What happened to TinyMCE's license?

[brianwarner]

It looks like the license was changed from MIT to GPLv2 yesterday.

The FAQ indicates that v6 onward would be MIT. As of 2024-02-29 it reads, "The TinyMCE core editor is free to use for commercial and noncommercial purposes. When it comes to licensing, the TinyMCE version 5 series makes use of an LGPL license. This is a distinct from a GPL licence, which is a copyleft licence.

Whereas from TinyMCE version 6 onwards, the core TinyMCE editor runs under an MIT License."

The commit references a JIRA ticket which isn't public. Can someone please shed some light on this?

[TheSpyder]

The public announcement hasn't gone up yet. Please remember that all we’ve done is change the repository, we haven’t released TinyMCE 7 yet, so you are commenting on a topic for which we haven’t had time to prepare content on the website. We just needed to update the source code to meet an engineering deadline.

Forever is a long commitment, and I agree that the wording used in that blog post was unfortunate in the context of the decision to change the free open source license of TinyMCE 7 from MIT to GPL. We will adjust the content on the website in the coming days.

TinyMCE 7 will only be available for free in software that complies with GPL version 2 or later.

[thorsten]

This is a quite bad decision if you want to bundle TinyMCE with an open source solution with a different open source licence.

[javierpaniza]

Indeed OpenXava has a LGPL license and uses TinyMCE 6, now we'll looking for another rich editor library. Curiously, the reason for changing CKEditor by TinyMCE in OpenXava some time ago was the license change in CKEditor, and now we found the same problem again.

[aemdy]

Could anyone explain if we can use TinyeMCE based on GPLv2 licence.

We have a commercial SaaS product that has a website written in React. On one of the pages on the website, there is an input field using TinyMCE.

While we do not plan to publish our website's source code, anyone can open up a URL and navigate to the page where TinyMCE editor is used. Are we breaching the licence terms here or not?

[smalos]

Could anyone explain if we can use TinyeMCE based on GPLv2 licence.

We have a commercial SaaS product that has a website written in React. On one of the pages on the website, there is an input field using TinyMCE.

While we do not plan to publish our website's source code, anyone can open up a URL and navigate to the page where TinyMCE editor is used. Are we breaching the licence terms here or not?

If you're using TinyMCE in a commercial SaaS product, you need to ensure that your usage complies with the terms of the TinyMCE license. The GPLv2 license allows you to use TinyMCE in your SaaS product, but there are certain conditions you must follow:

1. Distribution of Source Code: If you modify the TinyMCE code, you must make those modifications available to anyone who receives your product. Since you're not planning to publish your website's source code, this requirement may not apply to you as long as you're not modifying the TinyMCE source code.

2. Copyleft Provision: Any derivative work of TinyMCE must also be licensed under the GPLv2 license. This means that if you're incorporating TinyMCE into your website and your website is considered a derivative work, you must make your website's source code available under the GPLv2 license. However, there's a gray area regarding whether linking to TinyMCE through JavaScript constitutes a derivative work. Some argue that it does not, as long as TinyMCE operates as a separate program.

3. Dynamic Linking: If your website dynamically links to TinyMCE (e.g., through JavaScript), it's generally considered separate from TinyMCE itself, and the copyleft provision may not apply. However, this interpretation can vary, and you should consult legal advice to ensure compliance.

Given that your website is publicly accessible, it's important to carefully review the terms of the GPLv2 license and consider seeking legal advice to ensure that your usage of TinyMCE complies with the license terms and does not inadvertently breach any obligations.

[mrinasugosh]

@aemdy We will be releasing more notes on this and what it means for SaaS applications later this week. You can always contact us here for more clarification: https://www.tiny.cloud/contact/

If you have any concerns about the GPLv2+ license and its compatibility with your commercial project, Tiny offers the option to purchase a commercial license. This removes the copyleft requirements of GPLv2+, allowing you to use TinyMCE without affecting the proprietary status of your application's code.

