License data quality improvements

Дата публикации: 13-08-2026 19:14:12

GitHub now uses package registries like npmjs.org and PyPI to determine license information for software components in the dependency graph. This improves the accuracy and completeness of the licenses shown…
The post License data quality improvements appeared first on The GitHub Blog.

Основное содержимое страницы с новостью.

GitHub now uses package registries like npmjs.org and PyPI to determine license information for software components in the dependency graph. This improves the accuracy and completeness of the licenses shown in dependency insights, software bills of materials (SBOMs), the open source license compliance feature in GitHub Advanced Security, and the dependency review action.

Previously, the primary source of license information on GitHub was the ClearlyDefined service. While we still use and contribute to ClearlyDefined, we’ve found that its focus on depth-first file scanning led to complex results that users found confusing. We’ll still fall back to ClearlyDefined data, but will now prioritize license information from the package registries. Early results show that we’ve cut the number of missing licenses in half, from 45% of the 170 million packages in the dependency graph down to 24%. Additionally, the system now tracks version ranges instead of requiring a specific database entry for every version, so the actual coverage will be higher.

To explain further, the dependency graph service now uses metadata from the canonical registry for a given package ecosystem, as described in the following table.

The dependency graph service keeps license history based on version ranges. For example, Grafana, which relicensed from Apache to AGPL, has two entries: one covering 1.0.0 through 7.5.17 for Apache-2.0, and one from 8.0.0 or newer for AGPLv3. This both reduces the complexity of the database and provides license information for new versions without requiring each one to be added explicitly.

Updated license information is available now across all of GitHub.

Join the discussion within GitHub Community.

Схожие новости

#	Наименование новости	Тональность	Информативность	Дата публикации
1	Rule insights for organizations in public preview	0	7.89	12-08-2026
2	GitHub Copilot weekly releases — August 10	0	8.51	14-08-2026
3	GitHub &amp; other LLM-gen-AI Companies Urge <em>You</em> to Misdirect California Legislature on FOSS Licensing!	0	10.4	03-07-2026
4	Block users from comments in personal repositories	0	5.4	13-08-2026
5	GitHub service degradation may impact customers using GitHub	0	5.38	12-08-2026
6	Multiple redirect URIs and token refresh for OAuth apps	0	5.42	14-08-2026
7	net/go-pkgsite - 0.4.0	0	35.1	15-08-2026
8	PyPI hardens package security with new upload restrictions	0	9.58	23-07-2026
9	GitHub revamps bug bounty program with new VIP tier, payout changes	0	13.38	23-07-2026
10	games/OpenLoco - 26.08	0	17.1	15-08-2026

Классификация: . Схожих патентов: 0. Схожих новостей: 10. Тональность: 0. Информативность: 9.08. Источник: github.blog.