Skip to content

Fix #915: handle UNLICENSED in NuGet license expressions#1004

Open
jainlakshya wants to merge 1 commit intoCycloneDX:masterfrom
jainlakshya:fix-unlicensed-license-expression
Open

Fix #915: handle UNLICENSED in NuGet license expressions#1004
jainlakshya wants to merge 1 commit intoCycloneDX:masterfrom
jainlakshya:fix-unlicensed-license-expression

Conversation

@jainlakshya
Copy link
Copy Markdown

Fixes #915

NuGet license expressions can legally include the "UNLICENSED" token. Today, when a package uses that token, cyclonedx-dotnet emits it as a CycloneDX "license.id", which results in invalid output because "UNLICENSED" is not an SPDX license identifier.

Changes:

  • When parsing "LicenseType.Expression", map "UNLICENSED" (case-insensitive) to "license.name" instead of "license.id".
  • Added a unit test covering the "UNLICENSED" license-expression behavior.

Notes:

  • No behavior change for valid SPDX identifiers (e.g., Apache-2.0, MPL-2.0).
  • Keeps output valid while still preserving the package’s intent.

Verification:

  • dotnet test -c Release
  • dotnet format --verify-no-changes --include CycloneDX/Services/NugetV3Service.cs CycloneDX.Tests/NugetV3ServiceTests.cs

@jainlakshya jainlakshya requested a review from a team as a code owner January 16, 2026 23:42
Signed-off-by: Lakshya Jain <lakshyajain1995@gmail.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Nuget UNLICENSED License Expression Produces Invalid File

1 participant