A single dependency baked into Microsoft’s project templates flipped from free to metered overnight, and the .NET community’s backlash proves every CTO must audit the “free” libraries that hold their stack together.

One dependency, embedded in Microsoft's own project templates, went from free to metered overnight — and the .NET community's reaction shows why every CTO should know which "free" libraries their stack cannot live without.

In October 2020, the two maintainers of IdentityServer, a widely used authentication library for .NET applications, told users their Apache-licensed, free-to-use project was "inherently unsustainable" and moved it to a paid license under a new company, Duende Software. Organizations earning over $1 million a year now owe licensing fees starting at $1,500 annually. Microsoft kept the dependency in its official ASP.NET 6 templates anyway, meaning developers who scaffolded a new project got a commercial obligation by default, according to Aaron Stannard's account of the transition.

Strategic implications:

  • Free is a pricing decision, not a permanent state. Any dependency maintained by a small team or individual can convert to paid licensing at will, with no notice period comparable to a vendor contract's renewal terms. - Default templates create silent liability. Because Microsoft embedded the dependency in its own scaffolding, the exposure spread to every developer who never chose IdentityServer deliberately. - Revenue thresholds are the new tripwire. The $1 million-per-year licensing trigger means growing companies can cross into paid obligations without any purchasing decision being made. - The same dynamic is inverting in AI. Berkeley's Center for Media Research notes that open-weight models are commoditizing what vendors used to charge for, pushing monetization toward execution and infrastructure layers instead — the reverse direction, same underlying lesson: today's free component reflects today's economics, not tomorrow's.

The question to bring to the next architecture or procurement review: does anyone maintain a current inventory of open-source dependencies by maintainer size and license terms — and has anyone modeled what happens if the three smallest ones start charging?

The mechanics of the IdentityServer transition are worth studying because they describe a pattern of dependency exposure that architecture reviews rarely catch. IdentityServer shipped as Apache 2.0, which meant no attribution requirement, no copyleft obligation, and no signal to a legal team that the terms could change under them. That permissiveness is exactly what let it become a default.

The license swap itself is the part worth reading closely. Dominick Baier and Brock Allen did not fork silently or add a commercial tier alongside the open one: they moved the whole project to the Reciprocal Public License under a new corporate entity, Duende Software, starting with IdentityServer5 (Stannard). RPL is a source-available license, not OSI-approved open source in the sense most procurement checklists assume, and it carries reciprocity terms that trigger on modification and distribution, not just on redistribution of the original code.

The pricing structure itself signals who the maintainers were actually targeting. Fees apply to organizations earning more than $1 million a year, starting as low as $1,500 annually, a threshold clearly set to avoid taxing hobbyists and early-stage teams while capturing the enterprises that had been running identity infrastructure on volunteer labor for free (Stannard). That is a rational segmentation decision, not a money grab, but it does mean the risk concentrates precisely on the companies large enough to have the least excuse for not tracking their dependency terms.

Nothing about this failure mode is specific to .NET or to identity libraries. The practical mitigation is unglamorous: an SBOM generation step, via Syft, or dotnet list package --include-transitive piped into a license scanner, run on every dependency bump, not just on initial adoption, with license changes treated as a build-breaking event equivalent to a failed test.

The mechanics of the IdentityServer case are narrow enough to state plainly. Dominick Baier and Brock Allen, who built and maintained the open-source authentication library, told users in October 2020 that the project's economics were "inherently unsustainable." IdentityServer5 would move to the Reciprocal Public License under a new company, Duende Software, replacing the permissive Apache 2.0 terms the project had carried for years, according to Aaron Stannard's account on aaronstannard.com. The new terms charge organizations earning more than $1 million a year a license fee starting at $1,500 annually, per the same account. That threshold structure is the entire dataset available for this question: one project, one license change, one blog post documenting the fallout.

The reason the case traveled beyond .NET circles has less to do with the pricing than with distribution. IdentityServer wasn't a library developers had to seek out. Microsoft had built it into the default project templates for ASP.NET, and around May 2021, Microsoft continued shipping Duende's now-commercial dependency inside ASP.NET 6 scaffolding, per Stannard's reporting. Developers who ran dotnet new and accepted the defaults inherited a licensing obligation they never evaluated, because the vendor made the choice for them years before the maintainers needed revenue. Stannard's own framing captures the reaction: the community "collectively freaked out and demanded to speak with the manager of .NET OSS" — his joke being that Microsoft, as template gatekeeper, took the blame for a pricing decision it did not make.

What the source record does not support is any claim that this is a movement. There is no count of how many OSS projects have relicensed, no Tidelift or Open Collective funding data, no sequel case study in a different ecosystem. The IdentityServer episode is five years old and confined to one framework's authentication tooling. Extending it into a general thesis about maintainer behavior — that maintainers are "testing higher prices," present tense, industry-wide — is an inference this dataset cannot carry. The honest claim is narrower: one maintainer team, faced with unpaid security and protocol-maintenance work on a dependency embedded in a major vendor's defaults, converted to paid licensing once, and it went about as smoothly as license changes tend to go.

A separate and better-documented dynamic sits nearby and gets confused with it. The Berkeley Haas Center for Management of the Firm's 2026 dilemma report describes open-weight AI models commoditizing what used to be metered API access to frontier LLMs, pushing companies to ask, in the report's phrasing, "how do we build defensible, profitable business models when the engine driving our innovation is open to everyone." The report argues value is moving away from the model itself toward execution, customization and distribution around it. That is a real phenomenon, but it runs in the opposite direction from IdentityServer. In .NET, a scarce, previously free asset became priced because its maintainers could no longer subsidize it. Grouping both under "the free lunch is ending" produces a tidy headline and an analytically confused claim: one story is about supply-side exhaustion, the other about deliberate price competition among firms that can afford to give the core product away.

The infrastructure spending sitting in the background of both stories is real and large, but it does not connect to either. Microsoft reported $90.0 billion in quarterly revenue for the period ended June 30, 2026, up 18% year over year, with Microsoft Cloud revenue at $59.3 billion, per Microsoft's SEC filing.

Amazon reported AWS sales growing 37% year over year to a $169 billion annualized run rate in the quarter ended June 30, 2026, its fastest growth in eighteen quarters, per Amazon's SEC filing. The big three cloud providers held 63% of global infrastructure spend in the third quarter of 2025, up from 61% two years earlier, according to The Register's report on Synergy Research Group data. None of these filings or reports mention open-source licensing, maintainer compensation, or dependency risk. The temptation is to read hyperscaler capex and maintainer squeeze as the same story about who captures value in software. Nothing in the record connects them; the honest position is that they are two facts sitting near each other, not one fact explained twice.

What the evidence does support, cleanly, is a supply-chain lesson with a specific shape: a dependency's default inclusion in vendor tooling outlives the assumption that made it free. Duende's license change dates to October 2020. Microsoft's ASP.NET 6 scaffolding was still shipping the now-commercial dependency in May 2021, seven months later.