Two Live AGPL Disputes and What They Actually Teach About the License

Two Live AGPL Disputes and What They Actually Teach About the License

Two AGPL fights are playing out in public right now. Neither is really about whether the license holds up. ONLYOFFICE suspended its eight-year partnership with Nextcloud on March 31, 2026, after Nextcloud and IONOS launched a fork of ONLYOFFICE's editors called Euro-Office. Seven weeks later, on May 18, 2026, the Software Freedom Conservancy (SFC) announced it had confirmed two separate AGPLv3 violations by Bambu Lab, the 3D-printer maker. That came after Bambu threatened a developer over a community fork of its slicer software.

Both cases are worth walking through. They show exactly where AGPL's edges sit, and those edges are not where most teams assume.

ONLYOFFICE vs. Euro-Office: the fork was never the issue

Nextcloud and IONOS built Euro-Office as a "sovereign" alternative to Microsoft Office, forked directly from ONLYOFFICE's AGPL-licensed editors. ONLYOFFICE's objection was never the fork itself. AGPL grants that right outright, to anyone, for any reason, including "we no longer want to depend on a Russian-founded vendor."

The objection was that Euro-Office stripped ONLYOFFICE's branding and logos. ONLYOFFICE's CEO Lev Bannov argued the license doesn't permit that: "we do not grant anyone the right to remove our branding or alter our open source code without proper attribution."

The mechanics behind that claim matter. ONLYOFFICE had added a branding requirement as an AGPLv3 Section 7 "additional term." The license permits that: a licensor can attach narrow extra conditions, including declining to grant certain trademark rights.

But Section 7 also carries what practitioners call the self-cleaning clause: if a work you received "contains a notice stating that it is governed by this License along with a term that is a further restriction, you may remove that term." Nextcloud's position is that the branding requirement is precisely that kind of removable restriction.

The dispute is unresolved as of this writing. ONLYOFFICE kept its Nextcloud connector running for existing customers even after suspending the partnership. And outside legal commentary has landed on both sides of the Section 7 question.

The one thing both companies agree on is cleaner than the fight itself: trademark law and copyright license are different regimes. A copyright license can decline to grant trademark rights, but it can't summon trademark obligations that don't otherwise exist. Whether ONLYOFFICE's specific term survives the self-cleaning clause is genuinely unsettled. That the fork itself was allowed never was.

SFC vs. Bambu Lab: no exception for "we didn't really distribute it"

Bambu Studio is built on AGPLv3-licensed PrusaSlicer. Bambu bundles it with a proprietary networking library, libbambu_networking, without publishing that library's source. SFC's assessment is direct: shipping the combined program without Corresponding Source for every component in it "constitutes an egregious and ongoing violation of AGPLv3."

There's a second, separate finding. When independent developer Paweł Jarczak published an OrcaSlicer fork that restored features without Bambu's proprietary connector, Bambu sent him a cease-and-desist. SFC treats that legal threat as its own violation: AGPLv3 Section 10 bars imposing "further restrictions on the exercise of rights granted" by the license. Pressuring a downstream user over code they had every right to build on fits that description.

Neither finding depends on whether Bambu "distributed" software in the narrow sense people default to. The obligation to provide Corresponding Source attaches the moment the program is conveyed to a user. That includes a download, a bundled installer, or a network-accessible service. There is no carve-out for a proprietary helper library linked into the same binary.

Think of AGPL like a recipe. It has to be shared in full the moment the dish is served to a guest, not only if the recipe itself gets sold. If it ships as part of the combined work, its source ships too, or the license is violated.

SFC didn't file a lawsuit. It opened a fund and a project to reverse-engineer the missing library and maintain an independent fork instead. That's its own lesson: enforcement doesn't need a courtroom to cost a vendor real engineering time and public trust.

What AGPL actually restricts

Three corrections, drawn straight from both disputes:

1. Forking is never the violation. Copyleft exists specifically so that forking can't be stopped. Neither dispute challenges Nextcloud's or Jarczak's right to fork. Both challenge something stacked on top of it: a branding term in one case, an undisclosed proprietary library in the other.
2. Attribution means copyright notices, not your logo. AGPL requires preserving copyright and license notices. Requiring a fork to keep displaying your brand is a separate ask. Whether a licensor can attach that as a Section 7 term that survives the self-cleaning clause is exactly what ONLYOFFICE and Nextcloud are still arguing about.
3. The network clause has no size exception. Serving software only internally, or treating a linked component as "just a helper library," doesn't remove the obligation. If the combined work reaches any user, remote or local, Corresponding Source for the whole thing is owed.

Evaluating an AGPL component before you adopt it

What matters is not just what the license text says, but what your actual deployment plans to do with it. Before pulling an AGPL dependency into anything you intend to run as a service:

• Confirm whether you're modifying it. Unmodified use with no redistribution carries far less exposure than a fork you plan to operate yourself.
• Map every component that will ship or run alongside it, including internal glue code and any proprietary connectors. That's exactly the gap that caught Bambu Lab out.
• Decide before the architecture hardens whether "serve it as AGPL" or "buy a commercial license" is the outcome you actually want. I've covered the second path from the vendor's side in dual licensing an AGPL product. That piece explains why the model ends up smaller than most founders expect.
• If a licensor has attached branding or attribution terms beyond the standard notice requirement, read them against Section 7 first. Don't assume they're binding, or that you're free to ignore them.

For the wider map of what different licenses actually obligate, AGPL included, see what open-source licenses actually require in commercial software.

The takeaway

Both disputes are still open as of this writing. That's fine — the lesson doesn't depend on who wins. Copyleft's core promise, that a fork can't be locked away, is intact in both cases.

What's contested is everything built around it: branding terms, undisclosed proprietary libraries, and whether threatening a downstream user is itself a license violation. Read AGPL for what it actually says before you accept either the maximalist or minimalist version someone quotes at you.