[dependabot]

Bumps github.com/github/go-spdx/v2 from 2.7.1 to 2.8.0.

Release notes

Sourced from github.com/github/go-spdx/v2's releases.

Release v2.8.0

Overview

This release makes two changes:

• adds a function that returns the version of the SPDX License List used to generate the license data
• automatically generates license ranges as part of the license extraction process

Required Actions for Upgrading

None.

Details

SPDX License List version

A new function, spdxlicenses.LicenseListVersion, returns the version of the SPDX License List used to generate the license IDs, deprecated license IDs, exceptions, and license ranges included in this release.

import "github.com/github/go-spdx/v2/spdxexp/spdxlicenses"
version := spdxlicenses.LicenseListVersion()

For this release, LicenseListVersion returns "3.29.0".

Automatic license range generation

License ranges are now generated from the SPDX License List as part of the license extraction process run by the scheduled workflow. Previously, licenses, exceptions, and deprecations were updated automatically while license ranges were maintained manually.

A license range family is generated when at least two license IDs share a family name and end with a version number. Manually maintained inclusion and exclusion lists handle families that do not follow that pattern or IDs whose trailing number is not a version.

The generated data adds previously unrecognized version families, including bzip2, CDLA-Permissive, CERN-OHL, MulanPSL, NLOD, and OGL-UK. As a result, Satisfies can evaluate later-version relationships for more SPDX license families. Existing special cases remain explicitly included where needed for compatibility.

The generated pull request body now summarizes license and license range changes to support human review of newly identified range families.

What's Changed

• auto-generate license ranges as part of the extract process run by cron (#170) @​elrayle

Full Changelog: v2.7.1...v2.8.0

Contributors

@​elrayle

Commits

• bc34fa1 Merge pull request #171 from github/elr/release
• 1efd392 release 2.8.0
• 2e9375e Merge pull request #170 from github/elr/range-automation
• 1b424ba add function to return SPDX License List Version
• 0b0df83 avoid lint error
• 9d74d16 improve readability of TestBuildLicenseRangeFamilies making rules explicit
• b4ba926 add a golden file test to ensure the end-to-end generation process is correct
• c3ede39 fmt fix
• df183f4 remove licenses with versions from the range exclusion list
• 9e8cbd3 ignore nosec lint errors
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)