# BSD License

> The BSD license is a family of permissive open source licenses that allow any use, including closed-source, and most require keeping the copyright notice.

Also known as: BSD-3-Clause, BSD-2-Clause, 0BSD, BSD-4-Clause, New BSD License, Modified BSD License, Revised BSD License, Simplified BSD License, FreeBSD License, 3-clause BSD, 2-clause BSD

Source: https://socket.dev/glossary/bsd-license

Last updated: 2026-10-26

The BSD license is a family of permissive open source licenses that began at UC Berkeley. Each grants use, modification, and redistribution, including in closed-source products, and most require copying the notice into source and binary distributions. The variants, 4-clause, 3-clause (New or Modified), 2-clause (Simplified or FreeBSD), and 0BSD, carry different obligations, so the clause count matters.

"BSD" on its own does not name a license. The 4-clause BSD license requires an acknowledgment in any advertising that mentions the software, a condition the GPL does not allow. The 3-clause license forbids using contributors' names to promote your product, and the 2-clause license has neither condition. On October 26, 2026 we read the license files of the 712 BSD-labeled projects among PyPI's 5,000 most-downloaded. 265 of them, 37.2%, declare only "BSD" in their metadata. One of those, visions, shipped the 4-clause advertising clause under the label "BSD License" in every release from 0.7.5 to 0.8.1. Our position: a bare "BSD" is an unresolved license. Read the clauses in the file, and declare the exact SPDX identifier when you publish.

## What is the BSD license?

The BSD license is a copyright grant, a short list of conditions, and a warranty disclaimer. To see why each part exists, start from the default. Copyright reserves copying, modification, and distribution to the author the moment code is written. Code with no license is not free to use, even in a public repository. A license is the author's written permission to do those reserved things.

A [permissive license](https://socket.dev/glossary/permissive-license) grants that permission with conditions that cover notices and liability, never what you do with your own code. The BSD license does it in one sentence followed by numbered conditions. This is BSD-3-Clause as the [SPDX License List](https://spdx.org/licenses/BSD-3-Clause.html) publishes it, with the disclaimer shortened:

```text
Copyright (c) <year> <owner>.

Redistribution and use in source and binary forms, with or without
modification, are permitted provided that the following conditions are met:

1. Redistributions of source code must retain the above copyright notice,
   this list of conditions and the following disclaimer.

2. Redistributions in binary form must reproduce the above copyright notice,
   this list of conditions and the following disclaimer in the documentation
   and/or other materials provided with the distribution.

3. Neither the name of the copyright holder nor the names of its
   contributors may be used to endorse or promote products derived from
   this software without specific prior written permission.

THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
AND ANY EXPRESS OR IMPLIED WARRANTIES ... ARE DISCLAIMED. IN NO EVENT SHALL
THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY ... DAMAGES ...
```

The grant permits "redistribution and use," in source or binary form, modified or not. It places no limit on who uses the code or for what. That includes commercial use: the BSD license is approved by the Open Source Initiative (OSI), and the [Open Source Definition](https://opensource.org/osd) requires that an approved license "may not restrict the program from being used in a business." You can ship BSD code inside a closed-source product, charge for it, and keep your changes private.

Clause 1 governs source copies. It says "retain," which presumes a notice is already present. The notice is not always in the LICENSE file. estraverse, a BSD-2-Clause package at number 63 on npm's top-downloads list, ships a LICENSE.BSD file that begins at the grant, with no copyright line. Its copyright lines live in the header of estraverse.js, so "the above copyright notice" points at a comment in a source file.

Clause 2 governs binary copies, and it is the clause that distinguishes the BSD license from most of its peers. The notice, the list of conditions, and the disclaimer must appear "in the documentation and/or other materials provided with the distribution." The license names where the notice goes when the code itself is no longer readable. It does not define "binary form." We read it as any form other than source: a compiled executable, a container image, or a minified JavaScript bundle.

Clause 3, present only in the 3-clause and 4-clause variants, is the non-endorsement clause. It withholds one permission the grant might otherwise imply: you may not use the authors' or their organization's names to endorse or promote what you built without written permission.

