[dependabot]

Bumps github.com/github/go-spdx/v2 from 2.7.1 to 2.8.0.

Release notes

Sourced from github.com/github/go-spdx/v2's releases.

Release v2.8.0

Overview

This release makes two changes:

• adds a function that returns the version of the SPDX License List used to generate the license data
• automatically generates license ranges as part of the license extraction process

Required Actions for Upgrading

None.

Details

SPDX License List version

A new function, spdxlicenses.LicenseListVersion, returns the version of the SPDX License List used to generate the license IDs, deprecated license IDs, exceptions, and license ranges included in this release.

import "github.com/github/go-spdx/v2/spdxexp/spdxlicenses"
version := spdxlicenses.LicenseListVersion()

For this release, LicenseListVersion returns "3.29.0".

Automatic license range generation

License ranges are now generated from the SPDX License List as part of the license extraction process run by the scheduled workflow. Previously, licenses, exceptions, and deprecations were updated automatically while license ranges were maintained manually.

A license range family is generated when at least two license IDs share a family name and end with a version number. Manually maintained inclusion and exclusion lists handle families that do not follow that pattern or IDs whose trailing number is not a version.

The generated data adds previously unrecognized version families, including bzip2, CDLA-Permissive, CERN-OHL, MulanPSL, NLOD, and OGL-UK. As a result, Satisfies can evaluate later-version relationships for more SPDX license families. Existing special cases remain explicitly included where needed for compatibility.

The generated pull request body now summarizes license and license range changes to support human review of newly identified range families.

What's Changed

• auto-generate license ranges as part of the extract process run by cron (#170) @​elrayle

Full Changelog: v2.7.1...v2.8.0

Contributors

@​elrayle

Commits

• bc34fa1 Merge pull request #171 from github/elr/release
• 1efd392 release 2.8.0
• 2e9375e Merge pull request #170 from github/elr/range-automation
• 1b424ba add function to return SPDX License List Version
• 0b0df83 avoid lint error
• 9d74d16 improve readability of TestBuildLicenseRangeFamilies making rules explicit
• b4ba926 add a golden file test to ensure the end-to-end generation process is correct
• c3ede39 fmt fix
• df183f4 remove licenses with versions from the range exclusion list
• 9e8cbd3 ignore nosec lint errors
• Additional commits viewable in compare view

[markusthoemmes]

@dependabot rebase