SPDX License Field Lint for package.json, pyproject.toml and Cargo.toml

Six lines in one manifest fail before the SBOM is even started - and if you publish to npm, PyPI, crates.io or Packagist from a team selling into the EU, they are probably in your repository right now.

Here is the manifest. Every line below is a real, current defect, not a style preference.

"license": "GPL-3.0"
"license": "Unlicense"
license = {text = "MIT"}
"License :: OSI Approved :: MIT License"
"license": "MIT/Apache-2.0"
"license": "SSPL-1.0"

GPL-3.0 has been a deprecated identifier since SPDX License List 3.0. It was deprecated precisely because people used it to mean "version 3 or any later version", which is not what it says. The current identifiers are GPL-3.0-only and GPL-3.0-or-later, and they mean different things. The same split applies to GPL-2.0, LGPL-2.1, LGPL-3.0, AGPL-3.0 and the whole GNU family.

Unlicense is not UNLICENSED. Unlicense is a public-domain dedication: it hands your source to everyone, permanently. UNLICENSED is what npm expects for proprietary code. The two strings differ by one letter and a capitalisation, and they are exact opposites.

license = {text = "MIT"} and License :: classifiers are PEP 639 leftovers. PEP 639 replaced both with a bare SPDX expression in project.license plus a separate license-files key. setuptools has been warning about the table form, and its deprecation notice put the end of support at 2026-02-18. If your build has started failing on a machine with a current setuptools, this is why.

MIT/Apache-2.0 is old npm syntax that was removed. SPDX expressions use uppercase operators: MIT OR Apache-2.0. A lowercase or invalidates the whole expression just as surely.

SSPL-1.0 is source-available, not open source. The OSI declined to approve it, Debian and Fedora exclude it, and its section 13 extends copyleft to your entire service-management stack if you offer the software as a service. BUSL-1.1, Elastic-2.0, RSALv2, the PolyForm family, FSL and Commons-Clause sit in the same box. A procurement policy that says "OSI-approved licences only" rejects every one of them.

Why the usual tools do not catch this

npm publish and setuptools check the one package you are publishing. They say nothing about the hundreds of manifests you consume, and neither of them flags a deprecated SPDX identifier - a deprecated id is still a *known* id, so it validates.

Asking a chatbot is worse than useless here, and predictably so. Most of the text these models learned from was written before SPDX List 3.0 and before PEP 639, so the modal answer is GPL-3.0 and License :: OSI Approved :: MIT License. The model is confidently reproducing the exact two defects you are trying to remove.

That matters more now than it did last year. The licence is a required field in an SBOM, and CRA obligations landed on 11 September 2026 for vulnerability and incident reporting, with the full technical-documentation and SBOM requirements arriving 11 December 2027. You cannot answer either one from a manifest whose licence column is UNKNOWN.

The extension

SPDX License Lint is a VS Code extension that reads the licence declarations in the file you have open - package.json, pyproject.toml, setup.cfg, Cargo.toml, composer.json, *.gemspec - and applies 73 rules covering deprecated SPDX identifiers, invalid strings, npm's removed array and object forms, SPDX expression syntax, PEP 639 migration, and the obligations each licence actually carries.

Every finding gives you the line number, the reason, and the exact replacement string. That part is free and it finishes the job for the file in front of you.

The full version is $29 once: it runs the same 73 rules over every manifest in the repository in one pass, exports the licence inventory as CSV, JSON or HTML for the SBOM licence column, and rewrites a wrong identifier in place so a repo full of GPL-3.0 becomes GPL-3.0-only without a hand edit per file. For comparison, an open-source licence audit runs 40-160 hours and thousands to tens of thousands of dollars per program.

It also runs as a single web page with no install, no account and no network call, so you can paste a manifest in and see the answer before deciding anything.