No
GPL-2.0 and GPL-3.0 are not compatible with each other. GPL-2.0 only allows combination with code under GPL-2.0 (or, if the upstream specified 'or later', any later GPL). GPL-3.0 added new terms (patent grant, anti-tivoisation) that GPL-2.0 doesn't accept. If either upstream used the 'or later' formulation you may have a path; otherwise these cannot be combined into a single distributable.
| License | Family | Patent grant |
|---|---|---|
| GNU General Public License v2.0 (GPL-2.0) | strong-copyleft | No (implicit at most) |
| GNU General Public License v3.0 (GPL-3.0) | strong-copyleft | Yes |
GNU General Public License v2.0: Strong copyleft: derivative works distributed must also be GPL-2.0.
GNU General Public License v3.0: GPLv3 adds explicit patent grant + anti-tivoisation; updated copyleft language.
If you found this page because you're trying to figure out whether shipping a particular dependency is safe, the answer above is a starting point — not a substitute for reading the actual licenses or talking to a lawyer when stakes are high.
LicenseHound walks every transitive dependency in your repo, maps each to its SPDX license, and flags pairs like this one in PR comments. The CLI is free; the team dashboard is paid.