Scancode-toolkit

Latest version: v32.1.0

Safety actively analyzes 628903 Python packages for vulnerabilities to keep your Python projects secure.

Scan your dependencies

Page 8 of 12

2.9.7

Not secure
-------------------

No changes.

2.9.6

-------------------

- Add declared license normalization 1092
- Add new and improved license rules
- Add mising and clean up ABOUT files for all embedded third-party libraries
- Improve npm package.json handling (better keuword support)
- Update thirdparty libraries 1224

Credits: Many thanks to everyone that contributed to this release with code and bug reports

2.9.5

Not secure
-------------------

This is a minor pre-release of what will come up for 3.0 with no API change.

- Place all third-party packages under thirdparty 1219

Credits: Many thanks to everyone that contributed to this release with code and bug reports

- JonoYang

2.9.4

Not secure
-------------------

This is a pre-release of what will come up for 3.0 with several API changes
related to packages.

- Add Package URL field to top-level package output 1149
- --package option should collect homepage URL for packages 645
- Support installation from Pypi and update various third-parties to their
latest version 1183
- Fix bug where multiple outputs with --html would crash scancode
- Add new and improved licenses and license detection rules 1192 1186
- Ensure that plugin failure trigger a proper error exit code 1199
- Allow plugins to contribute codebase-level attributes in addition to
resource-level attributes.
- Output plugins can now be called from code 1148
- Fix incorrect copyright detection 1198
- Detect programming language more strictly and efficiently 1194
- Use simpler list of source package URLs/purls 1206
- Add purl to the packages data 1149
- Use direct attributes for package checksums 1189
- Remove package_manifest attribute for packages
- Add new Package "manifest_path" attribute which is a relative path to
the manifest file if any, such as a Maven .pom or a npm package.json.

Credits: Many thanks to everyone that contributed to this release with code and bug reports

- MartinPetkov
- majurg
- JonoYang

2.9.3

Not secure
-------------------

This is a pre-release of what will come up for 3.0 with an API change.

API change:
- The returned copyright data structure has changed and is now simpler and less nested

Licenses:
- Add new license and rules and improve licene rules 1186 1108 1124 1171 1173 1039 1098 1111
- Add new license clarity scoring 1180
This is also for use in the ClearlyDefined project
- Add is_exception to license scan results 1159

Copyrights:
- Copyright detection has been improved 930 965 1103
- Copyright data structure has been updated

Packages:
- Add support for FreeBSD packages (ports) 1073
- Add support for package root detection
- Detect nuget packages correctly 1088

Misc:

- Add facet, classification and summarizer plugins 357
- Fix file counts 1055
- Fix corrupted license cache error
- Upgrade all thridparty libraries 1070
- De-vendor prebuilt binaries to ease packaging for Linux distros 469

Credits: Many thanks to everyone that contributed to this release with code and bug reports

- selmf
- paralax
- majurg
- mueller-ma
- MartinPetkov
- techytushar

2.9.2

Not secure
-------------------
This is a major pre-release of what will come up for 3.0. with significant
packages and license API changes.

API changes:
- Simplify output option names 789
- Update the packages data structure and introduce Package URLs 275
- Add support for license expressions 74 with full exceptions support

Licenses:
- Add support for license expressions 74 with full exceptions support
- Enable SPDX license identifier match 81
- Update and change handling of composite licenses now that we support expressions
- Symchronize licenses with latest from SPDX and DejaCode 41
- Add new licenses ofr odds and ends: other-permissive and other-copyleft
- refine license index cache handling
- remove tests without value
- Add new license policy plugin 214, 880

Packages:
- Split packages from package_manifest 1027. This is experimental
The packages scan return now a single package_manifest key (not a list)
And a post_scan plugin (responding to the same --package) option perform
a roll-up of the manifest informationat the proper level for a package
type as the "packages" attribute (which is still a list). For instance
a package.json "package_manifest" will end up having a "packages" entry
in its parent directory.
- Include and return Package URLs (purl) 805 and 275
- Major rework of the package data structure 275
- Rename asserted_license to declared_licensing 275
- Add basic Godeps parsing support 275
- Add basic gemspec and Rubygems parsing support 275
- Add basic Gemfile.lock parsing support 275
- Add basic Win DLL parsing support 275
- Replace MD5/SHA1 by a list of checksums 275
- Use a single download_url, not a list 275
- Add namespace to npm. Compute defaults URL 275

Misc:
- multiple minor bug fixes
- do not ignore .repo files 881

Credits: Many thanks to everyone that contributed to this release with code and bug reports

- JonoYang
- majurg
- pombredanne
- yash-nisar
- ThorstenHarter

Page 8 of 12

© 2024 Safety CLI Cybersecurity Inc. All Rights Reserved.