What the BSD license leaves out matters as much. The BSD license never mentions patents, never says "irrevocable," and never says "sublicense." It says nothing about the license your own product must use, which is what makes it permissive. The patent silence is why companies that care about patents reach for the [Apache License 2.0](https://socket.dev/glossary/apache-license-2-0), which grants patent rights in writing.

## BSD 4-clause vs 3-clause vs 2-clause vs 0BSD

The classic BSD license variants are one text with clauses deleted over time. Each deletion removed an obligation, and each produced a license with its own [SPDX](https://socket.dev/glossary/spdx) identifier. 0BSD borrowed the name without the text.

> BSD license variants as one text with clauses removed: 4-clause, 3-clause, 2-clause, 1-clause, and 0BSD

The figure as text: BSD-4-Clause contains the grant, a source-notice condition, a binary-notice condition, an advertising-acknowledgment condition, a non-endorsement condition, and the disclaimer. BSD-3-Clause removes the advertising clause, which Berkeley deleted from its own code on July 22, 1999. BSD-2-Clause also removes non-endorsement. BSD-1-Clause also removes the binary-notice condition, leaving only the source notice. 0BSD keeps only the grant and the disclaimer, and its text derives from the ISC license rather than from Berkeley's. None of the five mentions patents. BSD-2-Clause-Patent adds an express patent grant, and BSD-3-Clause-Clear expressly excludes one.

The original license from the Regents of the University of California had four conditions. The third was the advertising clause:

```text
3. All advertising materials mentioning features or use of this software
   must display the following acknowledgement: This product includes
   software developed by the University of California, Berkeley and its
   contributors.
```

The advertising clause broke down as the license spread. Other authors copied the text and substituted their own names, so a system built from many BSD-licensed parts owed many acknowledgments. Richard Stallman described the result in [The BSD License Problem](https://www.gnu.org/licenses/bsd): "In a 1997 version of NetBSD, I counted 75 of these sentences."

Berkeley withdrew the clause for its own code. A [notice dated July 22, 1999](https://spec.org/hpc2021/docs/licenses/BSD-Change-1999.txt), signed by William Hoskins, Director of the Office of Technology Licensing at UC Berkeley, told licensees the clause was "hereby deleted in its entirety." The notice covered only the University's copyrights. Anyone else's code under a 4-clause license still carries the clause, and authors still choose it. visions, a Python type-inference library, ships a 4-clause license with a 2020 copyright line and its own acknowledgment sentence.

The 3-clause license is the 4-clause license minus advertising. SPDX calls it BSD-3-Clause, "New" or "Revised"; others call it the Modified BSD license. The 2-clause license also drops non-endorsement. SPDX calls it BSD-2-Clause, "Simplified," and it is often called the FreeBSD license. That second name is slightly wrong. The license page the FreeBSD Project publishes adds a "views and conclusions" paragraph after the disclaimer, which SPDX tracks separately as BSD-2-Clause-Views.

The Zero-Clause BSD license (0BSD) has no conditions at all. Despite its name, it descends from the ISC license, not from Berkeley. The Free Software Foundation (FSF) says so in its [license list](https://www.gnu.org/licenses/license-list.html): "Contrary to its name, it is not based on any of the BSD licenses." The OSI approved it on October 14, 2015, under the name Free Public License 1.0.0, and renamed it in 2018. TypeScript's tslib, number 15 on npm's top-downloads list, uses 0BSD, so code that calls into it from a TypeScript build owes no notice.

Two variants change the patent terms that the classic texts leave unstated. BSD-2-Clause-Patent adds an express patent grant to the 2-clause text. BSD-3-Clause-Clear goes the other way, adding a sentence that "NO EXPRESS OR IMPLIED LICENSES TO ANY PARTY'S PATENT RIGHTS ARE GRANTED BY THIS LICENSE."