We would also like to reassure you that older versions of TinyMCE remain under their original license (ie TinyMCE 6 would continue to be licensed under MIT). We will also continue to issue security fixes for the open source version of TinyMCE 6 for some time to give you time to consider the upgrade to TinyMCE 7.

Its always advisable to consult with a legal expert in software licensing to ensure full compliance. Please let us know if you have any additional questions or concerns around this.

-TinyMCE Team

[aemdy]

@mrinasugosh Thank you. I am looking forward to reading news from you about the licencing update.

Meanwhile, we decided to use TinyMCE 6 which is licenced under MIT and suits our needs well.

[Luzefiru]

@mrinasugosh Thank you. I am looking forward to reading news from you about the licencing update.

Meanwhile, we decided to use TinyMCE 6 which is licenced under MIT and suits our needs well.

Do you have any official statements from TinyMCE stating it is licensed under MIT? I do see the license.txt in their TinyMCE v6.8.3 CDN files though.

Does this mean I can use their editor via the CDN for commercial use without worrying about legal issues down the line?

[aemdy]

@mrinasugosh Thank you. I am looking forward to reading news from you about the licencing update. Meanwhile, we decided to use TinyMCE 6 which is licenced under MIT and suits our needs well.

Do you have any official statements from TinyMCE stating it is licensed under MIT? I do see the license.txt in their TinyMCE v6.8.3 CDN files though.

Does this mean I can use their editor via the CDN for commercial use without worrying about legal issues down the line?

We are using NPM version (https://www.npmjs.com/package/tinymce/v/6.8.3) and its licence file states MIT. We assume it is licenced as MIT as far as we do not upgrade to 7.*.

[Luzefiru]

We are using NPM version (https://www.npmjs.com/package/tinymce/v/6.8.3) and its licence file states MIT. We assume it is licenced as MIT as far as we do not upgrade to 7.*.

I see, I guess we are on the same boat. I wish the TinyMCE team was more explicit on older version licensing provisions in their documentation or website.

[mrinasugosh]

@aemdy @Luzefiru

TinyMCE v6.8.3 remains under the MIT open source license, which supports commercial use.

When v6 reaches end of life, your teams would need to address any concerns or questions about your eligibility to upgrade and use TinyMCEv7 under the GPL v2+ License. We recommend reaching out to us via our contact page and consulting your legal team for advice on full compliance.

Hope that helps!

[Luzefiru]

When v6 reaches end of life, your teams would need to address any concerns or questions about your eligibility to upgrade and use TinyMCEv7 under the GPL v2+ License.

Can we continue to use TinyMCE v6.8.3 even after its EOL under the MIT License?

[thorsten]

@Luzefiru yes

[mrinasugosh]

When v6 reaches end of life, your teams would need to address any concerns or questions about your eligibility to upgrade and use TinyMCEv7 under the GPL v2+ License.

Can we continue to use TinyMCE v6.8.3 even after its EOL under the MIT License?

@Luzefiru Yes, TinyMCE v6.8.3 can be used under the MIT License even after its official end-of-life (EOL). However, please note that after EOL, the version will no longer receive updates, including security fixes, which might be important for the ongoing safety and functionality of your project. It's always a good idea to keep your software up to date with the latest versions, when possible, for security and new features.

-TinyMCE Team

[thorsten]

@mrinasugosh But there's no solution for open source software with a license which is not compatible with the GPLv2

[Georg-Git]

What a mess with GPLv2+ and a lot of complex use cases.

