Your Open-Source App Changed Its License. What Happens to the Data You Keep in It

A license change binds the releases that come after it, not the copy you already have. Open-source grants already given are written to last — on their stated conditions. What a change can take is the future: new features, the official build, the hosted service. Whether you can leave depends on a tested export.

On 9 October 2026, Bitwarden told its users: "Starting in the next release, the Bitwarden apps published to the various stores will be the commercially licensed builds."¹ The same notice said: "The GPLv3 OSS licensed version continues to be updated and published on GitHub."¹ A Bitwarden employee added later in the thread that direct downloads from the company's download page "will also be under the commercial license."²

Read that closely. Bitwarden did not relicense its source code. The LICENSE.txt in its clients repository last changed on 1 May 2025, in a commit titled "Fix some references to master"; the server's last changed on 24 January 2024.³⁴ Both still name GPL v3.0 or AGPL v3.0 as the default, with the company's own license confined to a single directory. What changes is which license the official builds ship under.

That distinction is the whole essay in miniature. This is not legal advice — it describes what the license texts say. Read your app's LICENSE file, and ask a lawyer for anything that matters commercially.

Why does a license change feel like losing the app?

Because for most people the app and its license arrive as one object. You never read the license; you read the release notes. So when a vendor changes terms, the fear is that the tool — and everything you keep inside it — now belongs to someone else's business plan. The fear is reasonable. Most of it is misplaced.

The Hacker News thread on the Bitwarden notice put the feeling in one line: "why do I always feel like "this is where the enshittification begins" when I hear about license changes, even though these seem kind of harmless?"⁵ Another reply answered the opposite way: "I don't see what I've lost."⁶ Both are honest readings of the same news.

Vendors know the feeling and answer it in advance. Bitwarden's notice carries an edit: "No change to self-hosting, the licensing change affects those who are repackaging and reselling Bitwarden."¹ In 2021, Elastic's Shay Banon wrote of his company's change: "This change in source code licensing has no impact on the overwhelming majority of our user community who use our default distribution for free."⁷

The reassurance is a pattern, not a lie.

Researchers have a less comforting name for the move itself. In a 2026 paper in Information Systems Journal, Dawn Foster and Matt Germonprez describe how "freeriding accusations become the justification for unilateral, non‐incremental adaptation to a project's boundary regulation."⁸ Unilateral is the word that stings — you did not get a vote. The question is what that vote could ever have decided.

What can a license change reach, and what can't it?

A license change governs what the copyright holder releases next. It does not reach back into a copy you already received. The GPL makes its grant "irrevocable provided the stated conditions are met"; Apache 2.0, subject to its terms, calls its grant perpetual and irrevocable. HashiCorp applied its own 2023 change "on all future releases."

The GPL's wording is exact: "All rights granted under this License are granted for the term of copyright on the Program, and are irrevocable provided the stated conditions are met."⁹ The condition matters: the grant holds while you keep the license's terms. The same section adds: "This License explicitly affirms your unlimited permission to run the unmodified Program."⁹

Apache 2.0 says it in one breath — "Subject to the terms and conditions of this License", each contributor grants "a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license."¹⁰

The Free Software Foundation states the principle behind the GPL's wording. Asked whether a developer who released a program under the GPL can later license it to another party for exclusive use, its FAQ answers: "No, because the public already has the right to use the program under the GPL, and this right cannot be withdrawn."¹¹

Elsewhere the FAQ adds: "We think it is wrong to take back permissions already granted, except due to a violation. If your freedom could be revoked, then it isn't really freedom."¹¹ Note the qualifier — except due to a violation.

Vendors write their changes the same way. HashiCorp's 2023 announcement said it was moving from MPL 2.0 to the Business Source License "on all future releases of HashiCorp products."¹² Future releases. Not the ones already downloaded.

Source-available licenses run on version clocks too. The Business Source License 1.1 "applies separately for each version of the Licensed Work". Each version converts to its named open license "on the Change Date, or the fourth anniversary of the first publicly available distribution of a specific version", whichever comes first.¹³ So the clock is per version — not one date for the whole product.

Now the limit. These grants are copyright permissions over code. They promise nothing about future updates, app-store builds, the hosted service or the brand. Bitwarden's license file says it outright: "No grant of any rights in the trademarks, service marks, or logos of Bitwarden is made".³

How can a company ship GPL code under a different license?

