Licence risk with open-source tools: three examples from 2025 and 2026

What does licence risk mean?

Open-source software costs no licence fee, but it has a rights holder and a development effort that someone pays for. If either of these changes, what you receive in future changes too. The risk rarely lies in existing installations being banned overnight. It lies in updates, security fixes and new features arriving differently or not at all.

Three examples from 2025 and 2026 show three forms of this.

Tool	What happened	When	Licence today
Mirth Connect (interface engine)	Switch from an open to an exclusively commercial licence	Version 4.6, announced 19 March 2025	Up to 4.5.2 MPL 2.0, from 4.6 commercial
Flowise (toolkit for AI agents)	Acquired by Workday, then development discontinued	Acquisition 14 August 2025, discontinued 29 July 2026	Apache 2.0, repository archived
Langflow (toolkit for AI workflows)	Two changes of owner: DataStax, then IBM	4 April 2024 and 28 May 2025	MIT, unchanged

What happened with Mirth Connect?

Mirth Connect is a widely used interface engine in healthcare: it exchanges messages between clinical systems, for example via HL7 and FHIR. Up to version 4.5.2, the source code was under the Mozilla Public License 2.0, alongside commercial extensions. On 19 March 2025, the vendor NextGen Healthcare announced that with version 4.6 it would move to a single commercial, proprietary licence model.

For organisations using the open edition, NextGen named three paths: stay on their current version, move to 4.5.2 as the last open version, or buy a licence and move to 4.6. For approved, ongoing research studies at non-profit institutions, there is a free research licence.

The community produced forks, among them BridgeLink, backed by Innovar Healthcare: built on Mirth Connect 4.5.2 and still under the Mozilla Public License 2.0. BridgeLink’s administration interface is under a different licence, the Business Source License 1.1. So even with a fork, it pays to look at every component. A second fork, the Open Integration Engine, is also under the Mozilla Public License 2.0 and has been a project of the Eclipse Foundation since 2026. Versions, security vulnerabilities and paths for organisations running Mirth: Mirth Connect: licence, forks and connection to AI.

How interface engines and AI platforms differ in a hospital is described in HIS, interface engine and AI platform.

What happened with Flowise?

Flowise was a visual toolkit for AI agents under the Apache 2.0 licence. Workday acquired Flowise in August 2025. On 29 July 2026, the core team announced that development would stop immediately; since 13 August 2026 the repository has been read-only, and since 31 August 2026 the core team can no longer be contacted. Packages and container images are marked as deprecated.

The code remains available under Apache 2.0, and the team explicitly encourages forks. Anyone who keeps running Flowise takes on maintenance and security updates themselves or moves elsewhere. The licence did not change here; what ended was the development.

What happened with Langflow?

Langflow, a toolkit for AI workflows in Python, comes from Logspace. DataStax announced the acquisition on 4 April 2024. IBM announced on 25 February 2025 that it would acquire DataStax and completed the acquisition on 28 May 2025. In its announcement, IBM committed to continue supporting the Langflow community.

Langflow remains under the MIT licence (as of 11 October 2026). So far, only the owner has changed. For procurement, this means: the direction of development is now set by a large corporation with its own product strategy. That is not a flaw, but it is a point you should know about when making a long-term decision.

Which licences sound like open source but are not?

Open source as defined by the Open Source Definition allows use for any purpose. Several well-known tools make their code visible but set limits:

• n8n: Sustainable Use License. Use for your own internal business purposes and non-commercial use are allowed; not allowed is, for example, running n8n as a paid service for others.
• Dify: modified Apache 2.0 licence. No operation for multiple tenants without written permission; the logo and copyright in the interface may not be removed. Contributors agree that the vendor may make the licence stricter or more permissive.
• Camunda 8: source code under the Camunda License 1.0; since version 8.6 (October 2024), production use on your own premises requires a licence.

These models are legitimate and clearly described in the licence text. They simply belong in a different category from “free of charge and free to use”.

What does this mean for procurement?

• Read the licence text, not the label: Is the licence approved by the Open Source Initiative? Are there additional conditions on tenants, resale or production use?
• Know the rights holder: Who owns the code, and may the owners change the licence for future versions? Who funds the development?
• Record version and components: Which version is running, and under which licence is each component? A software bill of materials (SBOM) helps here.
• Plan an exit: What will you do if updates stop? Are there forks, a service provider for maintenance, an export of your workflows and data? More on this in Exit strategy for AI platforms.
• Plan for security updates: If development stops, nobody closes new vulnerabilities any more. Anyone running software without a vendor carries this duty themselves; see Liability: open-source build or purchased platform?.

Similar questions arise for AI models; they are covered in Using open AI models in your organisation.

How does this work with basebox?

basebox is not open source, and there are no plans for it to be. You get a licence with support and updates, and a contractual partner. basebox builds on open-source components such as vLLM and Keycloak; which ones are included is listed in the software bill of materials (SBOM). For the case of insolvency, it is agreed that the code will be published as open source so that customers can keep working. Apps with their instructions, knowledge bases and settings can be exported.

Not legal advice: This article classifies licences in general terms. Whether a licence permits your use, check in the licence text and, if in doubt, with your legal department. Information as of 11 October 2026; licences and owners can change.