The scope of GPLv2 is: Activities other than copying, distribution and modification are not covered by this License; they are outside its scope. The act of running the Program is not restricted https://www.gnu.org/licenses/old-licenses/gpl-2.0

Lets start with a first use case - a public available website with two js applications:

<script src="https://cdn.jsdelivr.net/npm/tinymce@7/tinymce.min.js"></script>
<script src="https://my.domain/myProprietaryCode.js"></script>

GPLv2:

• modifications: not applicable
• distribution: done by TinyMCE via npm via jsdelivr
• copy: the browser of the user makes a copy onto his computer, but only to run the Program, not for distribution => not applicable

In this use case the GPLv2 requirements do not apply, neither to my website nor to myProprietaryCode.js.

Is that the common understanding?

[mrinasugosh]

@mrinasugosh But there's no solution for open source software with a license which is not compatible with the GPLv2

We are planning to support our Tiny 6 users on MIT as they consider their best upgrade paths. We recommend exploring options like obtaining a commercial license for TinyMCE or contacting us here for a dialogue on alternative solutions.

-TinyMCE Team

[javierpaniza]

@mrinasugosh But there's no solution for open source software with a license which is not compatible with the GPLv2

The only solution for that case is looking for another library. TinyMCE will be no longer be used by open source projects, well, only by GPL open source projects.

[ThiefMaster]

It's a true shame to see you go a similar route as CKEditor.

It is always advisable to consult with a legal expert in software licensing to ensure full compliance. Please let us know if you have any additional questions or concerns around this.

Please publish your interpretation of how the GPL applies when using CKeditor TinyMCE in the various ways (embedding JS from a public CDN, using it directly - but unmodified - in your webpack build, etc.). Asking people to ask [their] lawyers is "taking the easy way". And just because someone's lawyer interprets the license in a particular way, that does not mean you / your lawyers do the same.

PS: It is also extremely confusing that your team members are not actually labelled as members of the tinymce github org. It's not like anyone can trust the fact that a comment is signed by "-TinyMCE Team" since I or anyone else could write the same...

---

The only solution for that case is looking for another library. TinyMCE will be no longer be used by open source projects, well, only by GPL open source projects.

I think the problem is that the amount of decent WYSIWYG editors is highly limited. There's CKEditor (GPL with a very obscure interpretation and quite ridiculous terms when you want a non-GPL open source exception) and TinyMCE... And I believe that's pretty much it.

[TheSpyder]

Mrina is tagged as a member, just as I am.

[ThiefMaster]

@mrinasugosh isn't, most likely she set her org membership to private in which case only other org members can see the label

[TheSpyder]

Apologies, I didn't realise. We'll get that fixed.

[woody-li]

So, what's the EOL date of version 6?

[m-blank-eneatec]

So, what's the EOL date of version 6?

According to the docs, the EOL for TinyMCE 6.8 is set for 2025-06-06.

[pferreir]

Yeah, please clarify what this means for non-GPL FOSS which makes use TinyMCE. Leaving it in a grey area is not a solution and demonstrates lack of transparency. I understand you want to avoid commercial usage of your project without anything in return, but maybe there are other solutions like dual licensing (e.g. MIT + commercial exception)?

[ThiefMaster]

Exactly!

Also, it seems like all you offer as a "simple one-click/webshop purchase" are cloud licenses, using your hosted infrastructure, and billed by "number of 'editor loads'". This is not great for all those of us who are privacy-friendly and do not even use public CDNs to load JS libraries.

While as a FOSS project it's somewhat strange to buy licenses to begin with (unless there were very good conditions and those would be applied in a way that anyone using that particular project was also be covered by it), it's completely out of the realm of what one would even consider when the only options you have are 1) paying by number of loads (that's just not scalable for anything freely downloadable!) or 2) having to contacting "enterprise" sales which is not only a hassle for everyone but probably also implies a somewhat high price tag.

[pgeorgi]

People are mentioning incompatible open source licenses in this discussion. The change is to "GPL v2 or later", which should cover compatibility with most open source licenses. That makes me wonder: which free software / open source licenses (by OSI, FSF, or DFSG standards) are affected?