The family keeps growing. As of SPDX License List 3.29.0, released September 16, 2026, 45 license identifiers contain "BSD," and 8 of them are OSI-approved. The same variants as data:

| Variant (SPDX ID) | Source notice | Binary notice | Advertising | Non-endorsement | Patents | OSI | Blue Oak tier |
| --- | --- | --- | --- | --- | --- | --- | --- |
| BSD-4-Clause | Yes | Yes | Yes | Yes | Silent | No | Bronze |
| BSD-3-Clause | Yes | Yes | No | Yes | Silent | Yes | Bronze |
| BSD-2-Clause | Yes | Yes | No | No | Silent | Yes | Silver |
| BSD-1-Clause | Yes | No | No | No | Silent | Yes | Silver |
| 0BSD | No | No | No | No | Silent | Yes | Bronze |
| BSD-2-Clause-Patent | Yes | Yes | No | No | Express grant | Yes | Gold |
| BSD-3-Clause-Clear | Yes | Yes | No | Yes | Expressly excluded | No | Bronze |

The last column comes from the [Blue Oak Council's license list](https://blueoakcouncil.org/list), version 15, which rates permissive licenses on drafting quality. Its ranking does not reward fewer conditions. BSD-3-Clause sits a tier below BSD-2-Clause because Bronze licenses "impose additional requirements or restrictions, such as BSD-style prohibitions against endorsement and promotion." BSD-2-Clause-Patent is the only BSD variant rated Gold, because it addresses patents explicitly.

## What is the difference between the BSD and MIT licenses?

The BSD license and the [MIT License](https://socket.dev/glossary/mit-license) grant nearly the same permissions. They differ in how the grant is worded, where the notice must go, and whether names are protected. For most uses, BSD-2-Clause and MIT are interchangeable.

The grant is worded differently. MIT lists eight rights: "use, copy, modify, merge, publish, distribute, sublicense, and/or sell." The BSD license permits "redistribution and use ... with or without modification" and names none of them. Both are read to allow commercial and closed-source use. MIT's explicit "sublicense" is the clearer basis for passing the code to customers under your own end-user terms.

The notice requirement is placed differently. MIT asks that its notice be "included in all copies or substantial portions of the Software," which leaves open what a copy is once a bundler has rewritten the code. The BSD license splits the case. Source copies retain the notice, and binary copies reproduce it in the accompanying documentation. A third-party notices file shipped beside a binary satisfies the BSD wording on its face.

BSD-3-Clause adds the non-endorsement clause, and MIT has no equivalent. Both licenses say nothing about patents.

|  | MIT | BSD-2-Clause | BSD-3-Clause | 0BSD | Apache-2.0 |
| --- | --- | --- | --- | --- | --- |
| Condition on redistribution | Notice in all copies | Notice in source; notice in docs for binaries | Same as BSD-2-Clause, plus no endorsement | None | License, NOTICE file, change notices |
| Names the sublicense right | Yes | No | No | No | Yes |
| Patent grant | None stated | None stated | None stated | None stated | Express, with termination |
| GPL-compatible (FSF) | Yes | Yes | Yes | Yes | GPLv3 only |
| Packages on npm top-downloads list | 12,234 | 116 | 304 | 5 | 1,796 |

Counts are packages on npm-high-impact 1.13.0's top-downloads list whose latest version declares exactly that license, as of October 26, 2026. The FSF says 0BSD "can operate as a free software license compatible with the GNU GPL," with a caveat about missing notices.

Our verdict: for a new library, BSD-2-Clause and MIT are equivalent, so choose by ecosystem convention. That means MIT in JavaScript and either one in Python, where BSD-3-Clause is common. Choose BSD-3-Clause if you want the non-endorsement clause in writing. Choose BSD-2-Clause-Patent or Apache-2.0 if patents could matter. Choose 0BSD for snippets and runtime helpers that end up inside other people's builds. Never choose BSD-4-Clause for new code.

## Is the BSD license compatible with the GPL?

The 2-clause and 3-clause BSD licenses are compatible with the GPL. The 4-clause BSD license is not. The FSF describes the Modified BSD license as "compatible with the GNU GPL" and calls the original "a lax, permissive non-copyleft free software license with a serious flaw: the 'obnoxious BSD advertising clause.'"

