License Lantern has reached Gold.
It takes local dependency files and turns them into a license inventory, an SPDX draft, and a starting point for third-party attribution. It supports npm lockfiles, Python project and requirements files, and CycloneDX JSON.
One thing I've kept explicit is what the tool doesn't know. Missing licenses and unknown or malformed SPDX expressions stay unresolved for review. Invalid input structures are rejected rather than quietly skipped. You can add sourced overrides and compare an inventory with a previous one without losing the original declaration or the review information.
The latest release improves malformed-input handling, bounds parsing, and protects existing output files. It runs locally without looking packages up through a registry.
You'll still need to verify license terms and include the actual notices and texts required for distribution. This gives you an organized place to do that work instead of treating missing metadata as an answer.
https://t.co/fu4qaxdYWH
License Lantern has reached Gold.
· Forge / Open Source Project Updates