[ssddanbrown]

@pgeorgi I think you'd be affected if currently licensing under anything more permissive that the GPLv2, along with any scenarios under terms incompatible with the GPLv2+ (many open or proprietary scenarios).

For me, I distribute my software under MIT, which I couldn't do in the same way if TinyMCE is under GPLv2+ as far as my understanding, and interpretation of combined works (without changing licensing or making significant changes to how TinyMCE is used, but either of those would change licensing to my users overall).

---

Just to add, TinyMCE did provide a little more detail about this change in this discussion thread: https://github.com/tinymce/tinymce/discussions/9496

[javierpaniza]

That makes me wonder: which free software / open source licenses (by OSI, FSF, or DFSG standards) are affected?

All but GPL, For example, OpenXava is LGPL, it cannot include GPL software.

[gcb]

Why are open source people complaining? Have GPL FUD gone crazy again? it's actually pretty simple https://www.gnu.org/licenses/gpl-faq.html IMO for JS client side code, even gpl3 would not impact your open source usage.

The change should only affect commercial distribution. And even that only for people who ship opaque js to their customers, which is a feat on it's own. Otherwise I be very impressed how you expose a rich text editor to your clients via a closed source server...

if you distribute open source software you already satisfy the "provide source" requirement. You only have to accept that improvements to tinyMCE portion of the code will also be GPL.

Only if you change tinyMCE code and ship a minified/obfuscated version only, then you are risking not complying with GPL2. But then, you are already doing so many things wrong this your least concern. Go on merrily distribute your MIT, GPL3, whatever code using this.

not a lawyer. Just know how to read enough to not be affected by corporate lawyer's FUD who want the world to be MIT/BSD.

[ThiefMaster]

IMO for JS client side code, even gpl3 would not impact your open source usage.

The problem is that this is not clear at all. There are no interpretation guidelines from the TinyMCE company. You can probably even ask 3 laywers and they'll tell you different interpretations.

And if you look e.g. at CKEditor they very much consider GPL to be of impact here: Their interpretation is basically that if you embed their editor on your website, all your website's code must be GPL as well.

I think if Tiny Inc. provided a clear statement on how they expect people to follow GPL when it comes to TinyMCE, then this could make things much clearer.

[pferreir]

@gcb there are tons of discussions online on the subject, mostly inconclusive. You have the right to think it's "pretty simple", but I would prefer to hear from a lawyer.

[code959437957]

Good job, i still using tinymce 5.0 for years

[javierpaniza]

You only have to accept that improvements to tinyMCE portion of the code will also be GPL.

That is tha case for LGPL, but not for GPL. With GPL all the sofware must be GPL.

[The4thLaw]

@Georg-Git this might fall under the concept of "Mere aggregation"

See also https://opensource.stackexchange.com/a/4500 which is fairly interesting.

[gcb]

@pferreir there is not tons of discussions. there are tons of people who never read the license arguing. It's mostly noise the pages you linked to. Instead of reading that noise, read the canonical page i linked, from the license authors and enforcers themselves.

You say you want to hear from a layer, but you ignore the link i posted with answers from the lawyers who authored the license and instead link to a page full of "answers" that start with "i'm not a lawyer". :(

[Georg-Git]

GPLv2 was published in 1991. Javascript was not published until 1997 in the Netscape browser.

And in recent years, the Javascript landscape has become a more and more dynamic and complex programming environment. The many interpretations only prove that it is not so easy to transfer such an old license text to modern use cases.

I mean in particular the interpretations of the license authors themselves. In the end they remain just their own interpretations of an old license text.

Lawyers? Ultimately, only a judge’s decision counts – and then only for a specific case.

Even TinyMCE won't help with the interpretation of GPLv2 - why should they dilute their lawyers' powder?

TinyMCE had obviously asked its employees: Do you want mere recognition or more money?