The mechanism is the GPL's rule against added restrictions. A [copyleft license](https://socket.dev/glossary/copyleft-license) like the GPL lets you combine code from other licenses only if their terms fit inside its own. A notice requirement fits, because the GPL also preserves notices. A requirement to put a sentence in your advertising is a condition the GPL does not impose, so the combined work cannot be distributed under the GPL.

The Apache Software Foundation draws the same line for its own projects. Its [third-party license policy](https://www.apache.org/legal/resolved.html) puts "BSD (without advertising clause)," 2-clause and 3-clause, in Category A, which Apache projects may include. It lists BSD-4-Clause in Category X, which they may not. A 4-clause dependency therefore keeps a project out of GPL distributions and out of Apache Software Foundation projects.

Compatibility runs in one direction. BSD code can go into a GPL program, but GPL code cannot be relabeled BSD. Socket covered a case of exactly that: in [the Tencent zipalign.py relicensing](https://socket.dev/blog/developer-accuses-tencent-of-copyright-violation), a GPLv3-licensed utility was ported, given a replacement copyright notice, and republished under BSD-3-Clause.

A BSD LICENSE file can also travel with a rider that changes the deal. React 15.6.1 shipped a standard 3-clause BSD license and a separate PATENTS file titled "Additional Grant of Patent Rights Version 2." The patent grant terminated if you brought a patent assertion against Facebook. The Apache Software Foundation moved the "Facebook BSD+Patents license" to Category X on July 15, 2017, [as LWN reported](https://lwn.net/Articles/728178/). Facebook announced on September 22, 2017 that it would [relicense React, Jest, Flow, and Immutable.js under MIT](https://engineering.fb.com/web/relicensing-react-jest-flow-and-immutable-js/), and React 16 shipped under MIT four days later. React 15.6.1's license field and LICENSE file both say BSD-3-Clause. The patent terms lived in a third file that neither one mentions.

## What does the BSD license require when you ship code?

The BSD license requires its copyright notice, conditions, and disclaimer to travel with every copy you distribute. Distribution triggers it. Running BSD code on your own servers hands no copy to anyone, so the conditions never apply. A desktop app, a mobile binary, a container image customers pull, and a JavaScript bundle served to browsers are all distributions.

The binary clause asks for more than a copyright line. "This list of conditions and the following disclaimer" means the full license text, reproduced for every BSD component. The usual way to meet it is a third-party notices file at a stable URL or behind an About screen, which is the "other materials provided with the distribution" the clause anticipates. That is part of ordinary [license compliance](https://socket.dev/glossary/license-compliance), and default toolchains do not do it for you.

The BSD wording is friendlier to bundlers than MIT's, but bundlers still lose the notice. When minifying, [esbuild keeps only legal comments](https://esbuild.github.io/api/#legal-comments): comments that contain @license or @preserve, or that start with //! or /\*!. We located the main entry file for 392 of the BSD-2-Clause and BSD-3-Clause packages on npm's top-downloads list. Only 33 of those files, 8.4%, contain any of those markers. estraverse's header, quoted above, is an ordinary block comment, so a minified bundle drops it. Our MIT License entry measured the same gap for MIT packages: 8.5% of their main files carry a marker. The BSD license never required the notice inside the code, only alongside it, so the fix is the same in both cases. Generate a notices file from each bundled package's license files at build time.

A [software bill of materials](https://socket.dev/glossary/software-bill-of-materials) tells you which components went into a build. It records a license identifier, not the notice text you owe, and for the reasons in the next section the identifier itself may be wrong. Socket generates attribution data for a whole dependency set, from the license and author information it finds across each package's files, through a package's License panel or the API, as [our license features announcement](https://socket.dev/blog/introducing-socket-license-detection) describes.

## A declared BSD license is a claim about which BSD

Package metadata is where most tools learn a dependency's license, and for the BSD family it is often too coarse to act on. We measured both large registries on October 26, 2026.

On npm, we took the 15,916 packages on npm-high-impact 1.13.0's top-downloads list, each downloaded at least 1,000,000 times a week when the list was compiled. 15,910 had a resolvable latest version, and 462 of those, 2.9%, mention BSD in their license metadata. 304 declare exactly BSD-3-Clause, 116 BSD-2-Clause, and 5 0BSD. Twelve more declare a bare "BSD" or "BSD License." BSD-3-Clause packages include source-map and qs, numbers 25 and 91 on the list.

