LicenseFinder

I have good experience with https://github.com/pivotal/LicenseFinder This produces BOM with versions but rather than out of date it focuses on licenses which comes handy during acquisitions due diligence. Supports many languages

Listing the benefits over tools like dependabot and LicenseFinder [1] would help. What does the AI actually do? Summarize dependency changelogs? One of my projects [2] wraps LicenceFinder in a GitHub action (Ruby only until I merge a pending PR). [1] https://github.com/pivotal/LicenseFinder [2] https://github.com/ralexander-phi/license_approval

Agreed. I found this project helpful for automating dependency checks: https://github.com/pivotal/LicenseFinder I actually played around with turning it into a GitHub action for further usability improvement, although it needs more work: https://github.com/ralexander-phi/license_approval

Interesting, GitHub recently released a similar tool in Ruby [0], and GitLab uses license_finder [1]. [0] https://github.com/github/licensed [1] https://github.com/pivotal/LicenseFinder

Pivotal Labs have a similar problem -- ensuring that only whitelisted licenses are represented in a codebase -- and developed License Finder for this kind of auditing: https://github.com/pivotal/LicenseFinder We also use it for Cloud Foundry. It's fairly robust. I work for Pivotal, but not on LF.

Another great tool to help with this process is Pivotal Labs' LicenseFinder: https://github.com/pivotal/LicenseFinder Disclosure: I work there

It honestly would not be that difficult to implement something like this. Both the OSI and FSF maintain lists of "approved" licenses along with standard license text. In fact, Pivotal Labs has created a tool along these lines for Ruby: https://github.com/pivotal/LicenseFinder , and the Leiningen project tool from Clojure allows for licenses to be specified in a machine parseable format: https://github.com/technomancy/leiningen/blob/master/sample.... .