Six licence lines break compliance in this repository - npm, PyPI and crates.io maintainers on EU-facing teams, four manifests.
package.json:5 "license": "GPL-3.0",
Deprecated SPDX id "GPL-3.0" (SPDX License List 3.0). It does NOT mean "or later" -
pick "GPL-3.0-only" or "GPL-3.0-or-later".
vendor.json:3 "license": "Unlicense"
CAUTION: "Unlicense" is a public-domain dedication - it hands the code to everyone.
For proprietary code npm expects "UNLICENSED" (all caps, with the D).
pyproject.toml:4 license = {text = "MIT"}
PEP 639: license = {text = "..."} is deprecated. Write license = "MIT" (a bare SPDX
expression). setuptools stops supporting the table form after 2026-02-18.
pyproject.toml:7 "License :: OSI Approved :: MIT License",
PEP 639 deprecated the "License ::" trove classifiers. Delete this line and put an
SPDX expression in project.license instead.
Cargo.toml:5 license = "MIT/Apache-2.0"
The old npm "MIT/Apache-2.0" slash syntax was removed. Write "MIT OR Apache-2.0".
Cargo.toml:9 license = "SSPL-1.0"
NOT OSI-approved (SSPL-1.0). The OSI declined to approve it. Section 13 extends
copyleft to your whole service-management stack if you offer the software as a
service. Debian and Fedora exclude it.
That is the entire output, not a sample. Six defects, four files, all real and current.
What each one costs you
GPL-3.0 was deprecated in SPDX License List 3.0 because people wrote it to mean "version 3 or any later version" - which it does not. GPL-3.0-only and GPL-3.0-or-later mean different things, and the same split runs through the GNU family.
Unlicense is not UNLICENSED. One hands your source to everyone, permanently; the other is what npm expects for proprietary code. One letter apart, exact opposites.
The two pyproject.toml findings are PEP 639 leftovers: it replaced the licence table and trove classifiers with a bare SPDX expression in project.license plus a license-files key. If a build started failing on current setuptools, that is why.
MIT/Apache-2.0 is removed npm syntax - SPDX expressions use uppercase operators: MIT OR Apache-2.0. And SSPL-1.0 is source-available, not open source, alongside BUSL-1.1, Elastic-2.0 and RSALv2. A policy of "OSI-approved licences only" rejects them all.
Why the usual tools miss all six
npm publish and setuptools check the one package you publish, never the hundreds you consume, and neither flags a deprecated SPDX id - a deprecated id is still a known id, so it validates.
A chatbot is worse, predictably. Most text these models learned from predates SPDX List 3.0 and PEP 639, so the modal answer is GPL-3.0 and License :: OSI Approved :: MIT License - the two defects you are removing.
The licence is a required SBOM field, CRA vulnerability and incident reporting obligations landed on 11 September 2026, and the full technical-documentation and SBOM requirements arrive 11 December 2027. Neither can be answered from a manifest whose licence column reads UNKNOWN.
The extension
SPDX License Lint reads the licence declarations in the open file - package.json, pyproject.toml, Cargo.toml, composer.json and more - and applies 73 rules: deprecated identifiers, invalid strings, npm's removed array and object forms, expression syntax, PEP 639 migration, and the obligation each licence carries. Every finding gives the line, the reason, and the exact replacement. That part is free and finishes the job for the file in front of you.
The full version is $29 once: the same 73 rules over every manifest in the repository in one pass, the licence inventory exported as CSV, JSON or HTML for the SBOM column, and a wrong identifier rewritten in place. An open-source licence audit runs 40-160 hours and thousands to tens of thousands of dollars per program; commercial SCA licence-compliance subscriptions start around $1,500/year.
Free in your browser (the same rules): https://getreadystack.com/tools/spdx-license-field-lint
Licence ($29, once, 7-day refund): https://buy.polar.sh/polar_cl_2aVJUYKnFr7h6WfPcOmXd27R9KXw2jEpdVXJc4G6fJk
Top comments (0)