On the [Python Package Index (PyPI)](https://socket.dev/glossary/python-package-index-pypi), we took the top 5,000 projects in Hugo van Kemenade's top-pypi-packages snapshot of October 1, 2026, ranked by 30-day downloads. 4,999 resolved, and 712 of them, 14.2%, carry BSD in their license metadata. The BSD share on PyPI is nearly five times npm's. idna (number 4), pandas, Flask, and Django declare BSD-3-Clause, and numpy declares BSD-3-Clause AND 0BSD AND MIT AND Zlib AND CC0-1.0.

For each BSD-labeled package we read the license files in its latest npm tarball or its smallest PyPI wheel. We classified each file by which BSD clauses it contains, using the standard clause wording. We did not judge equivalence under the SPDX matching guidelines.

> What license files contain, for 265 PyPI projects whose metadata says only BSD and 423 npm packages that declare an exact BSD identifier

The figure as text: of the 265 PyPI projects whose metadata says only BSD, 184 (69.4%) ship 3-clause text, 30 (11.3%) ship 2-clause text, 39 (14.7%) have no license file we could read in the wheel, and 12 (4.5%) ship other text, including MIT, Apache, GPL, and 0BSD. Of the 423 npm top-downloads packages that declare BSD-2-Clause, BSD-3-Clause, or 0BSD, 381 (90.1%) ship a license file whose clauses match, 35 (8.3%) ship no root license file, 5 (1.2%) ship the Apache License 2.0, and 2 (0.5%) ship different BSD clauses.

### Exact identifiers on npm mostly match the files

Of the 423 npm packages that declare exactly BSD-2-Clause, BSD-3-Clause, or 0BSD, 381 ship a root license file with the clauses their identifier names. Two more were over our 50 MB scan limit and are not counted. The 42 that do not match fall into three groups:

- 35 ship no license file at the package root, including esrecurse, glob-to-regexp, and seven @yarnpkg packages declared BSD-2-Clause.
- 5 declare BSD-3-Clause and ship the Apache License 2.0: rsocket-core and three other rsocket packages at 0.0.29-alpha.0, and @salesforce/types 1.9.0.
- 2 ship different clauses than they declare. raven 2.6.4 declares BSD-2-Clause and ships a 3-clause file with a non-endorsement clause naming Sentry. onecolor 4.1.0 declares BSD-2-Clause and ships a source clause and a non-endorsement clause, with no binary clause at all.

The opposite direction is harder to see, because a license scanner that trusts metadata never looks. Across all 13,780 top-downloads packages that ship a root license file, ten declare MIT, ISC, or Apache-2.0 and ship only BSD terms. Four are Sentry's bundler plugins. Their LICENSE file has an MIT heading over BSD-3-Clause text:

```text
$ npm view @sentry/webpack-plugin@11.9.0 license
MIT

$ head -12 package/LICENSE    # from @sentry/webpack-plugin-11.9.0.tgz
# MIT License

Copyright (c) 2022-2026, Sentry
All rights reserved.

Redistribution and use in source and binary forms, with or without
modification, are permitted provided that the following conditions are met:

- Redistributions of source code must retain the above copyright notice, this
  list of conditions and the following disclaimer.

- Redistributions in binary form must reproduce the above copyright notice,
```

The file continues with the non-endorsement clause and the BSD disclaimer. @sentry/vite-plugin, @sentry/bundler-plugin-core, and @sentry/babel-plugin-component-annotate ship the same text. The repository's root LICENSE is MIT text. The per-package LICENSE, which is the file npm publishes, is BSD-3-Clause. Both are permissive, so the practical risk is small, but the metadata, the heading, and the terms disagree about which license applies.

Smaller errors appear too. pikaday declares "(0BSD OR MIT)" and ships MIT text plus a 2-clause BSD license, not 0BSD. That metadata offers a no-attribution choice that the file never grants. splaytree-ts declares "BDS-3-Clause." None of the 13,780 root license files contains the 4-clause advertising clause.

