licensed 5.0.0 → 5.0.2

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (8) hide show
  1. checksums.yaml +4 -4
  2. data/CHANGELOG.md +262 -137
  3. data/Gemfile.lock +33 -27
  4. data/docs/migrations/v3.md +9 -9
  5. data/lib/licensed/sources/npm.rb +1 -1
  6. data/lib/licensed/version.rb +1 -1
  7. data/licensed.gemspec +2 -1
  8. metadata +27 -7
checksums.yaml CHANGED
@@ -1,7 +1,7 @@
1
1
  ---
2
2
  SHA256:
3
- metadata.gz: 418a3151f8331f3377eb4ff5b1a322733c006478c1bb84de7c023b2b1e567876
4
- data.tar.gz: ffceca317c9924f12d732781aec5a9311bccac316ca9cf0b4e5e2a02b5b5967a
3
+ metadata.gz: d20897c4058c8e9ad19047b9739d2a8e720bfbc89c905a6bfcb49d9fc7bc3e68
4
+ data.tar.gz: e9ca15847323c009380cdb7aef13eb20115f70e9794cd789e1154d5b64521040
5
5
  SHA512:
6
- metadata.gz: d6a33da199f2e60fd5ed19c08ad830aab62b8c2c0016c40844af94ba7b002ba58a2aa87e05b7a771054f9e95b333ed7f9bab7934d0cee6bdf981482f0b1f4a82
7
- data.tar.gz: 60da525db6d11b5df8aef42042ad11e0d796bae937e894510764ab8c3eb2dcea36501441382f97d2896f8f9d3fea162e788516038c07156b584c090a61ac9d4f
6
+ metadata.gz: 7beedc9a4c747ce3a915afd5f1b22555e59c0e96d025e184cffa8255a61b8d908ef5eaf3d29471e48c6e592e1fa19e4afbc90b647601e488ef8d67495077b988
7
+ data.tar.gz: 6a02a0c4a839d4fb907fccc6f7893e324cc9d53b9ac9aea3c7781d6a876ced89a88f7a08173fe26aa48a756addc477404037012991199f4b809d5228baefaf8f
data/CHANGELOG.md CHANGED
@@ -1,4 +1,5 @@
1
1
  # Changelog
2
+
2
3
  All notable changes to this project will be documented in this file.
3
4
 
4
5
  The format is based on [Keep a Changelog](http://keepachangelog.com/en/1.0.0/)
@@ -6,6 +7,17 @@ and this project adheres to [Semantic Versioning](http://semver.org/spec/v2.0.0.
6
7
 
7
8
  ## [Unreleased]
8
9
 
10
+ ## 5.0.2
11
+
12
+ - Pin setup-ruby and set permissions in test workflow (<https://github.com/licensee/licensed/pull/768>)
13
+ - Pin action versions in test.yml (<https://github.com/licensee/licensed/pull/776>)
14
+ - Add `csv` as a dependency for Ruby 3.4+ (<https://github.com/licensee/licensed/pull/786>)
15
+ - Fix `nil` bug when there's no `dependency` key in `package.json` (<https://github.com/licensee/licensed/pull/791>)
16
+
17
+ ## 5.0.1
18
+
19
+ - Updated dependencies as needed for security fixes
20
+
9
21
  ## 5.0.0
10
22
 
11
23
  ### Breaking change
@@ -27,145 +39,145 @@ and this project adheres to [Semantic Versioning](http://semver.org/spec/v2.0.0.
27
39
 
28
40
  ### Added
29
41
 
30
- - Licensed status command will alert on stale cached dependency records (https://github.com/github/licensed/pull/657)
42
+ - Licensed status command will alert on stale cached dependency records (<https://github.com/github/licensed/pull/657>)
31
43
 
32
44
  ## 4.3.1
33
45
 
34
46
  ### Changed
35
47
 
36
- - Bump nokogiri to resolve vulnerabilities (https://github.com/github/licensed/pull/648)
48
+ - Bump nokogiri to resolve vulnerabilities (<https://github.com/github/licensed/pull/648>)
37
49
 
38
50
  ## 4.3.0
39
51
 
40
52
  ### Added
41
53
 
42
- - Cocoapods support has been re-enabled using a cocoapods plugin (https://github.com/github/licensed/pull/644)
54
+ - Cocoapods support has been re-enabled using a cocoapods plugin (<https://github.com/github/licensed/pull/644>)
43
55
 
44
56
  ## 4.2.0
45
57
 
46
58
  ### Added
47
59
 
48
- - Reviewed and ignored configuration lists support matching on versions and version ranges (https://github.com/github/licensed/pull/629)
60
+ - Reviewed and ignored configuration lists support matching on versions and version ranges (<https://github.com/github/licensed/pull/629>)
49
61
 
50
62
  ### Fixed
51
63
 
52
- - Licensed should more reliably source dependencies from Gradle >= 8.0 (https://github.com/github/licensed/pull/630)
64
+ - Licensed should more reliably source dependencies from Gradle >= 8.0 (<https://github.com/github/licensed/pull/630>)
53
65
 
54
66
  ## 4.1.0
55
67
 
56
68
  ### Added
57
69
 
58
- - Custom license terms can be added to dependencies via new configuration options (https://github.com/github/licensed/pull/624)
59
- - Licensed is now integrated with pnpm to enumerate dependencies (https://github.com/github/licensed/pull/626)
70
+ - Custom license terms can be added to dependencies via new configuration options (<https://github.com/github/licensed/pull/624>)
71
+ - Licensed is now integrated with pnpm to enumerate dependencies (<https://github.com/github/licensed/pull/626>)
60
72
 
61
73
  ## 4.0.4
62
74
 
63
75
  ### Changed
64
76
 
65
- - Dependency version requirements are more relaxed (https://github.com/github/licensed/pull/619)
77
+ - Dependency version requirements are more relaxed (<https://github.com/github/licensed/pull/619>)
66
78
 
67
79
  ## 4.0.3
68
80
 
69
81
  ### Changed
70
82
 
71
- - Cocoapods dependency enumeration has been disabled (https://github.com/github/licensed/pull/616)
83
+ - Cocoapods dependency enumeration has been disabled (<https://github.com/github/licensed/pull/616>)
72
84
 
73
85
  ### Fixed
74
86
 
75
- - Fixed method signature change in Bundler API with Bundler >= 2.4.4 (:tada: @CvX https://github.com/github/licensed/pull/614)
76
- - Fixed installation dependency compatibility with Rails >= 7.0 (https://github.com/github/licensed/pull/616)
87
+ - Fixed method signature change in Bundler API with Bundler >= 2.4.4 (:tada: @CvX <https://github.com/github/licensed/pull/614>)
88
+ - Fixed installation dependency compatibility with Rails >= 7.0 (<https://github.com/github/licensed/pull/616>)
77
89
 
78
90
  ## 4.0.2
79
91
 
80
92
  ### Fixed
81
93
 
82
- - The path to a gradlew executable can be configured when enumerating gradle dependencies (:tada: @LouisBoudreau https://github.com/github/licensed/pull/610)
94
+ - The path to a gradlew executable can be configured when enumerating gradle dependencies (:tada: @LouisBoudreau <https://github.com/github/licensed/pull/610>)
83
95
 
84
96
  ## 4.0.1
85
97
 
86
98
  ### Fixed
87
99
 
88
- - Running gradle tests will no longer fail when gradle is not available (https://github.com/github/licensed/pull/606)
100
+ - Running gradle tests will no longer fail when gradle is not available (<https://github.com/github/licensed/pull/606>)
89
101
 
90
102
  ## 4.0.0
91
103
 
92
104
  ### Added
93
105
 
94
- - Licensed supports Cocoapods as a dependency source (:tada: @LouisBoudreau https://github.com/github/licensed/pull/584)
95
- - Licensed supports Gradle multi-project builds (:tada: @LouisBoudreau https://github.com/github/licensed/pull/583)
106
+ - Licensed supports Cocoapods as a dependency source (:tada: @LouisBoudreau <https://github.com/github/licensed/pull/584>)
107
+ - Licensed supports Gradle multi-project builds (:tada: @LouisBoudreau <https://github.com/github/licensed/pull/583>)
96
108
 
97
109
  ### Fixed
98
110
 
99
- - Licensed no longer crashes when run with Bundler >= 2.4.0 (:tada: @JoshReedSchramm https://github.com/github/licensed/pull/597)
111
+ - Licensed no longer crashes when run with Bundler >= 2.4.0 (:tada: @JoshReedSchramm <https://github.com/github/licensed/pull/597>)
100
112
 
