This obligation is for network-copyleft licenses (AGPL, SSPL, OSL, and similar). It is not shown for GPL alone. GPL copyleft mainly bites when you distribute binaries. AGPL adds a network clause: offering the software as a service over the internet can trigger source-disclosure duties even when users never download an installer. See GPL vs AGPL (two different triggers) for the side-by-side comparison.
The same review is raised for the source-available licenses (FSL, BUSL, Elastic, PolyForm), and they restrict something else. They do not ask you to publish your own source. They limit what you may do with the component itself. Typically you may not offer it, or a product that competes with it, as a hosted or managed service, and for FSL and BUSL that limit runs for a set number of years before the code turns into a normal open source license. The review asks you to work out whether the way your team uses the component falls inside that limit.
Why this is the highest-stakes checkbox
A permissive license might only ask for attribution on a license page. Network-copyleft licenses can affect your core product architecture: whether proprietary code must be published, how you isolate modules, and what you promise in customer contracts.
Questions to answer with counsel
- Is this component part of the service users access remotely (SaaS, API, hosted dashboard)?
- Does the license's network clause apply to your deployment model, or is the component only used in internal tooling?
- If source must be offered: where will users find it (public repo, in-app link, support process)?