
Security News
PyPI Expands Trusted Publishing to GitLab Self-Managed as Adoption Passes 25 Percent
PyPI adds Trusted Publishing support for GitLab Self-Managed as adoption reaches 25% of uploads
spdx-license-ids
Advanced tools
A list of SPDX license identifiers
Download JSON directly, or use npm:
npm install spdx-license-ids
Type: string[]
All license IDs except for the currently deprecated ones.
const ids = require('spdx-license-ids');
//=> ['0BSD', 'AAL', 'ADSL', 'AFL-1.1', 'AFL-1.2', 'AFL-2.0', 'AFL-2.1', 'AFL-3.0', 'AGPL-1.0-only', ...]
ids.includes('BSD-3-Clause'); //=> true
ids.includes('CC-BY-1.0'); //=> true
ids.includes('GPL-3.0'); //=> false
Type: string[]
Deprecated license IDs.
const deprecatedIds = require('spdx-license-ids/deprecated');
//=> ['AGPL-1.0', 'AGPL-3.0', 'GFDL-1.1', 'GFDL-1.2', 'GFDL-1.3', 'GPL-1.0', 'GPL-2.0', ...]
deprecatedIds.includes('BSD-3-Clause'); //=> false
deprecatedIds.includes('CC-BY-1.0'); //=> false
deprecatedIds.includes('GPL-3.0'); //=> true
The 'spdx' package offers functions to parse, validate, and compare SPDX expressions. It provides more comprehensive functionality compared to spdx-license-ids, which only lists license IDs.
This package is used to parse and validate SPDX license expressions. Unlike spdx-license-ids, which provides lists of license IDs, spdx-expression-parse can handle complex license expressions, including those with 'AND' and 'OR' operators.
The spdx-correct package is designed to correct invalid SPDX license IDs and expressions. It is more focused on error correction, while spdx-license-ids simply provides a list of valid and deprecated license IDs.
While spdx-license-ids provides SPDX license identifiers, license-checker is a tool that scans a project's dependencies for license information, which can then be compared against the list of licenses provided by spdx-license-ids.
FAQs
A list of SPDX license identifiers
The npm package spdx-license-ids receives a total of 26,551,734 weekly downloads. As such, spdx-license-ids popularity was classified as popular.
We found that spdx-license-ids demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 2 open source maintainers collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
PyPI adds Trusted Publishing support for GitLab Self-Managed as adoption reaches 25% of uploads

Research
/Security News
A malicious Chrome extension posing as an Ethereum wallet steals seed phrases by encoding them into Sui transactions, enabling full wallet takeover.

Security News
Socket is heading to London! Stop by our booth or schedule a meeting to see what we've been working on.