101
113
  ### Changed
102
114
 
103
- - BREAKING: Licensed no longer ships executables with releases (https://github.com/github/licensed/pull/586)
104
- - BREAKING: Licensed no longer includes support for Go <= 1.11 (https://github.com/github/licensed/pull/602)
115
+ - BREAKING: Licensed no longer ships executables with releases (<https://github.com/github/licensed/pull/586>)
116
+ - BREAKING: Licensed no longer includes support for Go <= 1.11 (<https://github.com/github/licensed/pull/602>)
105
117
 
106
118
  ## 3.9.1
107
119
 
108
120
  ### Fixed
109
121
 
110
- - Updating cached dependency records will more accurately apply `review_changed_license` flag (https://github.com/github/licensed/pull/578)
122
+ - Updating cached dependency records will more accurately apply `review_changed_license` flag (<https://github.com/github/licensed/pull/578>)
111
123
 
112
124
  ## 3.9.0
113
125
 
114
126
  ### Added
115
127
 
116
- - `NOTICE` files can now be generated without cached files in a repository (https://github.com/github/licensed/pull/572)
128
+ - `NOTICE` files can now be generated without cached files in a repository (<https://github.com/github/licensed/pull/572>)
117
129
 
118
130
  ## 3.8.0
119
131
 
120
132
  ### Added
121
133
 
122
- - Licensing compliance status checks can now be used without cached files in a repository (https://github.com/github/licensed/pull/560)
134
+ - Licensing compliance status checks can now be used without cached files in a repository (<https://github.com/github/licensed/pull/560>)
123
135
 
124
136
  ## 3.7.5
125
137
 
126
138
  ### Fixed
127
139
 
128
- - Python dependency metadata will be correctly parsed from the ouput of `pip show` (https://github.com/github/licensed/pull/555)
140
+ - Python dependency metadata will be correctly parsed from the ouput of `pip show` (<https://github.com/github/licensed/pull/555>)
129
141
 
130
142
  ## 3.7.4
131
143
 
132
144
  ### Fixed
133
145
 
134
- - Licenses for Python dependencies built with Hatchling are correctly found (https://github.com/github/licensed/pull/547)
146
+ - Licenses for Python dependencies built with Hatchling are correctly found (<https://github.com/github/licensed/pull/547>)
135
147
 
136
148
  ## 3.7.3
137
149
 
138
150
  ### Fixed
139
151
 
140
- - Swift test fixtures build artifacts are now ignored (:tada: @CvX https://github.com/github/licensed/pull/524)
141
- - Running cargo test fixture setup no longer deletes test files (:tada: @CvX https://github.com/github/licensed/pull/525)
142
- - Bundler test fixtures are compatible with latest macOS silicon(:tada: @CvX https://github.com/github/licensed/pull/528)
143
- - Fix segfaults seen using licensed with ruby 3.0.4 (https://github.com/github/licensed/pull/530)
144
- - Fix compatibility with latest versions of bundler 2.3 (https://github.com/github/licensed/pull/535)
145
- - Fix compatibility with latest versions of bundler 2.3 (:tada: @CvX https://github.com/github/licensed/pull/522)
152
+ - Swift test fixtures build artifacts are now ignored (:tada: @CvX <https://github.com/github/licensed/pull/524>)
153
+ - Running cargo test fixture setup no longer deletes test files (:tada: @CvX <https://github.com/github/licensed/pull/525>)
154
+ - Bundler test fixtures are compatible with latest macOS silicon(:tada: @CvX <https://github.com/github/licensed/pull/528>)
155
+ - Fix segfaults seen using licensed with ruby 3.0.4 (<https://github.com/github/licensed/pull/530>)
156
+ - Fix compatibility with latest versions of bundler 2.3 (<https://github.com/github/licensed/pull/535>)
157
+ - Fix compatibility with latest versions of bundler 2.3 (:tada: @CvX <https://github.com/github/licensed/pull/522>)
146
158
 
147
159
  ## 3.7.2
148
160
 
149
161
  ### Fixed
150
162
 
151
- - Comparing dependency license contents now finds matching contents regardless of the order of the licenses (https://github.com/github/licensed/pull/516)
152
- - Fixed typo in a link in README.md (https://github.com/github/licensed/pull/514)
163
+ - Comparing dependency license contents now finds matching contents regardless of the order of the licenses (<https://github.com/github/licensed/pull/516>)
164
+ - Fixed typo in a link in README.md (<https://github.com/github/licensed/pull/514>)
153
165
 
154
166
  ### Changed
155
167
 
156
- - Elixir testing setup is migrated to erlef/setup-beam (https://github.com/github/licensed/pull/512)
168
+ - Elixir testing setup is migrated to erlef/setup-beam (<https://github.com/github/licensed/pull/512>)
157
169
 
158
170
  ## 3.7.1
159
171
 
160
172
  ### Fixed
161
173
 
162
- - Dependencies' legal notice file matching has been made more strict to reduce false positives on code files containing the word `legal` (https://github.com/github/licensed/pull/510)
174
+ - Dependencies' legal notice file matching has been made more strict to reduce false positives on code files containing the word `legal` (<https://github.com/github/licensed/pull/510>)
163
175
 
164
176
  ## 3.7.0
165
177
 
166
178
  ### Changed
167
179
 
168
- - Pip and pipenv sources will find dependency licenses under `dist-info/license_files` when available (https://github.com/github/licensed/pull/504)
180
+ - Pip and pipenv sources will find dependency licenses under `dist-info/license_files` when available (<https://github.com/github/licensed/pull/504>)
169
181
 
170
182
  ## 3.6.0
171
183
 
@@ -173,17 +185,17 @@ and this project adheres to [Semantic Versioning](http://semver.org/spec/v2.0.0.
173
185
 
174
186
  ### Added
175
187
 
176
- - Composer dev dependencies can optionally be included in enumerated PHP dependencies (:tada: @digilist https://github.com/github/licensed/pull/486)
177
- - Getting started usage documentation (https://github.com/github/licensed/pull/483)
178
- - Initial support for NPM workspaces (https://github.com/github/licensed/pull/485)
188
+ - Composer dev dependencies can optionally be included in enumerated PHP dependencies (:tada: @digilist <https://github.com/github/licensed/pull/486>)
189
+ - Getting started usage documentation (<https://github.com/github/licensed/pull/483>)
190
+ - Initial support for NPM workspaces (<https://github.com/github/licensed/pull/485>)
179
191
 
180
192
  ### Changed
181
193
 
182
- - Transitive dependencies are now enumerated by the `pip` source (https://github.com/github/licensed/pull/480)
194
+ - Transitive dependencies are now enumerated by the `pip` source (<https://github.com/github/licensed/pull/480>)
183
195
 
184
196
  ### Fixed
185
197
 
186
- - `licensed cache --force` will now correctly overwrite existing license classifications (https://github.com/github/licensed/pull/473)
198
+ - `licensed cache --force` will now correctly overwrite existing license classifications (<https://github.com/github/licensed/pull/473>)
187
199
 
188
200
  ## 3.5.0
189
201
 
@@ -191,7 +203,7 @@ and this project adheres to [Semantic Versioning](http://semver.org/spec/v2.0.0.
191
203
 
192
204
  ### Added
193
205
 
194
- - [Licensee](https://github.com/licensee/licensee) confidence thresholds can be configured in the licensed configuration file (https://github.com/github/licensed/pull/455)
206
+ - [Licensee](https://github.com/licensee/licensee) confidence thresholds can be configured in the licensed configuration file (<https://github.com/github/licensed/pull/455>)
195
207
 
196
208
  ## 3.4.4
197
209
 
@@ -199,7 +211,7 @@ and this project adheres to [Semantic Versioning](http://semver.org/spec/v2.0.0.
199
211
 
200
212
  ### Fixed
201
213
 
202
- - The npm and pip sources have better protection from strings causing crashes in `Hash#dig` (https://github.com/github/licensed/pull/450)
214
+ - The npm and pip sources have better protection from strings causing crashes in `Hash#dig` (<https://github.com/github/licensed/pull/450>)
203
215
 
204
216
  ## 3.4.3
205
217
 
@@ -207,7 +219,7 @@ and this project adheres to [Semantic Versioning](http://semver.org/spec/v2.0.0.
207
219
 
208
220
  ### Added
209
221
 
210
- - The npm source handles more cases of missing, optional, peer dependencies (https://github.com/github/licensed/pull/443)
222
+ - The npm source handles more cases of missing, optional, peer dependencies (<https://github.com/github/licensed/pull/443>)
211
223
 
