Security News
Introducing the Socket Python SDK
The initial version of the Socket Python SDK is now on PyPI, enabling developers to more easily interact with the Socket REST API in Python projects.
spdx-license-ids
Advanced tools
The spdx-license-ids package provides a list of SPDX license identifiers. SPDX (Software Package Data Exchange) is a standard format for communicating the licensing information of software packages. This package is useful for validating license identifiers, checking if a license ID is deprecated, and listing all valid SPDX license IDs.
List of all SPDX license IDs
This feature provides an array of all non-deprecated SPDX license identifiers. You can use this list to validate or display available licenses.
const spdxLicenseIds = require('spdx-license-ids');
console.log(spdxLicenseIds);
List of deprecated SPDX license IDs
This feature provides an array of deprecated SPDX license identifiers. It is useful for checking if a license ID is no longer valid according to the SPDX specification.
const spdxLicenseIdsDeprecated = require('spdx-license-ids/deprecated');
console.log(spdxLicenseIdsDeprecated);
The 'spdx' package offers functions to parse, validate, and compare SPDX expressions. It provides more comprehensive functionality compared to spdx-license-ids, which only lists license IDs.
This package is used to parse and validate SPDX license expressions. Unlike spdx-license-ids, which provides lists of license IDs, spdx-expression-parse can handle complex license expressions, including those with 'AND' and 'OR' operators.
The spdx-correct package is designed to correct invalid SPDX license IDs and expressions. It is more focused on error correction, while spdx-license-ids simply provides a list of valid and deprecated license IDs.
While spdx-license-ids provides SPDX license identifiers, license-checker is a tool that scans a project's dependencies for license information, which can then be compared against the list of licenses provided by spdx-license-ids.
A list of SPDX license identifiers
Download JSON directly, or use npm:
npm install spdx-license-ids
Type: string[]
All license IDs except for the currently deprecated ones.
const ids = require('spdx-license-ids');
//=> ['0BSD', 'AAL', 'ADSL', 'AFL-1.1', 'AFL-1.2', 'AFL-2.0', 'AFL-2.1', 'AFL-3.0', 'AGPL-1.0-only', ...]
ids.includes('BSD-3-Clause'); //=> true
ids.includes('CC-BY-1.0'); //=> true
ids.includes('GPL-3.0'); //=> false
Type: string[]
Deprecated license IDs.
const deprecatedIds = require('spdx-license-ids/deprecated');
//=> ['AGPL-1.0', 'AGPL-3.0', 'GFDL-1.1', 'GFDL-1.2', 'GFDL-1.3', 'GPL-1.0', 'GPL-2.0', ...]
deprecatedIds.includes('BSD-3-Clause'); //=> false
deprecatedIds.includes('CC-BY-1.0'); //=> false
deprecatedIds.includes('GPL-3.0'); //=> true
FAQs
A list of SPDX license identifiers
We found that spdx-license-ids demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 2 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
The initial version of the Socket Python SDK is now on PyPI, enabling developers to more easily interact with the Socket REST API in Python projects.
Security News
Floating dependency ranges in npm can introduce instability and security risks into your project by allowing unverified or incompatible versions to be installed automatically, leading to unpredictable behavior and potential conflicts.
Security News
A new Rust RFC proposes "Trusted Publishing" for Crates.io, introducing short-lived access tokens via OIDC to improve security and reduce risks associated with long-lived API tokens.