Because it holds the copyright. A license binds the people who receive the code, not the owner who grants it. Bitwarden's contributor agreement assigns contributors' copyright to the company. So Bitwarden can offer the same codebase under a second license, while the GPL grants it has already given stay where they are.

The agreement is short on this point: "By submitting a Contribution, you assign to Bitwarden all right, title, and interest in any copyright in the Contribution."¹⁴ Not every project asks contributors for this. Whether one does is worth knowing before you depend on an app — and it is visible in the repository before you install anything.

Bitwarden is open about what its second license is. Its licensing FAQ says plainly: "The Bitwarden License does not qualify as an open source license under the OSI definition."¹⁵ In the forum thread, a Bitwarden employee put the other side: "Code under the commercial license is just as viewable and transparent on GitHub."²

Readable is not the same as reusable.

Hacker News titled its submission "Bitwarden Dual License Model". One commenter objected that the notice "doesn't use that term anywhere."¹⁶ The precise description is narrower: the codebase keeps its licenses, and the official builds change which one they ship under.

What did users keep after earlier license changes?

They kept the released versions. Elasticsearch, Terraform and Redis each changed license for future releases, and each time the earlier versions stayed under their open licenses. That is why OpenTofu and Valkey could fork. Two of the three companies later added an OSI-approved AGPL option — relicensing is not always a one-way door.

Each row is sourced to the project's own announcement. Elastic wrote in January 2021 that it was moving "our Apache 2.0-licensed source code in Elasticsearch and Kibana to be dual licensed under Server Side Public License (SSPL) and the Elastic License, giving users the choice of which license to apply." The change came "before our upcoming 7.11 release."⁷ Redis wrote in March 2024: "Consequently, Redis will no longer be distributed under the three-clause Berkeley Software Distribution (BSD)."¹⁹

The forks started from the last open version. The Linux Foundation said Valkey "will continue development on Redis 7.2.4 and will keep the project available for use and distribution under the open source Berkeley Software Distribution (BSD) 3-clause license."²⁰ OpenTofu said: "Over 100 companies, 10 projects, and 400 individuals pledged their time and resources to keep Terraform open-source."¹⁸

Then two companies moved back toward an open option. Elastic, in August 2024: "we will be adding AGPL as another license option next to ELv2 and SSPL in the coming weeks."¹⁷ Redis's Rowan Trollope, in May 2025, announced "Adding the OSI-approved AGPL as an additional licensing option for Redis, starting with Redis 8 (available now);"²¹ None of this predicts what any other vendor will do.

A fork is a right, not a rescue. Dawn Foster's 2024 study of these three relicenses found that "Employees of Elastic and HashiCorp were making well over 90% of the contributions in the year before the relicense and again in the year after."²² Redis was different: "there were employees from 12 other companies contributing to Redis who were disenfranchised by the licensing change."²²

Whether a fork thrives depends on who was writing the code before the change.

How common are these events? A June 2026 preprint by Dmitrii Dmitrenko — single-author and not yet peer-reviewed — built a sample of 105 open-source data-infrastructure projects. It reports that "About a quarter of the sample (24 percent) experienced at least one adverse event." The rate was "46 percent for single-vendor venture-backed projects, 2.5 percent for foundation-governed projects funded outside the venture cycle."²³ Treat it as one constructed sample, not a census.

What can you actually lose?

The future, mostly. Features built after the change may exist only in the new build. The official binary, the one that updates itself, may now ship under the new terms. A hosted service runs on its own terms of service. And an old version still running is not the same as an old version still maintained.

Bitwarden's notice said "All current features are available in both versions."¹ Asked what would differ between the two, a Bitwarden employee replied: "Some future components will be published under the commercial license and will exist only in that build. Newly developed features will be evaluated on a case-by-case basis for which license applies to them."² A volunteer moderator noted that "the word "current" is doing some heavy lifting".²

Nothing you have today is withdrawn. What the open build gets tomorrow is decided case by case.

Convenience is the second loss. A GPL build on GitHub is real — but someone has to build it, sign it and keep it updated. If you used the store version because it updated itself, that ease now comes with the commercial license.

The third is a question rather than a claim. A retained license is not a retained security patch. If you plan to stay on the last open version, ask who will fix its bugs — and check whether anyone has said they will.

Why does the export decide whether you can leave?