212
224
  ## 3.4.2
213
225
 
@@ -215,7 +227,7 @@ and this project adheres to [Semantic Versioning](http://semver.org/spec/v2.0.0.
215
227
 
216
228
  ### Fixed
217
229
 
218
- - The yarn source will no longer evaluate package.json files that do not represent project dependencies (https://github.com/github/licensed/pull/439)
230
+ - The yarn source will no longer evaluate package.json files that do not represent project dependencies (<https://github.com/github/licensed/pull/439>)
219
231
 
220
232
  ## 3.4.1
221
233
 
@@ -223,7 +235,7 @@ and this project adheres to [Semantic Versioning](http://semver.org/spec/v2.0.0.
223
235
 
224
236
  ### Fixed
225
237
 
226
- - Malformed package.json files will no longer crash yarn dependency detection (https://github.com/github/licensed/pull/431)
238
+ - Malformed package.json files will no longer crash yarn dependency detection (<https://github.com/github/licensed/pull/431>)
227
239
 
228
240
  ## 3.4.0
229
241
 
@@ -231,17 +243,17 @@ and this project adheres to [Semantic Versioning](http://semver.org/spec/v2.0.0.
231
243
 
232
244
  ### Added
233
245
 
234
- - New Yarn enumerator with support for berry versions (https://github.com/github/licensed/pull/423)
246
+ - New Yarn enumerator with support for berry versions (<https://github.com/github/licensed/pull/423>)
235
247
 
236
248
  ### Fixed
237
249
 
238
- - Error handling cases return correct values in the Yarn enumerator (https://github.com/github/licensed/pull/425)
239
- - Fixed link in command documentation (:tada: @chibicco https://github.com/github/licensed/pull/416)
240
- - Fixed minor backwards compatibility issue for Ruby 2.3 support (:tada: @dzunk https://github.com/github/licensed/pull/414)
250
+ - Error handling cases return correct values in the Yarn enumerator (<https://github.com/github/licensed/pull/425>)
251
+ - Fixed link in command documentation (:tada: @chibicco <https://github.com/github/licensed/pull/416>)
252
+ - Fixed minor backwards compatibility issue for Ruby 2.3 support (:tada: @dzunk <https://github.com/github/licensed/pull/414>)
241
253
 
242
254
  ### Changed
243
255
 
244
- - Licensed's own dependencies are cached in the repository and kept up to date with GitHub Actions (https://github.com/github/licensed/pull/421)
256
+ - Licensed's own dependencies are cached in the repository and kept up to date with GitHub Actions (<https://github.com/github/licensed/pull/421>)
245
257
 
246
258
  ## 3.3.1
247
259
 
@@ -249,11 +261,11 @@ and this project adheres to [Semantic Versioning](http://semver.org/spec/v2.0.0.
249
261
 
250
262
  ### Fixed
251
263
 
252
- - Fix evaluation of peer dependencies with npm 7 (:tada: @manuelpuyol https://github.com/github/licensed/pull/411)
264
+ - Fix evaluation of peer dependencies with npm 7 (:tada: @manuelpuyol <https://github.com/github/licensed/pull/411>)
253
265
 
254
266
  ### Changed
255
267
 
256
- - Manifest source evaluation performance improvements (https://github.com/github/licensed/pull/407)
268
+ - Manifest source evaluation performance improvements (<https://github.com/github/licensed/pull/407>)
257
269
 
258
270
  ## 3.3.0
259
271
 
@@ -261,11 +273,11 @@ and this project adheres to [Semantic Versioning](http://semver.org/spec/v2.0.0.
261
273
 
262
274
  ### Added
263
275
 
264
- - New cargo source enumerates rust dependencies (https://github.com/github/licensed/pull/404)
276
+ - New cargo source enumerates rust dependencies (<https://github.com/github/licensed/pull/404>)
265
277
 
266
278
  ### Changed
267
279
 
268
- - Removed non-functional files from gem builds (https://github.com/github/licensed/pull/405)
280
+ - Removed non-functional files from gem builds (<https://github.com/github/licensed/pull/405>)
269
281
 
270
282
  ## 3.2.3
271
283
 
@@ -273,8 +285,8 @@ and this project adheres to [Semantic Versioning](http://semver.org/spec/v2.0.0.
273
285
 
274
286
  ### Fixed
275
287
 
276
- - Bundler source will no longer infinitely recurse when enumerating specifications (https://github.com/github/licensed/pull/402)
277
- - Using the `--sources` command line option will no longer delete skipped sources' cached files (https://github.com/github/licensed/pull/401)
288
+ - Bundler source will no longer infinitely recurse when enumerating specifications (<https://github.com/github/licensed/pull/402>)
289
+ - Using the `--sources` command line option will no longer delete skipped sources' cached files (<https://github.com/github/licensed/pull/401>)
278
290
 
279
291
  ## 3.2.2
280
292
 
@@ -282,7 +294,7 @@ and this project adheres to [Semantic Versioning](http://semver.org/spec/v2.0.0.
282
294
 
283
295
  ### Fixed
284
296
 
285
- - Bundler source works properly again when used outside of `bundle exec` (https://github.com/github/licensed/pull/397)
297
+ - Bundler source works properly again when used outside of `bundle exec` (<https://github.com/github/licensed/pull/397>)
286
298
 
287
299
  ## 3.2.1
288
300
 
@@ -290,13 +302,13 @@ and this project adheres to [Semantic Versioning](http://semver.org/spec/v2.0.0.
290
302
 
291
303
  ### Changed
292
304
 
293
- - Updated multiple dependency versions (:tada: @mmorel-35 https://github.com/github/licensed/pull/385, https://github.com/github/licensed/pull/389)
294
- - Go homepage links use pkg.go.dev instead of godoc.org (:tada: @mmorel-35 https://github.com/github/licensed/commit/73cfbbe954a3e8c8cbaf8b68253053b157e01b79)
295
- - Local development ruby version changed to 2.7.4 (https://github.com/github/licensed/pull/393)
305
+ - Updated multiple dependency versions (:tada: @mmorel-35 <https://github.com/github/licensed/pull/385>, <https://github.com/github/licensed/pull/389>)
306
+ - Go homepage links use pkg.go.dev instead of godoc.org (:tada: @mmorel-35 <https://github.com/github/licensed/commit/73cfbbe954a3e8c8cbaf8b68253053b157e01b79>)
307
+ - Local development ruby version changed to 2.7.4 (<https://github.com/github/licensed/pull/393>)
296
308
 
297
309
  ### Fixed
298
310
 
299
- - Bundler source correctly finds platform specific dependencies (https://github.com/github/licensed/pull/392)
311
+ - Bundler source correctly finds platform specific dependencies (<https://github.com/github/licensed/pull/392>)
300
312
 
301
313
  ## 3.2.0
302
314
 
@@ -304,18 +316,18 @@ and this project adheres to [Semantic Versioning](http://semver.org/spec/v2.0.0.
304
316
 
305
317
  ### Added
306
318
 
307
- - Application names can be dynamically generated based on the path to the application source (https://github.com/github/licensed/pull/375)
319
+ - Application names can be dynamically generated based on the path to the application source (<https://github.com/github/licensed/pull/375>)
308
320
 
309
321
  ### Changed
310
322
 
311
- - Updated command documentation (https://github.com/github/licensed/pull/378, https://github.com/github/licensed/pull/380/files)
312
- - Updated configuration documentation (https://github.com/github/licensed/pull/375)
313
- - Cache and status commands give additional diagnostic output when using JSON and YAML formatters (https://github.com/github/licensed/pull/378)
314
- - Status command will give users a link to documentation when compliance checks fail (https://github.com/github/licensed/pull/381)
323
+ - Updated command documentation (<https://github.com/github/licensed/pull/378>, <https://github.com/github/licensed/pull/380/files>)
324
+ - Updated configuration documentation (<https://github.com/github/licensed/pull/375>)
325
+ - Cache and status commands give additional diagnostic output when using JSON and YAML formatters (<https://github.com/github/licensed/pull/378>)
326
+ - Status command will give users a link to documentation when compliance checks fail (<https://github.com/github/licensed/pull/381>)
315
327
 
316
328
  ### Fixed
317
329
 
318
- - The bundler source correctly checks that the path bundler specifies a gem is loaded from is a file (https://github.com/github/licensed/pull/379)
330
+ - The bundler source correctly checks that the path bundler specifies a gem is loaded from is a file (<https://github.com/github/licensed/pull/379>)
319
331
 
