self-hoster is that a fork only helps if someone maintains it. Valkey, OpenTofu, OpenBao and OpenSearch all have corporate or foundation backing. A fork of a smaller project would not, and “I’ll fork it if they relicense” is not a migration plan.

What this means for a self-hoster

Work through these five cases in order; most people stop at the first.

1. You run the software unmodified, for yourself or your team. Every license here permits it, including BUSL, SUL and RSALv2. No source obligation, no payment. This is 90% of self-hosting.
2. You run it unmodified but give customers access. Still fine under AGPLv3, MPL 2.0 and BSD-3. Under BUSL, SUL, RSALv2 and ELv2 you are now in the territory those licenses regulate — read the grant, not the badge.
3. You modify it and expose it over a network. AGPLv3 §13 applies: offer the Corresponding Source of your modified version to those remote users. MPL 2.0 only asks you to publish your changes to MPL-covered files. BSD-3 asks for nothing beyond attribution.
4. You sell its functionality. This is the only real tripwire in the entire article, and all five restrictive licenses aim at it.
5. The vendor relicenses a future version. Costs you nothing if you kept what you deployed.

Step 5 is free to execute and almost nobody does it. Pick the tag you actually run, not main:

mkdir -p licenses/2026-10-19 && cd licenses/2026-10-19

curl -sL https://raw.githubusercontent.com/grafana/grafana/v12.2.0/LICENSE \
  -o grafana-v12.2.0-LICENSE.txt
curl -sL https://raw.githubusercontent.com/redis/redis/8.0.0/LICENSE.txt \
  -o redis-8.0.0-LICENSE.txt
curl -sL https://raw.githubusercontent.com/hashicorp/terraform/v1.9.8/LICENSE \
  -o terraform-v1.9.8-LICENSE.txt

sha256sum *.txt > SHA256SUMS

Record the tag and the hash in your runbook next to the deployment. If a future release changes terms, you can still prove what governed the version you shipped — and the old tag keeps working.

To check a container image rather than the repository, read the license out of the image you are about to run:

docker run --rm --entrypoint sh grafana/grafana:12.2.0 \
  -c 'find / -maxdepth 4 -iname "LICENSE*" 2>/dev/null | head'

If that returns nothing, pull the corresponding tag from GitHub instead and note that the image may include code under additional terms.

Our recommendation

Our recommendation for a self-hosted stack in 2026

Valkey for the cache, PostgreSQL for the database, OpenBao for secrets, Grafana for dashboards. Valkey and OpenBao carry no resale restriction at all, PostgreSQL’s license is in the same permissive family, and Grafana is AGPLv3, which costs you nothing as long as you run it unmodified. For object storage, do not default to MinIO community any more — not because of its license, which is a genuine AGPLv3, but because the repository is archived and the community edition no longer ships binaries. Choose a store whose pushed_at is recent and whose releases you can actually pull.

Our recommendation if you are building a product on top of open source

Prefer BSD-3 or MPL 2.0 for anything you embed and ship — Valkey, OpenBao and OpenTofu are the safe picks in this group. Take AGPLv3 only if a source offer on your modifications is workable for you, which it usually is for server-side components you do not distribute. Do not build a product on BUSL, SUL, RSALv2 or ELv2 code until you have read the grant line by line and matched it against your revenue model.

Our recommendation if you already run BUSL, SUL or RSAL software internally

Change nothing. Internal production use is explicitly permitted by all three, and the versions you have cannot be relicensed retroactively. Keep the tag, keep the LICENSE file, note the Change Date where one exists, and revisit the decision when the Change Date lands or when your usage stops being internal.

Common problems

• “AGPL means I have to open-source my whole app.” §13 covers “your modified version” of the Program. An unmodified Grafana or MinIO imposes nothing on your application code. The genuine open question is derivative works — plugins, linked modules — and that is a legal call, not something the license text answers for you.
• “BUSL expires into open source after four years.” Only per version, and only because HashiCorp named Change License: MPL 2.0. BUSL 1.1 does not require a Change License at all; a vendor can set a longer date or a different outcome.
• “The source is on GitHub, so it’s open source.” Source-available is not open source. BUSL, SUL, FSL, RSALv2, SSPL and ELv2 all restrict use in ways the OSI definition forbids.
• “Redis is SSPL.” Redis 8+ offers RSALv2, SSPLv1 or AGPLv3, your choice, and Redis 7.2 and earlier remain BSD-3. The SSPL-only description is two changes out of date.
• “Sentry uses the BSL.” Its LICENSE.md is FSL-1.1-Apache-2.0, with each release converting to Apache 2.0 after two years.
• “Elasticsearch is AGPLv3 now.” The source default is a triple license including AGPLv3; the released distribution stays under ELv2, and x-pack is ELv2 only. Building from source and pulling the official binaries are two different legal positions.
• “MinIO is the safe S3 default.” The repository is archived, the README says it is no longer maintained, and the community edition is source-only with no binary updates. The license is fine; the supply chain is not.
• “Grafana relicensed recently.” April 2021, at v8.0.0. Nothing has changed since; the repository at HEAD is still AGPLv3.
• “If they relicense, I’ll fork it.” You can only fork the last permissively licensed commit, and a fork needs maintainers. Four of the five relicensings here produced a backed fork; smaller projects would not.
• curl .../LICENSE returns 404. Redis, Valkey and Elasticsearch use LICENSE.txt or COPYING. Check the repository root before concluding a project is unlicensed.

Related guides

• Redis vs Valkey: Which Should You Use for Your Next Project?
• How Much Does It Cost to Self-Host n8n?
• Build a Self-Hosted Notion Alternative
• Coolify vs Dokku vs CapRover: Best Self-Hosted PaaS?
• Docker Compose vs Kubernetes for Small Projects

Conclusion

The license landscape in 2026 is more stable than its reputation. Three vendors softened their terms (Redis with AGPLv3, Elasticsearch with an AGPLv3 option, Sentry with a two-year fuse to Apache 2.0), two are still BUSL but with a four-year expiry that is already running, and the projects that remain source-available rather than open source — n8n, and the AIStor tier MinIO now sells — say so in their license files instead of hiding it.

What actually changed is that a permissive license no longer tells you whether a project is healthy. MinIO is AGPLv3 and archived. Elasticsearch is partly AGPLv3 and still ELv2 where the features are. The two checks that matter take a minute each: read the license file at the tag you deploy, and check whether the repository still moves.

This article reports what license files say as of 2026-10-19. It is not legal advice; if the answer decides whether your business ships, ask a lawyer who can look at your architecture.