Who will throw the first stone? Definitely not the ones in the darkened glass palaces. 😉

[lofcz]

Ultimately, this boils down to the same thing CK did. Unlike Tiny, they were a bit more open regarding the license. The important bit is:

As situations like this bring doubt, when analyzing the legality of a specific case, there will be a strong emphasis on understanding what are the intentions of the copyright owner (licensor). In our case, as explained in this issue, there is a clear intention, and I confirm it, of allowing CKEditor under the GPL license only within software that is also GPL, no matter which way such software is made available for end users. https://github.com/ckeditor/ckeditor5/issues/991#issuecomment-389812759

So the thing is simple. Whether the license is called GPLv2 or something else is pretty irrelevant, the important thing is Tiny wants money for you using their product unless you make the source code for your application available.

And as with CK, the pricing is expensive.

For us, this sucks as we have a lot of custom plugins and whatnot so migrating will be a major pain.

I see two ways forward:

1 - Someone forks v6 and maintains it. Whether Tiny stops v6 maintenance sooner or later is almost irrelevant as we are not getting the new features anyway so the technological debt will pile up, even if CVEs are fixed for a year or two. It would be awesome but I don't have my hopes up for this as the code is complex and without docs and having a few folks full-time on it, it's hard to imagine any meaningful progress materializing, hence something like Open~Tofu~ Tiny is unlikely.

2 - React folks (the majority) can just migrate to Lexical. As for Vanilla users (including niche frameworks like Blazor) the impact will be felt the harshest. As for us, we will stick with v6 for now and evaluate how much is Lexical usable without React. Quill v2 is also releasing soon, which might be OK-ish for some use cases.

Good luck everyone.

[rshekhtm]

Folks comparing CKEditor and Tiny licensing should be aware that the two companies are in fact owned by the same entity, called Tiugo Technologies, which appears to be a holding company. Tiny was acquired a year ago, and it's not terribly surprising that they are trying to streamline how the two products are licensed. I don't see any discussion of Tiugo or the acquisition in any of the comments, so this is probably not common knowledge.

[ThiefMaster]

Oh wow, that explains a lot... and their website indeed confirms that they own/control CK and Tiny.

[Blackbam]

In some project we spent half a year to replace CKEditor with TinyMCE in order to comply to license requirements and now you replace the license of this huge and all-time free great editor to GPL. Seriously, f*ck you ! 🤬🤬🤬

Really hope someone is going to do a fork of V6 and anyone will abandon that Tiugo Technologies crap.

[gcb]

I stand corrected, in this case.

The author have a wrong interpretation (in my opinion) and hold the wrong assumption which were never tested in court.

MIT software can very well distribute GPL components, provided source for all changes on the GPL component is also provided, and that this "exception" to the MIT software is always preserved (i.e. you never offer the software as a whole package as "MIT", you should always mention the component GPL license too. If at any point this is broken, then the author interpretation holds true. Which is also the case if you chose to sell it as a package, as now you cannot highlight the GPL component exception anymore.

but again, disrregard everything you read about gpl everywhere, including this comment. Only read from fsf and gnu.org. this is relevant here: https://www.gnu.org/licenses/gpl-faq.html#DoesTheGPLAllowMoney

[ssddanbrown]

@gcb Ultimately i believe (in my opinion that lacks legal expertise) this will come down specific scenario and use, along with interpretations of the license since there is room for interpretation when it comes to JavaScript style of use/inclusion. Also from the same FSF FAQ:

If a library is released under the GPL (not the LGPL), does that mean that any software which uses it has to be under the GPL or a GPL-compatible license? (#IfLibraryIsGPL) Yes, because the program actually links to the library. As such, the terms of the GPL apply to the entire combination. The software modules that link with the library may be under various GPL compatible licenses, but the work as a whole must be licensed under the GPL. [...]