320
332
  ## 3.1.0
321
333
 
@@ -323,17 +335,18 @@ and this project adheres to [Semantic Versioning](http://semver.org/spec/v2.0.0.
323
335
 
324
336
  ### Added
325
337
 
326
- - Licensed supports Swift/Swift package manager as a dependency source (:tada: @mattt https://github.com/github/licensed/pull/363)'
338
+ - Licensed supports Swift/Swift package manager as a dependency source (:tada: @mattt <https://github.com/github/licensed/pull/363>)'
327
339
 
328
340
  ### Changed
329
341
 
330
- - The `source_path` configuration property accepts arrays of inclusion and exclusion glob patterns (https://github.com/github/licensed/pull/368)
331
- - The Nuget source now uses configured fallback folders to find dependencies that are not in found in the project folder (https://github.com/github/licensed/pull/366)
332
- - The Nuget source supports a configurable property for the path from the project source path to the project's `obj` folder (https://github.com/github/licensed/pull/365)
342
+ - The `source_path` configuration property accepts arrays of inclusion and exclusion glob patterns (<https://github.com/github/licensed/pull/368>)
343
+ - The Nuget source now uses configured fallback folders to find dependencies that are not in found in the project folder (<https://github.com/github/licensed/pull/366>)
344
+ - The Nuget source supports a configurable property for the path from the project source path to the project's `obj` folder (<https://github.com/github/licensed/pull/365>)
333
345
 
334
346
  ### Fixed
335
- - The Go source's checks for local packages will correctly find paths in case-insensitive file systems (https://github.com/github/licensed/pull/370)
336
- - The Bundler source will no longer unnecessarily reset the local Bundler environment configuration (https://github.com/github/licensed/pull/372)
347
+
348
+ - The Go source's checks for local packages will correctly find paths in case-insensitive file systems (<https://github.com/github/licensed/pull/370>)
349
+ - The Bundler source will no longer unnecessarily reset the local Bundler environment configuration (<https://github.com/github/licensed/pull/372>)
337
350
 
338
351
  ## 3.0.1
339
352
 
@@ -341,7 +354,7 @@ and this project adheres to [Semantic Versioning](http://semver.org/spec/v2.0.0.
341
354
 
342
355
  ### Fixed
343
356
 
344
- - The bundler source will correctly enumerate dependencies pulled with a `git:` directive (https://github.com/github/licensed/pull/360)
357
+ - The bundler source will correctly enumerate dependencies pulled with a `git:` directive (<https://github.com/github/licensed/pull/360>)
345
358
 
346
359
  ## 3.0.0
347
360
 
@@ -359,7 +372,7 @@ and this project adheres to [Semantic Versioning](http://semver.org/spec/v2.0.0.
359
372
 
360
373
  ### Fixed
361
374
 
362
- - The pip source works with package names containing periods (:tada: @bcskda https://github.com/github/licensed/pull/350)
375
+ - The pip source works with package names containing periods (:tada: @bcskda <https://github.com/github/licensed/pull/350>)
363
376
 
364
377
  ## 2.15.1
365
378
 
@@ -367,161 +380,209 @@ and this project adheres to [Semantic Versioning](http://semver.org/spec/v2.0.0.
367
380
 
368
381
  ### Changed
369
382
 
370
- - The npm source will ignore dependencies that are marked as both extraneous and missing (https://github.com/github/licensed/pull/347)
383
+ - The npm source will ignore dependencies that are marked as both extraneous and missing (<https://github.com/github/licensed/pull/347>)
371
384
 
372
385
  ## 2.15.0
386
+
373
387
  2021-03-24
374
388
 
375
389
  ### Added
376
- - Support for npm 7 (https://github.com/github/licensed/pull/341)
390
+
391
+ - Support for npm 7 (<https://github.com/github/licensed/pull/341>)
377
392
 
378
393
  ### Fixed
379
- - Files in the manifest source will be found correctly for apps that are not at the repository root (https://github.com/github/licensed/pull/345)
394
+
395
+ - Files in the manifest source will be found correctly for apps that are not at the repository root (<https://github.com/github/licensed/pull/345>)
380
396
 
381
397
  ## 2.14.4
398
+
382
399
  2021-02-09
383
400
 
384
401
  ### Added
385
- - `list` and `cache` commands optionally print output in JSON or YML formats using the `--format/-f` flag (https://github.com/github/licensed/pull/334)
386
- - `list` command will include detected license keys using the `--licenses/-l` flag (https://github.com/github/licensed/pull/334)
402
+
403
+ - `list` and `cache` commands optionally print output in JSON or YML formats using the `--format/-f` flag (<https://github.com/github/licensed/pull/334>)
404
+ - `list` command will include detected license keys using the `--licenses/-l` flag (<https://github.com/github/licensed/pull/334>)
387
405
 
388
406
  ## 2.14.3
407
+
389
408
  2020-12-11
390
409
 
391
410
  ### Fixed
392
- - Auto-generating license text for a known license will no longer raise an error if the found license has no text (:tada: @Eun https://github.com/github/licensed/pull/328)
411
+
412
+ - Auto-generating license text for a known license will no longer raise an error if the found license has no text (:tada: @Eun <https://github.com/github/licensed/pull/328>)
393
413
 
394
414
  ## 2.14.2
415
+
395
416
  2020-11-20
396
417
 
397
418
  ### Fixed
398
- - Yarn source correctly finds dependency paths on disk (https://github.com/github/licensed/pull/326)
399
- - Go source better handles finding dependencies that have been vendored (https://github.com/github/licensed/pull/323)
419
+
420
+ - Yarn source correctly finds dependency paths on disk (<https://github.com/github/licensed/pull/326>)
421
+ - Go source better handles finding dependencies that have been vendored (<https://github.com/github/licensed/pull/323>)
400
422
 
401
423
  ## 2.14.1
424
+
402
425
  2020-10-09
403
426
 
404
427
  ### Fixed
405
- - Shell command output is encoded to UTF8 (https://github.com/github/licensed/pull/319)
428
+
429
+ - Shell command output is encoded to UTF8 (<https://github.com/github/licensed/pull/319>)
406
430
 
407
431
  ## 2.14.0
432
+
408
433
  2020-10-04
409
434
 
410
435
  ### Added
411
- - `reviewed` dependencies can use glob pattern matching (https://github.com/github/licensed/pull/313)
436
+
437
+ - `reviewed` dependencies can use glob pattern matching (<https://github.com/github/licensed/pull/313>)
412
438
 
413
439
  ### Fixed
414
- - Fix configuring source path globs that expand into a single directory (https://github.com/github/licensed/pull/312)
440
+
441
+ - Fix configuring source path globs that expand into a single directory (<https://github.com/github/licensed/pull/312>)
415
442
 
416
443
  ## 2.13.0
444
+
417
445
  2020-09-23
418
446
 
419
447
  ### Added
420
- - `status` command results can be output in YAML and JSON formats (:tada: @julianvilas https://github.com/github/licensed/pull/303)
448
+
449
+ - `status` command results can be output in YAML and JSON formats (:tada: @julianvilas <https://github.com/github/licensed/pull/303>)
421
450
 
422
451
  ### Fixed
423
- - `licensed` no longer crashes when parsing invalid YAML from cached records (https://github.com/github/licensed/pull/306)
424
- - NPM source will no longer crash when invalid JSON is returned from npm CLI calls (https://github.com/github/licensed/pull/300)
425
- - Bundler source is fixed to work properly with `gems.rb` lockfiles (https://github.com/github/licensed/pull/299)
452
+
453
+ - `licensed` no longer crashes when parsing invalid YAML from cached records (<https://github.com/github/licensed/pull/306>)
454
+ - NPM source will no longer crash when invalid JSON is returned from npm CLI calls (<https://github.com/github/licensed/pull/300>)
455
+ - Bundler source is fixed to work properly with `gems.rb` lockfiles (<https://github.com/github/licensed/pull/299>)
426
456
 
427
457
  ## 2.12.2
458
+
428
459
  2020-07-07
429
460
 
430
461
  ### Changed
431
- - Cleaned up ruby 2.7 warnings (:tada: @jurre https://github.com/github/licensed/pull/292)
432
- - Cleaned up additional warnings in tests (https://github.com/github/licensed/pull/293)
462
+
463
+ - Cleaned up ruby 2.7 warnings (:tada: @jurre <https://github.com/github/licensed/pull/292>)
464
+ - Cleaned up additional warnings in tests (<https://github.com/github/licensed/pull/293>)
433
465
 
