SPDX License Field Lint for package.json, pyproject.toml and Cargo.toml

Six licence lines break compliance in this repository - npm, PyPI and crates.io maintainers on EU-facing teams, four manifests.

package.json:5     "license": "GPL-3.0",
  Deprecated SPDX id "GPL-3.0" (SPDX License List 3.0). It does NOT mean "or later" -
  pick "GPL-3.0-only" or "GPL-3.0-or-later".

vendor.json:3      "license": "Unlicense"
  CAUTION: "Unlicense" is a public-domain dedication - it hands the code to everyone.
  For proprietary code npm expects "UNLICENSED" (all caps, with the D).

pyproject.toml:4   license = {text = "MIT"}
  PEP 639: license = {text = "..."} is deprecated. Write license = "MIT" (a bare SPDX
  expression). setuptools stops supporting the table form after 2026-02-18.

pyproject.toml:7   "License :: OSI Approved :: MIT License",
  PEP 639 deprecated the "License ::" trove classifiers. Delete this line and put an
  SPDX expression in project.license instead.

Cargo.toml:5       license = "MIT/Apache-2.0"
  The old npm "MIT/Apache-2.0" slash syntax was removed. Write "MIT OR Apache-2.0".

Cargo.toml:9       license = "SSPL-1.0"
  NOT OSI-approved (SSPL-1.0). The OSI declined to approve it. Section 13 extends
  copyleft to your whole service-management stack if you offer the software as a
  service. Debian and Fedora exclude it.

That is the entire output, not a sample. Six defects, four files, all real and current.

What each one costs you

GPL-3.0 was deprecated in SPDX License List 3.0 because people wrote it to mean "version 3 or any later version" - which it does not. GPL-3.0-only and GPL-3.0-or-later mean different things, and the same split runs through the GNU family.

Unlicense is not UNLICENSED. One hands your source to everyone, permanently; the other is what npm expects for proprietary code. One letter apart, exact opposites.

The two pyproject.toml findings are PEP 639 leftovers: it replaced the licence table and trove classifiers with a bare SPDX expression in project.license plus a license-files key. If a build started failing on current setuptools, that is why.

MIT/Apache-2.0 is removed npm syntax - SPDX expressions use uppercase operators: MIT OR Apache-2.0. And SSPL-1.0 is source-available, not open source, alongside BUSL-1.1, Elastic-2.0 and RSALv2. A policy of "OSI-approved licences only" rejects them all.

Why the usual tools miss all six

npm publish and setuptools check the one package you publish, never the hundreds you consume, and neither flags a deprecated SPDX id - a deprecated id is still a known id, so it validates.

A chatbot is worse, predictably. Most text these models learned from predates SPDX List 3.0 and PEP 639, so the modal answer is GPL-3.0 and License :: OSI Approved :: MIT License - the two defects you are removing.

The licence is a required SBOM field, CRA vulnerability and incident reporting obligations landed on 11 September 2026, and the full technical-documentation and SBOM requirements arrive 11 December 2027. Neither can be answered from a manifest whose licence column reads UNKNOWN.

The extension

SPDX License Lint reads the licence declarations in the open file - package.json, pyproject.toml, Cargo.toml, composer.json and more - and applies 73 rules: deprecated identifiers, invalid strings, npm's removed array and object forms, expression syntax, PEP 639 migration, and the obligation each licence carries. Every finding gives the line, the reason, and the exact replacement. That part is free and finishes the job for the file in front of you.

The full version is $29 once: the same 73 rules over every manifest in the repository in one pass, the licence inventory exported as CSV, JSON or HTML for the SBOM column, and a wrong identifier rewritten in place. An open-source licence audit runs 40-160 hours and thousands to tens of thousands of dollars per program; commercial SCA licence-compliance subscriptions start around $1,500/year.