license-scanner

Scanning dependencies for license compliance involves auditing your project's full dependency tree across npm, pip, Maven, Gradle, Cargo, Go, NuGet, and C/C++ to detect violations and copyleft conflicts. It produces SPDX-normalized findings with severity triage for remediation.

Upgrading packages can cause license compliance violations due to license drift, such as a dependency shifting from Apache-2.0 to SSPL. The scanner detects these shifts, blocking upgrades until legal review to prevent accidental copyleft conflicts or non-OSI license integration.

Automating license scanning in CI involves integrating the scanner to continuously audit dependencies during builds. It enforces allowlists, detects missing attribution, and generates SPDX-normalized reports with severity triage to meet continuous release requirements.

Yes, dependency scanning detects transitive copyleft conflicts by flagging AGPL and GPL licenses that conflict with proprietary or SaaS products. It prioritizes these violations by severity to prevent forced open-sourcing of proprietary code.

The best way to generate an SPDX attribution bundle is using a scanner that normalizes license findings and extracts attribution data from your dependency tree. This produces an audit-ready bundle to meet point-in-time compliance requirements.