434
466
  ## 2.12.1
467
+
435
468
  2020-06-30
436
469
 
437
470
  ### Fixed
438
- - `licensed` no longer exits an error code when using the `--sources` CLI argument (https://github.com/github/licensed/pull/290)
471
+
472
+ - `licensed` no longer exits an error code when using the `--sources` CLI argument (<https://github.com/github/licensed/pull/290>)
439
473
 
440
474
  ## 2.12.0
475
+
441
476
  2020-06-19
442
477
 
443
478
  ### Added
444
- - `--sources` argument for cache, list, status and notices commands to filter running sources (https://github.com/github/licensed/pull/287)
479
+
480
+ - `--sources` argument for cache, list, status and notices commands to filter running sources (<https://github.com/github/licensed/pull/287>)
445
481
 
446
482
  ### Fixed
447
- - `cache` command will not remove files outside of enabled source cache paths (https://github.com/github/licensed/pull/287)
483
+
484
+ - `cache` command will not remove files outside of enabled source cache paths (<https://github.com/github/licensed/pull/287>)
448
485
 
449
486
  ## 2.11.1
487
+
450
488
  2020-06-09
451
489
 
452
490
  ### Fixed
453
- - `notices` command properly reads cached dependency notices contents (https://github.com/github/licensed/pull/283)
491
+
492
+ - `notices` command properly reads cached dependency notices contents (<https://github.com/github/licensed/pull/283>)
454
493
 
455
494
  ## 2.11.0
495
+
456
496
  2020-06-02
457
497
 
458
498
  ### Added
459
- - `notices` command to create a `NOTICE` file for each configured app (https://github.com/github/licensed/pull/277)
499
+
500
+ - `notices` command to create a `NOTICE` file for each configured app (<https://github.com/github/licensed/pull/277>)
460
501
 
461
502
  ### Fixed
462
- - NuGet source no longer crashes on a non-existent dependency path (https://github.com/github/licensed/pull/280)
463
- - Go source no longer crashes on a non-existent dependency package path (https://github.com/github/licensed/pull/274)
503
+
504
+ - NuGet source no longer crashes on a non-existent dependency path (<https://github.com/github/licensed/pull/280>)
505
+ - Go source no longer crashes on a non-existent dependency package path (<https://github.com/github/licensed/pull/274>)
464
506
 
465
507
  ## 2.10.0
508
+
466
509
  2020-05-15
467
510
 
468
511
  ### Changed
469
- - NPM source ignores missing peer dependencies (https://github.com/github/licensed/pull/267)
512
+
513
+ - NPM source ignores missing peer dependencies (<https://github.com/github/licensed/pull/267>)
470
514
 
471
515
  ### Added
472
- - NuGet source (:tada: @zarenner https://github.com/github/licensed/pull/261)
473
- - Multiple apps can share a single cache location (https://github.com/github/licensed/pull/263)
516
+
517
+ - NuGet source (:tada: @zarenner <https://github.com/github/licensed/pull/261>)
518
+ - Multiple apps can share a single cache location (<https://github.com/github/licensed/pull/263>)
474
519
 
475
520
  ## 2.9.2
521
+
476
522
  2020-04-28
477
523
 
478
524
  ### Changed
479
- - `licensee` minimum version bumped to 9.13.2 (https://github.com/github/licensed/pull/256)
525
+
526
+ - `licensee` minimum version bumped to 9.13.2 (<https://github.com/github/licensed/pull/256>)
480
527
 
481
528
  ## 2.9.1
529
+
482
530
  2020-03-24
483
531
 
484
532
  ### Changed
485
- - relaxed gem version restrictions on Thor (:tada: @eileencodes https://github.com/github/licensed/pull/254)
533
+
534
+ - relaxed gem version restrictions on Thor (:tada: @eileencodes <https://github.com/github/licensed/pull/254>)
486
535
 
487
536
  ## 2.9.0
537
+
488
538
  2020-03-19
489
539
 
490
540
  ### Added
491
- - Source paths use glob pattern matching (https://github.com/github/licensed/pull/245)
541
+
542
+ - Source paths use glob pattern matching (<https://github.com/github/licensed/pull/245>)
492
543
 
493
544
  ### Fixed
494
- - Mix source supports updates to mix.lock format (:tada: @bruce https://github.com/github/licensed/pull/242)
495
- - Go source supports `go list` format changes in go 1.14 (https://github.com/github/licensed/pull/247)
545
+
546
+ - Mix source supports updates to mix.lock format (:tada: @bruce <https://github.com/github/licensed/pull/242>)
547
+ - Go source supports `go list` format changes in go 1.14 (<https://github.com/github/licensed/pull/247>)
496
548
 
497
549
  ### Changed
498
- - `licensed cache` will flag dependencies for re-review when license text changes (https://github.com/github/licensed/pull/248)
499
- - `licensed status` will raise errors on dependencies that need re-review (https://github.com/github/licensed/pull/248)
500
- - `licensee` minimum version bumped to 9.13.1 (https://github.com/github/licensed/pull/251)
550
+
551
+ - `licensed cache` will flag dependencies for re-review when license text changes (<https://github.com/github/licensed/pull/248>)
552
+ - `licensed status` will raise errors on dependencies that need re-review (<https://github.com/github/licensed/pull/248>)
553
+ - `licensee` minimum version bumped to 9.13.1 (<https://github.com/github/licensed/pull/251>)
501
554
 
502
555
  ## 2.8.0
556
+
503
557
  2020-01-03
504
558
 
505
559
  ### Added
506
- - Yarn source (https://github.com/github/licensed/pull/232, https://github.com/github/licensed/pull/233, https://github.com/github/licensed/pull/236)
507
- - NPM source has a new option to include non-production dependencies (https://github.com/github/licensed/pull/231)
560
+
561
+ - Yarn source (<https://github.com/github/licensed/pull/232>, <https://github.com/github/licensed/pull/233>, <https://github.com/github/licensed/pull/236>)
562
+ - NPM source has a new option to include non-production dependencies (<https://github.com/github/licensed/pull/231>)
508
563
 
509
564
  ### Fixed
510
- - Cabal source will no longer crash if packages aren't found (https://github.com/github/licensed/pull/230)
565
+
566
+ - Cabal source will no longer crash if packages aren't found (<https://github.com/github/licensed/pull/230>)
511
567
 
512
568
  ## 2.7.0
569
+
513
570
  2019-11-10
514
571
 
515
572
  ### Added
516
- - License text is automatically generated for known licenses when not otherwise available (https://github.com/github/licensed/pull/223)
573
+
574
+ - License text is automatically generated for known licenses when not otherwise available (<https://github.com/github/licensed/pull/223>)
517
575
 
518
576
  ### Changed
519
- - Ignoring dependencies uses glob pattern matching (https://github.com/github/licensed/pull/225)
577
+
578
+ - Ignoring dependencies uses glob pattern matching (<https://github.com/github/licensed/pull/225>)
520
579
 
521
580
  ## 2.6.2
581
+
522
582
  2019-11-03
523
583
 
524
584
  ### Changed
585
+
525
586
  - A number of improvements to the go dependency enumerator
526
587
  - use `go env GOPATH` as a default if no other GOPATH is found
527
588
  - better compatibility with go modules when finding license content
@@ -530,94 +591,121 @@ and this project adheres to [Semantic Versioning](http://semver.org/spec/v2.0.0.
530
591
  - better checks for standard packages, reducing the amount of cached content
531
592
 
532
593
  ## 2.6.1
594
+
533
595
  2019-10-26
534
596
 
535
597
  ### Changed
536
- - Performance improvements during dependency enumeration (:tada: @krzysztof-pawlik-gat https://github.com/github/licensed/pull/204, https://github.com/github/licensed/pull/207) (https://github.com/github/licensed/pull/210)
598
+
599
+ - Performance improvements during dependency enumeration (:tada: @krzysztof-pawlik-gat <https://github.com/github/licensed/pull/204>, <https://github.com/github/licensed/pull/207>) (<https://github.com/github/licensed/pull/210>)
537
600
 
538
601
  ## 2.6.0
602
+
539
603
  2019-10-22
540
604
 
541
605
  ### Added
542
- - Mix source for Elixir (:tada: @bruce https://github.com/github/licensed/pull/195)
606
+
607
+ - Mix source for Elixir (:tada: @bruce <https://github.com/github/licensed/pull/195>)
543
608
 