Because a software license governs the program, not the records you keep in it. The GPL says so itself: output is covered "only if the output, given its content, constitutes a covered work." Your passwords and notes are not the program. Taking them elsewhere depends on whether the app writes them out in a format you can open.

The full GPL sentence reads: "The output from running a covered work is covered by this License only if the output, given its content, constitutes a covered work."⁹

A license debate, however loud, does not touch the data you produced.

So the useful question moves from the license to the format. Bitwarden's own help center lists what its exports produce: "Exports can be downloaded in a few formats: .json (plaintext) .csv (plaintext) .json (Encrypted) .zip (with attachments)".²⁴ It also states a limit: ".zip exports are currently only available for individual vault data."²⁴ That is a documented exit, with its edges written down.

Every app you keep data in deserves the same reading. For notes, two companion questions have their own pieces. What survives when the company behind an app shuts down is covered in note apps compared by what survives when the company doesn't. How well each app's export holds up is scored in an export-fidelity roundup.

A license change is the milder case of the same problem — the company stays, and only its terms move. In the EU, some rights to move your data come from regulation, not from any app's license.

Three checks to run this week

Find out which build you run, read the license file that build shipped with, and test the export. The first tells you whose terms you are on. The second tells you what you may do with the copy you have. The third tells you whether you can leave — and it is the only one you can prove today.

1. Which build do you run? An app-store install, a vendor download and a self-built copy can sit under different licenses — Bitwarden's change applies to the first two.¹² Check the app's About screen and where you installed it from.
2. Which license did that version ship with? Open the LICENSE file at the release tag for your version, not the current main branch. Under the Business Source License, also look for the Change Date — it is set per version.¹³
3. Have you tested the export? Export everything once. Open the file in a different program. Check the edges: attachments, folders, and items shared with other people. Bitwarden's docs, for one, note that .zip exports with attachments cover individual vault data only.²⁴

The third check is the one most people skip. It is also the one that does not depend on a vendor keeping its word.

Frequently asked questions

Can a license change be retroactive?

Not for copies you already received under an open license. The GPL's grant is "irrevocable provided the stated conditions are met," and Apache 2.0's, subject to its terms, is "perpetual" and "irrevocable." By the texts' own wording, a vendor cannot withdraw the grant on a released version from someone who keeps its terms. This is not legal advice.⁹¹⁰

Is the old version still open source after a relicense?

Yes, under the license it shipped with. That is why OpenTofu could fork Terraform and Valkey could fork Redis 7.2.4 after their vendors changed license for future releases. What the old version does not get automatically is new features or security fixes — those depend on someone maintaining it, which a fork does not guarantee.²⁰¹⁸²²

Is that something the GPL license even allows?

Yes, when the company holds the copyright. A license binds people who receive the code, not its owner. Bitwarden's contributor agreement assigns contributors' copyright to Bitwarden, so the company can offer the code under a second license. The GPL grants already given are not withdrawn; the FSF's FAQ says the public's existing GPL right "cannot be withdrawn."¹¹¹⁴

What differences will exist between the two parallel versions?

None today, by Bitwarden's account: "All current features are available in both versions." A Bitwarden employee said future components may be published under the commercial license and "exist only in that build," with new features evaluated case by case. The repositories' default licenses — GPL v3.0 for clients, AGPL v3.0 for the server — had not changed as of 11 October 2026.¹³²

What is a Business Source License change date?

It is the date on which a specific version under the Business Source License 1.1 converts to its named open-source "Change License." The conversion happens on the Change Date or on the fourth anniversary of that version's first public release, whichever comes first. Each version has its own clock, so newer versions convert later.¹³

Did Bitwarden go closed source?

No. Its notice says "Bitwarden is not going closed-source," and the license files in its clients and server repositories were unchanged on 11 October 2026. What changes, from the next release, is that app-store builds and direct downloads ship as the commercially licensed build. A GPLv3 build continues to be updated and published on GitHub.¹³⁴

What should I do when an app I use changes its license?

Run three checks. Find out which build you run, since store, download and repository builds can differ. Read the license file at your version's release tag. Then export your data and open it in another program. The export is the only check that proves you can leave, regardless of what the license says next.¹³²⁴

A license is a promise about code; an export is a promise you can test. Keep the one you can test.

mnmnote.com keeps your notes as open Markdown on your own device — an exit that does not wait on anyone's license decision.