The npm CLI accepts all of it. npm's [package.json documentation](https://docs.npmjs.com/cli/v12/configuring-npm/package-json#license) asks for "a current SPDX license identifier," but npm 12.2.1 publishes a bare "BSD" without comment:

```text
$ cat package.json
{ "name": "bsd-demo-a", "version": "1.0.0", "license": "BSD" }
$ npm --version
12.2.1
$ npm publish --dry-run
npm notice
npm notice package: bsd-demo-a@1.0.0
npm notice Tarball Contents
npm notice 19B index.js
npm notice 63B package.json
npm notice Tarball Details
...
npm warn publish This command requires you to be logged in to https://registry.npmjs.org/ (dry-run)
npm notice Publishing to https://registry.npmjs.org/ with tag latest and default access (dry-run)
+ bsd-demo-a@1.0.0
```

The only warning is about authentication.

### PyPI metadata often says only "BSD"

Python's license metadata has three places to put a license, and only one of them is precise. Of the 712 BSD-labeled PyPI projects, 219 declare a License-Expression, the SPDX field that PEP 639 added in core metadata 2.4. 161 write a clause count in the free-text License field, and 58 paste the whole license into it. 265, 37.2%, say only BSD: 180 put "BSD," "BSD License," or similar in the License field, and 85 rely on the trove classifier License :: OSI Approved :: BSD License alone. The last 9 pair the BSD classifier with a License string that names something else.

Jinja2 is the most-downloaded example, at number 41. Its 3.1.6 wheel declares no license field at all, only the classifier:

```text
$ unzip -p jinja2-3.1.6-py3-none-any.whl jinja2-3.1.6.dist-info/METADATA | grep -E '^(Metadata-Version|License|Classifier: License)'
Metadata-Version: 2.4
Classifier: License :: OSI Approved :: BSD License
License-File: LICENSE.txt
```

The classifier cannot be resolved without the file. [PEP 639](https://peps.python.org/pep-0639/) deprecates license classifiers and names this one as its example of "the ambiguous classifiers (such as License :: OSI Approved :: BSD License)." Reading the 265 projects' license files resolves most of them. 184 contain 3-clause text and 30 contain 2-clause text. 39 have no license file we could read in the wheel, and 12 hold something else, including MIT, Apache, and GPL text and one 0BSD file. numba, pyasn1-modules, and nest-asyncio all declare "BSD" and ship the 2-clause license.

You can run the same check on your own dependencies. This script reads every installed license file in a node\_modules directory or a Python site-packages directory, and prints each one that grants BSD terms, with its clauses and the package's declared license:

```python
#!/usr/bin/env python3
"""Print each installed license file that grants BSD terms, with its clauses.
Usage: python3 bsd_clauses.py node_modules
       python3 bsd_clauses.py .venv/lib/python3.13/site-packages"""
import json, pathlib, re, sys

GRANT = "redistribution and use in source and binary forms"
CLAUSES = {
    "source": "redistributions of source code must retain",
    "binary": "redistributions in binary form must reproduce",
    "advertising": "all advertising materials mentioning",
    "endorsement": "be used to endorse or promote",
}

def normalize(text):
    text = re.sub(r"(?m)^[ \t]*(//+|#+|\*+)", " ", text)
    return re.sub(r"\s+", " ", text).lower()

def declared(pkg):
    if (pkg / "package.json").is_file():
        return str(json.loads((pkg / "package.json").read_text()).get("license"))
    head = (pkg / "METADATA").read_text(errors="replace").split("\n\n")[0]
    fields = re.findall(r"^((?:License-Expression|License): .*|Classifier: License :: .*)$", head, re.M)
    return " | ".join(fields)

def license_files(pkg):
    files = pkg.rglob("*") if pkg.name.endswith(".dist-info") else pkg.iterdir()
    return sorted(f for f in files if f.is_file() and re.search(r"licen[cs]e|copying", f.name, re.I))

root = pathlib.Path(sys.argv[1])
pkgs = [p.parent for p in root.rglob("package.json")
        if p.parent.parent.name == "node_modules"
        or (p.parent.parent.name.startswith("@") and p.parent.parent.parent.name == "node_modules")]
pkgs += list(root.glob("*.dist-info"))
for pkg in sorted(set(pkgs)):
    for f in license_files(pkg):
        text = normalize(f.read_text(errors="replace"))
        if GRANT in text:
            found = "+".join(k for k, phrase in CLAUSES.items() if phrase in text)
            print(f"{pkg.name}/{f.name}: declared {declared(pkg)!r}, clauses {found}")
```

