Skip to content

v30.0.0 - 2021-09-23
Compare
Choose a tag to compare
@pombredanne pombredanne released this 23 Sep 11:46
· 2946 commits to develop since this release
v30.0.0
a0d4d81
This commit was created on GitHub.com and signed with GitHub’s verified signature. The key has expired.
GPG key ID: 4AEE18F83AFDEB23
Expired
Verified
Learn about vigilant mode.

This is a major release with new features, and several bug fixes and
improvements including major updates to the license detection.

We have dropped using calendar-based versions and are now switched back to semver
versioning. To ensure that there is no ambiguity, the new major version has been
updated from 21 to 30. The primary reason is that calver was not helping
integrators to track major version changes like semver does.

We also have introduced a new JSON output format version based on semver to
version the JSON output format data structure and have documented the new
versioning approach.

Here are the key changes for each area:

Package detection:

  • The Debian packages declared license detection in machine readable copyright
    files and unstructured copyright has been significantly improved with the
    tracking of the detection start and end line of a license match. This is not
    yet exposed outside of tests but has been essential to help improve detection.

  • Debian copyright license detection has been significantly improved with new
    license detection rules.

  • Support for Windows packages has been improved (and in particular the handling
    of Windows packages detection in the Windows registry).

  • Support for Cocoapod packages has been significantly revamped and is now
    working as expected.

  • Support for PyPI packages has been refined, in particular package descriptions.

Copyright detection:

  • The copyright detection accuracy has been improved and several bugs have been
    fixed.

License detection:

There have been some significant updates in license detection. We now track
34,164 license and license notices:

  • 84 new licenses have been added,

  • 34 existing license metadata have been updated,

  • 2765 new license detection rules have been added, and

  • 2041 existing license rules have been updated.

  • Several license detection bugs have fixed.

  • The SPDX license list 3.14 is now supported and has been synced with the
    licensedb. We also include the version of the SPDX license list in the
    ScanCode YAML, JSON and the SPDX outputs, as well as display it with the
    "--version" command line option.

  • Unknown licenses have a new flag "is_unknown" in their metadata to identify
    them explicitly. Before that we were just relying on the naming convention of
    having "unknown" as part of a license key.

  • Rules that match at least one unknown license have a flag "has_unknown" set
    and returned in the match results.

  • Experimental: License detection can now "follow" license mentions that
    reference another file such as "see license in COPYING" where we can relate
    this mention to the actual license detected in the COPYING file. Use the new
    "--unknown-licenses" command line option to test this new feature.
    This feature will evolve significantly in the next version(s).

Outputs:

  • The SPDX output now has the mandatory ids attribute per SPDX spec. And we
    support SPDX 2.2 and SPDX license list 3.14.

Miscellaneous

  • There is a new "--no-check-version" CLI option to scancode to bypass live,
    remote outdated version check on PyPI

  • The scan results and the CLI now display an outdated version warning when
    the installed ScanCode version is older than 90 days. This is to warn users
    that they are relying on outdated, likely buggy, insecure and inaccurate scan
    results and encourage them to update to a newer version. This is made entirely
    locally based on date comparisons.

  • We now display again the command line progressbar counters correctly.

  • A bug has been fixed in summarization.

  • Generated code detection has been improved with several new keywords.

Thank you!

Many thanks to the many contributors that made this release possible and in
particular:

What's Changed

New Contributors

Full Changelog: v21.8.4...v30.0.0

Contributors

heckj, sschuberth, and 32 other contributors
Assets 15
Loading