For me, I don't feel I could use it in my MIT distributed project as-is since I distribute TinyMCE as part of it, and TinyMCE is a core part that makes up the greater works (rather than an optional separately-licensed component or similar). It's equivilient to it being "linked" IMO (although that's where some intepretation lies since "linking" is not the same in JavaScript, but the actual GPLv2 license doesn't mention linking itself, that's just part of the FAQ to help add clarity for that style of usage).

There's also the Author's (Tinys) intent of the license and their interpretation, which I don't think they've relayed but they've shown to be fairly business focused on the past when they used the LGPL license (They put forward questionable requirements in regards to branding and modifications). Additionally, if they only wanted to ensure the library itself remained under GPL they would have used LGPL (like they used to use).

[IT-ZZ]

Could anyone explain if we can use TinyMCE based on GPLv2 licence.

We have a commercial website that has both public and selfservice areas. Selfservice are is only used by our customers. On one of the pages of the selfservice, there is an input field using TinyMCE. TinyMCE is loaded on page via script tag.

We are planning to use TinyMCE version. 7, and it would be hosted on our website.

Website is built in .NET 6 and the website code is not available to anyone. Are we breaching the licence terms here or not?

[Blackbam]

@IT-ZZ Yes you can use TinyMCE on your website but you have to make the source code of the whole project public then. Or you pay one of those expensive plans TinyMCE offers on their website. It is the same issue as with CKEditor. It looks like the company of CKEditor has taken over TinyMCE because they want to eliminate the free competition and force everybody to pay, I am not 100% sure but it definitely looks like it.

If you use TinyMCE only internally you can keep using it for free. But a website frontend with customer access using TinyMCE means you are distributing the Source Code in the frontend to your customers which means all source code of the project has to be public or you have to use the commercial license - this is how lawyers explained it to us. In the backend you should be able to use it without restrictions.

Of course you could simply ignore it and keep using it, but there might be legal issues in the future then.

My suggestion is to create a fork of V6 and make a TinyMCFree project - I would contribute!

[lofcz]

Current pricing makes Tiny unusable for quite a few people. We would happily pay ~$500 / year for a perpetual license (a year of updates for free, keep using the last version before your license expires forever), and unlimited projects, unlimited loads. However, the plans now make the product inaccessible to us.

Consider applying the current pricing to companies with over X employees or Y revenue and introducing affordable plans for small & medium-sized companies.

[mikkorantalainen]

Could we have official clarificafion from TinyMCE that you actually want to enforce the requirements of GPL instead of LGPL?

The LGPL would clearly allow use on websites where the website is hosted on system that's not licensed as GPL but TinyMCE binds with JavaScript and would be considered similar to dynamic linking in binary executables and dynamic linking is only allowed with LGPL.

Note that versions before TinyMCE version 6 were licensed explictly as LGPL to make it possible to combine TinyMCE with other (that is, non-GPL) open source software. Version 7 being licensed with GPL would therefore mean that the usage that was historically okay with version 4 or version 5 is no longer acceptable with version 7!

[carlosmintfan]

In some project we spent half a year to replace CKEditor with TinyMCE in order to comply to license requirements and now you replace the license of this huge and all-time free great editor to GPL. Seriously, f*ck you ! 🤬🤬🤬

Really hope someone is going to do a fork of V6 and anyone will abandon that Tiugo Technologies crap.

That's right (although I'd say curses aren't okay even with some letter replaced with a *)

[carlosmintfan]

I don't know if they did anything to prevent this, but if not: So, this repo is licensed under the GPL. Now somebody makes a great PR with some awesome changes and TinyMCE merges it at once. Then, they release it in an upgrade and, of course, they also want to port this awesome community change to their commercial product. But they can't do that because I've only made a PR to this GPL repo and they don't have the copyright of my contribution that would allow them to re-license it under their commercial license, and if they do it anyway, we'll bring them 'fore the courts.

[carlosmintfan]

@IT-ZZ Yes you can use TinyMCE on your website but you have to make the source code of the whole project public then.

Not only make it public, but also license it under GPL and nothing else 😞