544
609
  ## 2.5.0
610
+
545
611
  2019-09-26
546
612
 
547
613
  ### Added
548
- - `env` command to output application environment configuration (https://github.com/github/licensed/pull/187, https://github.com/github/licensed/pull/191)
614
+
615
+ - `env` command to output application environment configuration (<https://github.com/github/licensed/pull/187>, <https://github.com/github/licensed/pull/191>)
549
616
 
550
617
  ### Changed
551
- - `status` command will pass if multiple allowed licenses are found (https://github.com/github/licensed/pull/188)
618
+
619
+ - `status` command will pass if multiple allowed licenses are found (<https://github.com/github/licensed/pull/188>)
552
620
 
553
621
  ## 2.4.0
622
+
554
623
  2019-09-15
555
624
 
556
625
  ### Added
557
- - Composer source for PHP (https://github.com/github/licensed/pull/182)
626
+
627
+ - Composer source for PHP (<https://github.com/github/licensed/pull/182>)
558
628
 
559
629
  ## 2.3.2
630
+
560
631
  2019-08-26
561
632
 
562
633
  ### Fixed
634
+
563
635
  - Bundler with/without array settings are properly handled for bundler 1.15.x
564
636
 
565
637
  ## 2.3.1
638
+
566
639
  2019-08-20
567
640
 
568
641
  ### Changed
569
- - Using the npm source with yarn, "missing" dependencies are no longer considered errors (:tada: @krzysztof-pawlik-gat https://github.com/github/licensed/pull/170)
570
- - The bundler source now calls `gem specification` with dependency version requirements (https://github.com/github/licensed/pull/173)
642
+
643
+ - Using the npm source with yarn, "missing" dependencies are no longer considered errors (:tada: @krzysztof-pawlik-gat <https://github.com/github/licensed/pull/170>)
644
+ - The bundler source now calls `gem specification` with dependency version requirements (<https://github.com/github/licensed/pull/173>)
571
645
 
572
646
  ## 2.3.0
647
+
573
648
  2019-05-19
574
649
 
575
650
  ### Added
576
- - New Pipenv dependency source enumerator (:tada: @krzysztof-pawlik-gat https://github.com/github/licensed/pull/167)
651
+
652
+ - New Pipenv dependency source enumerator (:tada: @krzysztof-pawlik-gat <https://github.com/github/licensed/pull/167>)
577
653
 
578
654
  ## 2.2.0
655
+
579
656
  2019-05-11
580
657
 
581
658
  ### Added
582
- - Content hash versioning strategy for go and manifest sources (https://github.com/github/licensed/pull/164)
659
+
660
+ - Content hash versioning strategy for go and manifest sources (<https://github.com/github/licensed/pull/164>)
583
661
 
584
662
  ### Fixed
585
- - Python source handles urls and package names with "-" in requirements.txt (:tada: @krzysztof-pawlik-gat https://github.com/github/licensed/pull/165)
663
+
664
+ - Python source handles urls and package names with "-" in requirements.txt (:tada: @krzysztof-pawlik-gat <https://github.com/github/licensed/pull/165>)
586
665
 
587
666
  ## 2.1.0
667
+
588
668
  2019-04-16
589
669
 
590
670
  ### Added
591
- - New Gradle dependency source enumerator (:tada: @dbussink https://github.com/github/licensed/pull/150, @jandersson-svt https://github.com/github/licensed/pull/159)
592
- - Metadata added to distributed packages (https://github.com/github/licensed/pull/160)
671
+
672
+ - New Gradle dependency source enumerator (:tada: @dbussink <https://github.com/github/licensed/pull/150>, @jandersson-svt <https://github.com/github/licensed/pull/159>)
673
+ - Metadata added to distributed packages (<https://github.com/github/licensed/pull/160>)
593
674
 
594
675
  ### Changes
595
- - Bundler dependency source loads license key from a gem's cached gemspec file as a fallback (https://github.com/github/licensed/pull/154)
596
- - Licensed will only raise errors on an empty dependency path when caching records (https://github.com/github/licensed/pull/149)
676
+
677
+ - Bundler dependency source loads license key from a gem's cached gemspec file as a fallback (<https://github.com/github/licensed/pull/154>)
678
+ - Licensed will only raise errors on an empty dependency path when caching records (<https://github.com/github/licensed/pull/149>)
597
679
 
598
680
  ### Fixed
599
- - Migrating to v2 will no longer crash trying to migrate cached records that don't exist (https://github.com/github/licensed/pull/148)
600
- - Reported warnings will no longer crash licensed when caching records (https://github.com/github/licensed/pull/147)
681
+
682
+ - Migrating to v2 will no longer crash trying to migrate cached records that don't exist (<https://github.com/github/licensed/pull/148>)
683
+ - Reported warnings will no longer crash licensed when caching records (<https://github.com/github/licensed/pull/147>)
601
684
 
602
685
  ## 2.0.1
686
+
603
687
  2019-02-14
604
688
 
605
689
  ### Changes
690
+
606
691
  - Dependency paths that don't exist on the local disk are reported as warnings
607
692
  - Cache, status and list output is sorted by app name, source type and dependency name
608
693
  - Bumped `licensee` gem requirement
609
694
 
610
695
  ## 2.0.0
696
+
611
697
  2019-02-09
612
698
 
613
699
  **This is a major release and includes breaking changes to the configuration and cached record file formats**
614
700
 
615
701
  ### Added
702
+
616
703
  - New `migrate` command to automatically update configuration and cached record file formats
617
704
  - New extensible reporting infrastructure
618
705
  - New base command and source classes to abstract away implementation details
619
706
 
620
707
  ### Changes
708
+
621
709
  - Cached dependency metadata files are now stored entirely as YAML, with `.dep.yml` extension
622
710
  - The Bundler dependency source is now identified in configuration files and output as `bundler` instead of `rubygem`
623
711
  - Refactored sources for better consistency between classes
@@ -626,134 +714,171 @@ and this project adheres to [Semantic Versioning](http://semver.org/spec/v2.0.0.
626
714
  - Updated Dependency classes for better integration with `licensee`
627
715
 
628
716
  ### Fixed
717
+
629
718
  - Licensed no longer exits on errors when evaluating dependency sources or finding dependencies
630
719
  - The Bundler dependency source correctly finds the `bundler` gem as a dependency in more cases
631
720
 
632
721
  ## 1.5.2
722
+
633
723
  2018-12-27
634
724
 
635
725
  ### Changes
636
- - Go source added support for Go modules and Golang 1.11+ (https://github.com/github/licensed/pull/113)
726
+
727
+ - Go source added support for Go modules and Golang 1.11+ (<https://github.com/github/licensed/pull/113>)
637
728
 
638
729
  ### Fixed
639
- - Licensed will have a non-zero exit code when commands fail (:tada: @parkr https://github.com/github/licensed/pull/111)
730
+
731
+ - Licensed will have a non-zero exit code when commands fail (:tada: @parkr <https://github.com/github/licensed/pull/111>)
640
732
 
641
733
  ## 1.5.1
734
+
642
735
  2018-10-30
643
736
 
644
737
  ### Fixed
645
- - Fixed a scenario where licensed wasn't finding bundler dependencies when run as an executable due to a ruby version mismatch (https://github.com/github/licensed/pull/106)
738
+
739
+ - Fixed a scenario where licensed wasn't finding bundler dependencies when run as an executable due to a ruby version mismatch (<https://github.com/github/licensed/pull/106>)
646
740
 
647
741
  ## 1.5.0
742
+
648
743
  2018-10-24
649
744
 
650
745
  ### Added
651
- - `licensed (version | -v | --version)` command to see the current licensed version (:tada: @mwagz! https://github.com/github/licensed/pull/101)
746
+
747
+ - `licensed (version | -v | --version)` command to see the current licensed version (:tada: @mwagz! <https://github.com/github/licensed/pull/101>)
652
748
 
653
749
  ### Fixed
654
- - NPM source no longer raises an error when ignored dependencies aren't found (:tada: @mwagz! https://github.com/github/licensed/pull/100)
655
- - Checking for a Git repo will no longer possibly modify `.git/index` (:tada: @dbussink https://github.com/github/licensed/pull/102)
656
- - Fixed a scenario where licensed wasn't finding bundler dependencies when run as an executable (https://github.com/github/licensed/pull/103)
750
+
751
+ - NPM source no longer raises an error when ignored dependencies aren't found (:tada: @mwagz! <https://github.com/github/licensed/pull/100>)
752
+ - Checking for a Git repo will no longer possibly modify `.git/index` (:tada: @dbussink <https://github.com/github/licensed/pull/102>)
753
+ - Fixed a scenario where licensed wasn't finding bundler dependencies when run as an executable (<https://github.com/github/licensed/pull/103>)
657
754
 
