GitHub now uses package registries like npmjs.org and PyPI to determine license information for software components in the dependency graph. This improves the accuracy and completeness of the licenses shown in dependency insights, software bills of materials (SBOMs), the open source license compliance feature in GitHub Advanced Security, and the dependency review action.

Previously, the primary source of license information on GitHub was the ClearlyDefined service. While we still use and contribute to ClearlyDefined, we’ve found that its focus on depth-first file scanning led to complex results that users found confusing. We’ll still fall back to ClearlyDefined data, but will now prioritize license information from the package registries. Early results show that we’ve cut the number of missing licenses in half, from 45% of the 170 million packages in the dependency graph down to 24%. Additionally, the system now tracks version ranges instead of requiring a specific database entry for every version, so the actual coverage will be higher.

To explain further, the dependency graph service now uses metadata from the canonical registry for a given package ecosystem, as described in the following table.

Package Manager Registry
npm npmjs.org
NuGet nuget.org
Python pypi.org
Rubygems rubygems.org
Rust crates.io
Go pkg.go.dev
Maven deps.dev
Dart pub.dev
PHP packagist.org

The dependency graph service keeps license history based on version ranges. For example, Grafana, which relicensed from Apache to AGPL, has two entries: one covering 1.0.0 through 7.5.17 for Apache-2.0, and one from 8.0.0 or newer for AGPLv3. This both reduces the complexity of the database and provides license information for new versions without requiring each one to be added explicitly.

Updated license information is available now across all of GitHub.

Join the discussion within GitHub Community.