search

davglass / license-checker

Check NPM package licenses
Other
1.59k stars 215 forks source link

Don't use `spdx` package #153

Open zommerfelds opened 6 years ago

zommerfelds commented 6 years ago

The spdx package is outdated and contains a bug. I believe their parser is broken and doesn't support licenses such as BSD-3-Clause-Clear because it is masked by BSD-3-Clause. We should probably use something like https://github.com/jslicense/check-npm-package-licenses.js (same author, newer package).

honzajavorek commented 6 years ago

Doesn't seem to be difficult job to replace it: https://github.com/davglass/license-checker/blob/de9710b0ed7a17265e352a23e66bcc96eba956c7/lib/license.js#L24 Maybe you could try to do a drop-in replacement and to make a PR so we see whether tests pass? Could be a good start.

BTW, also "spdx-correct" and "spdx-satisfies" are used, not sure whether those are okay or not.