658
755
  ## 1.4.0
756
+
659
757
  2018-10-20
660
758
 
661
759
  ### Added
760
+
662
761
  - Git Submodules dependency source :tada:
663
762
  - Configuration option to explicitly set a root absolute path
664
763
 
665
764
  ### Changes
765
+
666
766
  - `COPYING` file is no longer matched as a legal file
667
767
 
668
768
  ### Fixed
769
+
669
770
  - NPM source will enumerate multiple versions of the same dependency
670
771
  - Running Licensed outside of a Git repository no longer raises an error
671
772
  - Packaging scripts will correctly return to the previous branch when the script is finished
672
773
 
673
774
  ## 1.3.4
775
+
674
776
  2018-09-20
675
777
 
676
778
  ### Changes
779
+
677
780
  - Bundler source will avoid looking for a gemspec file when possible
678
781
 
679
782
  ## 1.3.3
783
+
680
784
  2018-09-07
681
785
 
682
786
  ### Fixed
787
+
683
788
  - Manifest source configuration globs correctly enumerates files from within submodules
684
789
  - The manifest source no longer errors when getting version information from submodules
685
790
 
686
791
  ## 1.3.2
792
+
687
793
  2018-08-15
688
794
 
689
795
  ### Fixed
796
+
690
797
  - Fixed issue when multiple versions of a cabal package are found
691
798
 
692
799
  ## 1.3.1
800
+
693
801
  2018-08-01
694
802
 
695
803
  ### Fixed
804
+
696
805
  - Fixed regression finding ruby gems by path
697
806
 
698
807
  ## 1.3.0
808
+
699
809
  2018-07-25
700
810
 
701
811
  ### Added
812
+
702
813
  - Manifests for the manifest dependency source can be specified using glob patterns in the configuration
703
814
  - Paths to licenses for dependencies from the manifest dependency source can be specified in the configuration
704
815
  - Manifest dependency source looks for license content in C-style comments if a license file isn't found
705
816
 
706
817
  ## Changes
818
+
707
819
  - GitHub is no longer queried to find remote license information
708
820
  - Removed custom logic around determining whether to use the license key from `licensee`
709
821
  - NPM dependency enumeration doesn't use `npm list`
710
822
  - Licensed now tracks content from multiple license files when available
711
823
 
712
824
  ### Fixed
825
+
713
826
  - Fixed regression finding platform-specific ruby gems
714
827
 
715
828
  ## 1.2.0
829
+
716
830
  2018-06-22
717
831
 
718
832
  ### Added
833
+
719
834
  - Building and packaging distributable exes for licensed releases
720
835
  - Can now configure which Gemfile groups are excluded from dependency enumeration
721
836
 
722
837
  ### Fixed
838
+
723
839
  - Bundler is no longer always reported as a dependency
724
840
  - Set the minimum required ruby version for licensed
725
841
 
726
842
  ## 1.1.0
843
+
727
844
  2018-06-04
728
845
 
729
846
  ### Added
847
+
730
848
  - Pip dependency source :tada:
731
849
  - Go Dep dependency source :tada:
732
850
 
733
851
  ### Changed
852
+
734
853
  - Changed how `sources` configuration property affects which sources are enabled
735
854
  - Raise informative error messages when shell commands fail
736
855
 
737
856
  ### Fixed
857
+
738
858
  - Don't reuse cached license when cached version metadata is missing
739
859
  - Disable dependency sources when dependent tools are not available
740
860
  - Vendored packages from the go std library are properly excluded
741
861
  - Cabal dependency enumeration properly includes executable targets
742
862
 
743
863
  ## 1.0.1
864
+
744
865
  2018-04-26
745
866
 
746
867
  ### Added
868
+
747
869
  - GOPATH settable in configuration file
748
870
 
749
871
  ### Changed
872
+
750
873
  - Reuse "license" metadata property when license text has not changed
751
874
 
752
875
  ### Fixed
876
+
753
877
  - Path expansion for cabal "ghc_package_db" configuration setting occurs from repository root
754
878
  - Local Gemfile(.lock) files correctly used in enumerating Bundler source dependencies
755
879
 
756
880
  ## 1.0.0
881
+
757
882
  2018-02-20
758
883
 
759
884
  Initial release :tada:
data/Gemfile.lock CHANGED
@@ -1,12 +1,13 @@
1
1
  PATH
2
2
  remote: .
3
3
  specs:
4
- licensed (5.0.0)
4
+ licensed (5.0.2)
5
+ csv (~> 3.3)
5
6
  json (~> 2.6)
6
7
  licensee (~> 9.16)
7
8
  parallel (~> 1.22)
8
9
  pathname-common_prefix (~> 0.0.1)
9
- reverse_markdown (~> 2.1)
10
+ reverse_markdown (>= 2.1, < 4.0)
10
11
  ruby-xxHash (~> 0.4.0)
11
12
  thor (~> 1.2)
12
13
  tomlrb (~> 2.0)
@@ -24,56 +25,61 @@ GEM
24
25
  minitest (>= 5.1)
25
26
  mutex_m
26
27
  tzinfo (~> 2.0)
27
- addressable (2.8.1)
28
- public_suffix (>= 2.0.2, < 6.0)
28
+ addressable (2.8.7)
29
+ public_suffix (>= 2.0.2, < 7.0)
29
30
  ast (2.4.2)
30
31
  base64 (0.2.0)
31
32
  bigdecimal (3.1.7)
32
33
  byebug (11.1.3)
33
34
  concurrent-ruby (1.2.3)
34
35
  connection_pool (2.4.1)
35
- dotenv (2.8.1)
36
+ csv (3.3.2)
37
+ dotenv (3.1.4)
36
38
  drb (2.2.1)
37
- faraday (2.7.4)
38
- faraday-net_http (>= 2.0, < 3.1)
39
- ruby2_keywords (>= 0.0.4)
40
- faraday-net_http (3.0.2)
39
+ faraday (2.12.1)
40
+ faraday-net_http (>= 2.0, < 3.5)
41
+ json
42
+ logger
43
+ faraday-net_http (3.4.0)
44
+ net-http (>= 0.5.0)
41
45
  i18n (1.14.4)
42
46
  concurrent-ruby (~> 1.0)
43
- json (2.7.2)
44
- licensee (9.16.0)
45
- dotenv (~> 2.0)
46
- octokit (>= 4.20, < 7.0)
47
- reverse_markdown (>= 1, < 3)
47
+ json (2.9.1)
48
+ licensee (9.18.0)
49
+ dotenv (>= 2, < 4)
50
+ octokit (>= 4.20, < 10.0)
51
+ reverse_markdown (>= 1, < 4)
48
52
  rugged (>= 0.24, < 2.0)
49
53
  thor (>= 0.19, < 2.0)
50
- mini_portile2 (2.8.1)
51
- minitest (5.25.1)
54
+ logger (1.6.1)
55
+ mini_portile2 (2.8.8)
56
+ minitest (5.25.4)
52
57
  minitest-hooks (1.5.2)
53
58
  minitest (> 5.3)
54
- mocha (2.4.5)
59
+ mocha (2.7.1)
55
60
  ruby2_keywords (>= 0.0.5)
56
61
  mutex_m (0.2.0)
57
- nokogiri (1.16.5)
58
- mini_portile2 (~> 2.8.0)
62
+ net-http (0.5.0)
63
+ uri
64
+ nokogiri (1.16.7)
65
+ mini_portile2 (~> 2.8.2)
59
66
  racc (~> 1.4)
60
- octokit (6.1.0)
67
+ octokit (9.2.0)
61
68
  faraday (>= 1, < 3)
62
69
  sawyer (~> 0.9)
63
70
  parallel (1.26.3)
64
71
  parser (3.2.0.0)
65
72
  ast (~> 2.4.1)
66
73
  pathname-common_prefix (0.0.2)
67
- public_suffix (5.0.1)
68
- racc (1.6.2)
74
+ public_suffix (6.0.1)
75
+ racc (1.8.1)
69
76
  rack (3.0.9.1)
70
77
  rainbow (3.1.1)
71
78
  rake (13.2.1)
72
79
  regexp_parser (2.6.2)
73
- reverse_markdown (2.1.1)
80
+ reverse_markdown (3.0.0)
74
81
  nokogiri
75
- rexml (3.3.6)
76
- strscan
82
+ rexml (3.3.9)
77
83
  rubocop (1.45.1)
78
84
  json (~> 2.3)
79
85
  parallel (~> 1.10)
@@ -100,16 +106,16 @@ GEM
100
106
  ruby-progressbar (1.11.0)
101
107
  ruby-xxHash (0.4.0.2)
102
108
  ruby2_keywords (0.0.5)
103
- rugged (1.5.1)
109
+ rugged (1.7.2)
104
110
  sawyer (0.9.2)
105
111
  addressable (>= 2.3.5)
106
112
  faraday (>= 0.17.3, < 3)
107
- strscan (3.1.0)
108
113
  thor (1.3.2)
109
114
  tomlrb (2.0.3)
110
115
  tzinfo (2.0.6)
111
116
  concurrent-ruby (~> 1.0)
112
117
  unicode-display_width (2.4.2)
118
+ uri (1.0.2)
113
119
 
