Apache-2.0 is a permissive licence with two things MIT does not spell out: an explicit patent grant from every contributor, and a termination clause that revokes it if you bring a patent claim about the work. For anything you intend to distribute widely, that difference is the reason to prefer it.
Filed under the SPDX identifier GitHub reports for the repository,
not under what the README claims. NOASSERTION means a licence file
exists that GitHub could not match to an SPDX identifier — read it
before you depend on it.
Why ACTIVE: pushed_at = 2026-08-05 — 9 days, within the 90-day ACTIVE threshold.
Field
Value at this printing
pushed_at
2026-08-05
archived
false
latest_release
v1.61.1 · 2026-06-23
license.spdx_id
Apache-2.0
stargazers_count
4100
http_status
200
fetched_at
2026-08-14T09:12:00Z
rubric_edition
2nd, in force
Endpoint: GET https://api.github.com/repos/Kaliiiiiiiiii-Vinyzu/patchright
unauthenticated · 60 req/hr
A live read does not change what is printed above it. The site records that you ran it; what GitHub returned is not kept. The printed state moves only when the register is swept and a new printing is issued. raw JSON
Why ACTIVE: pushed_at = 2026-08-09 — 5 days, within the 90-day ACTIVE threshold.
Field
Value at this printing
pushed_at
2026-08-09
archived
false
latest_release
—
license.spdx_id
Apache-2.0
stargazers_count
1500
http_status
200
fetched_at
2026-08-14T09:12:00Z
rubric_edition
2nd, in force
Endpoint: GET https://api.github.com/repos/Kaliiiiiiiiii-Vinyzu/patchright-python
unauthenticated · 60 req/hr
A live read does not change what is printed above it. The site records that you ran it; what GitHub returned is not kept. The printed state moves only when the register is swept and a new printing is issued. raw JSON
Why SEMI: pushed_at = 2026-02-26 — 169 days, inside the 90–365 day SEMI band.
Field
Value at this printing
pushed_at
2026-02-26
archived
false
latest_release
—
license.spdx_id
Apache-2.0
stargazers_count
1200
http_status
200
fetched_at
2026-08-14T09:12:00Z
rubric_edition
2nd, in force
Endpoint: GET https://api.github.com/repos/daijro/browserforge
unauthenticated · 60 req/hr
A live read does not change what is printed above it. The site records that you ran it; what GitHub returned is not kept. The printed state moves only when the register is swept and a new printing is issued. raw JSON
Why ACTIVE: pushed_at = 2026-08-06 — 8 days, within the 90-day ACTIVE threshold.
Field
Value at this printing
pushed_at
2026-08-06
archived
false
latest_release
v2.1.88 · 2026-08-05
license.spdx_id
Apache-2.0
stargazers_count
2600
http_status
200
fetched_at
2026-08-14T09:12:00Z
rubric_edition
2nd, in force
Endpoint: GET https://api.github.com/repos/apify/fingerprint-suite
unauthenticated · 60 req/hr
A live read does not change what is printed above it. The site records that you ran it; what GitHub returned is not kept. The printed state moves only when the register is swept and a new printing is issued. raw JSON
Why DEAD: pushed_at = 2023-01-08 — 1314 days, past the 1095-day outer threshold.
Field
Value at this printing
pushed_at
2023-01-08
archived
false
latest_release
—
license.spdx_id
Apache-2.0
stargazers_count
2200
http_status
200
fetched_at
2026-08-14T09:12:00Z
rubric_edition
2nd, in force
Endpoint: GET https://api.github.com/repos/jackspirou/clientjs
unauthenticated · 60 req/hr
A live read does not change what is printed above it. The site records that you ran it; what GitHub returned is not kept. The printed state moves only when the register is swept and a new printing is issued. raw JSON
Why ACTIVE: pushed_at = 2026-08-13 — 1 days, within the 90-day ACTIVE threshold.
Field
Value at this printing
pushed_at
2026-08-13
archived
false
latest_release
—
license.spdx_id
Apache-2.0
stargazers_count
1100
http_status
200
fetched_at
2026-08-14T09:12:00Z
rubric_edition
2nd, in force
Endpoint: GET https://api.github.com/repos/plabayo/rama
unauthenticated · 60 req/hr
A live read does not change what is printed above it. The site records that you ran it; what GitHub returned is not kept. The printed state moves only when the register is swept and a new printing is issued. raw JSON
Each contributor grants a perpetual, worldwide, royalty-free patent licence covering their own contributions. If you then sue anyone alleging that the work infringes a patent, your patent licence under Apache-2.0 terminates. That reciprocity is deliberate and it is the clause corporate legal review is usually looking for.
The other obligations are modest and administrative: retain notices, state significant changes in modified files, and carry any NOTICE file forward. None of them requires you to publish your own source.
What it does not do
It is not copyleft. Nothing in it obliges you to distribute your modifications, and nothing in it reaches across a network boundary the way AGPL-3.0 does. Combining Apache-2.0 code with proprietary work is permitted, and this catalogue files it in the permissive bucket for that reason.
This register reads the identifier from the repository's own licence metadata at the field check, not from a README badge, and prints it exactly as the API returned it.
Questions about the Apache-2.0 entries
Licence questions, answered from the field this register reads and from the licence texts themselves. Nothing here is legal advice.
Is Apache-2.0 safer than MIT for a commercial product?
Many legal teams treat it that way because of the explicit patent grant and termination clause, which MIT does not contain. This register records the identifier the repository declares and files both in the permissive bucket; it does not give legal advice.
Do I have to publish changes to Apache-2.0 code?
No. The licence asks you to retain notices and to state significant changes in the files you modified. It contains no source-disclosure obligation, which is what separates it from the copyleft licences grouped elsewhere in this catalogue.
How is the licence for each entry determined?
From the repository host's own licence metadata, read at the field check and printed with that timestamp attached. A README badge is not consulted, and where the metadata resolves to NOASSERTION the register says so rather than guessing.
Every row above was chosen by somebody who then had to establish two
separate things — whether the code was alive, and whether it was theirs
to use. Donut Browser answers the second in its own repository: an
open-source anti-detect browser under AGPL-3.0, with the desktop
application and the sync server both in that repository, engine-level
fingerprint spoofing through the Wayfern Chromium fork rather than
injected JavaScript, a local REST API and MCP server on your own
machine, zero telemetry, and a pre-launch gate that refuses to start a
profile when the proxy's exit geography contradicts the profile's
fingerprint. Its own licence row is in
this same catalogue, read at the same
field check as everything else.