Run against a site-packages directory with idna 3.20, Jinja2 3.1.6, numba 0.68.0, and visions 0.8.1 installed, it prints:

```text
idna-3.20.dist-info/LICENSE.md: declared 'License-Expression: BSD-3-Clause', clauses source+binary+endorsement
jinja2-3.1.6.dist-info/LICENSE.txt: declared 'Classifier: License :: OSI Approved :: BSD License', clauses source+binary+endorsement
numba-0.68.0.dist-info/LICENSE: declared 'License: BSD | Classifier: License :: OSI Approved :: BSD License', clauses source+binary
numba-0.68.0.dist-info/LICENSES.third-party: declared 'License: BSD | Classifier: License :: OSI Approved :: BSD License', clauses source+binary+endorsement
visions-0.8.1.dist-info/LICENSE: declared 'License: BSD License', clauses source+binary+advertising+endorsement
```

The last line is the one that matters. visions 0.8.1 says "BSD License" in its metadata and ships a 4-clause license whose third condition reads: "All advertising materials mentioning features or use of this software must display the following acknowledgement: This product uses 'visions', read more at https://github.com/dylan-profiler/visions." Every visions release from 0.7.5 in December 2021 through 0.8.1 in February 2025 carries the same pairing. visions 0.8.2, published May 26, 2026, finally declares License-Expression: BSD-4-Clause.

The ambiguous releases are the ones people install. ydata-profiling 4.18.4, a data-profiling library that declares the MIT License, requires visions\>=0.7.5,\<0.8.2. Every visions release that range allows carries the advertising clause under a "BSD License" label. A policy that maps "BSD" to BSD-3-Clause approves a dependency that the FSF calls GPL-incompatible and that Apache projects may not include.

Socket's [Ambiguous License Classifier](https://socket.dev/alerts/ambiguousClassifier) alert flags exactly this metadata pattern. It fires on PEP 301 classifiers that "identify more than one license without any additional information," with the BSD classifier as its example. Socket's License panel then shows each license found in the package's files and where it was found. The metadata alone is not enough: as our [license analysis write-up](https://socket.dev/blog/socket-license-analysis) puts it, registry license data "is more often than not a gross underestimate."

## The license field should name the clauses

The BSD family has outgrown its name. "BSD" once meant one university's license. It now covers 45 SPDX identifiers with different obligations, and the differences that matter, advertising, endorsement, and patents, are exactly the ones a bare "BSD" hides.

Registries can fix most of this at publish time. The npm registry should reject license strings that are not valid SPDX expressions, as its own documentation already asks. "BSD" and "BDS-3-Clause" would fail, and the publisher would fix them in seconds. PyPI accepts License-Expression and deprecated the BSD classifier in PEP 639, but only 219 of the 712 BSD-labeled projects we measured use the new field. A publish-time warning for the ambiguous classifier would reach the rest. Both registries could display the license detected in the files beside the declared one, so that Sentry's MIT heading over BSD text would surface on the package page.

An exact identifier still does not finish the job. React's PATENTS file sat beside a valid BSD-3-Clause LICENSE until React 16. Open WebUI shows the newer version of the problem. Its code through v0.6.5 is BSD-3-Clause. Its [license page](https://docs.openwebui.com/license/) says that from v0.6.6, effective April 19, 2025, "You may NOT alter, remove, or obscure any 'Open WebUI' branding," and that the new license "is not an OSI-approved 'open source' license." SPDX lists the text as BSD-3-Clause-OpenWebUI, the "BSD 3-Clause - OpenWebUI variant." A license name that begins with BSD-3-Clause is no longer evidence that the terms are BSD-3-Clause. The only reliable input is the text in the files you ship.