114
120
  PLATFORMS
115
121
  ruby
data/docs/migrations/v3.md CHANGED
@@ -16,7 +16,7 @@ Using licensed to enumerate bundler dependencies in a GitHub Actions workflow wi
16
16
 
17
17
  If you are using licensed in a GitHub Actions workflow, [github/setup-licensed](https://github.com/github/setup-licensed) has been updated according to this breaking change. `setup-licensed` will install the licensed gem when ruby is available, or the licensed executable when ruby is not available. Alternatively, you can `gem install` licensed directly as an actions step.
18
18
 
19
- This is an example workflow definition that runs [github/licensed-ci](https://github.com/github/licensed-ci)'s opinionated license compliance workflow in CI. It includes jobs that demonstrate installing licensed using
19
+ This is an example workflow definition that runs [github/licensed-ci](https://github.com/github/licensed-ci)'s opinionated license compliance workflow in CI. It includes jobs that demonstrate installing licensed using
20
20
  - `gem install`
21
21
  - [github/setup-licensed](https://github.com/github/setup-licensed)
22
22
  - installing when included in a bundler gem file
@@ -43,9 +43,9 @@ jobs:
43
43
  steps:
44
44
  # checkout the repo
45
45
  - uses: actions/checkout@v1
46
-
46
+
47
47
  # install ruby
48
- - uses: ruby/setup-ruby@v1
48
+ - uses: ruby/setup-ruby@a2bbe5b1b236842c1cb7dd11e8e3b51e0a616acc
49
49
  with:
50
50
  ruby-version: "3.0"
51
51
 
@@ -60,8 +60,8 @@ jobs:
60
60
  # run licensed-ci to cache any metadata changes and verify compliance
61
61
  - uses: github/licensed-ci@v1
62
62
 
63
- # OR
64
-
63
+ # OR
64
+
65
65
  # install licensed using gem install
66
66
  licensed-ci-gem:
67
67
  runs-on: ubuntu-latest
@@ -69,9 +69,9 @@ jobs:
69
69
  steps:
70
70
  # checkout the repo
71
71
  - uses: actions/checkout@v1
72
-
72
+
73
73
  # install ruby and bundler
74
- - uses: ruby/setup-ruby@v1
74
+ - uses: ruby/setup-ruby@a2bbe5b1b236842c1cb7dd11e8e3b51e0a616acc
75
75
  with:
76
76
  ruby-version: "3.0"
77
77
 
@@ -93,9 +93,9 @@ jobs:
93
93
  steps:
94
94
  # checkout the repo
95
95
  - uses: actions/checkout@v1
96
-
96
+
97
97
  # install ruby and bundler
98
- - uses: ruby/setup-ruby@v1
98
+ - uses: ruby/setup-ruby@a2bbe5b1b236842c1cb7dd11e8e3b51e0a616acc
99
99
  with:
100
100
  ruby-version: "3.0"
101
101
 
data/lib/licensed/sources/npm.rb CHANGED
@@ -48,7 +48,7 @@ module Licensed
48
48
  end
49
49
 
50
50
  def packages
51
- root_dependencies = package_metadata["dependencies"]
51
+ root_dependencies = package_metadata["dependencies"] || {}
52
52
  recursive_dependencies(root_dependencies).each_with_object({}) do |(name, results), hsh|
53
53
  results.uniq! { |package| package["version"] }
54
54
  if results.size == 1
data/lib/licensed/version.rb CHANGED
@@ -1,6 +1,6 @@
1
1
  # frozen_string_literal: true
2
2
  module Licensed
3
- VERSION = "5.0.0".freeze
3
+ VERSION = "5.0.2".freeze
4
4
 
5
5
  def self.previous_major_versions
6
6
  major_version = Gem::Version.new(Licensed::VERSION).segments.first
data/licensed.gemspec CHANGED
@@ -23,13 +23,14 @@ Gem::Specification.new do |spec|
23
23
 
24
24
  spec.required_ruby_version = ">= 3.0.0"
25
25
 
26
+ spec.add_dependency "csv", "~> 3.3"
26
27
  spec.add_dependency "licensee", "~> 9.16"
27
28
  spec.add_dependency "thor", "~> 1.2"
28
29
  spec.add_dependency "pathname-common_prefix", "~> 0.0.1"
29
30
  spec.add_dependency "tomlrb", "~> 2.0"
30
31
  spec.add_dependency "ruby-xxHash", "~> 0.4.0"
31
32
  spec.add_dependency "parallel", "~> 1.22"
32
- spec.add_dependency "reverse_markdown", "~> 2.1"
33
+ spec.add_dependency "reverse_markdown", ">= 2.1", "< 4.0"
33
34
  spec.add_dependency "json", "~> 2.6"
34
35
 
35
36
  spec.add_development_dependency "rake", "~> 13.0"
metadata CHANGED
@@ -1,15 +1,29 @@
1
1
  --- !ruby/object:Gem::Specification
2
2
  name: licensed
3
3
  version: !ruby/object:Gem::Version
4
- version: 5.0.0
4
+ version: 5.0.2
5
5
  platform: ruby
6
6
  authors:
7
7
  - GitHub
8
- autorequire:
8
+ autorequire:
9
9
  bindir: exe
10
10
  cert_chain: []
11
- date: 2024-10-04 00:00:00.000000000 Z
11
+ date: 2025-02-06 00:00:00.000000000 Z
12
12
  dependencies:
13
+ - !ruby/object:Gem::Dependency
14
+ name: csv
15
+ requirement: !ruby/object:Gem::Requirement
16
+ requirements:
17
+ - - "~>"
18
+ - !ruby/object:Gem::Version
19
+ version: '3.3'
20
+ type: :runtime
21
+ prerelease: false
22
+ version_requirements: !ruby/object:Gem::Requirement
23
+ requirements:
24
+ - - "~>"
25
+ - !ruby/object:Gem::Version
26
+ version: '3.3'
13
27
  - !ruby/object:Gem::Dependency
14
28
  name: licensee
15
29
  requirement: !ruby/object:Gem::Requirement
@@ -98,16 +112,22 @@ dependencies:
98
112
  name: reverse_markdown
99
113
  requirement: !ruby/object:Gem::Requirement
100
114
  requirements:
101
- - - "~>"
115
+ - - ">="
102
116
  - !ruby/object:Gem::Version
103
117
  version: '2.1'
118
+ - - "<"
119
+ - !ruby/object:Gem::Version
120
+ version: '4.0'
104
121
  type: :runtime
105
122
  prerelease: false
106
123
  version_requirements: !ruby/object:Gem::Requirement
107
124
  requirements:
108
- - - "~>"
125
+ - - ">="
109
126
  - !ruby/object:Gem::Version
110
127
  version: '2.1'
128
+ - - "<"
129
+ - !ruby/object:Gem::Version
130
+ version: '4.0'
111
131
  - !ruby/object:Gem::Dependency
112
132
  name: json
113
133
  requirement: !ruby/object:Gem::Requirement
@@ -327,7 +347,7 @@ homepage: https://github.com/github/licensed
327
347
  licenses:
328
348
  - MIT
329
349
  metadata: {}
330
- post_install_message:
350
+ post_install_message:
331
351
  rdoc_options: []
332
352
  require_paths:
333
353
  - lib
@@ -343,7 +363,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
343
363
  version: '0'
344
364
  requirements: []
345
365
  rubygems_version: 3.3.26
346
- signing_key:
366
+ signing_key:
347
367
  specification_version: 4
348
368
  summary: Extract and validate the licenses of dependencies.
349
369
  test_files: []