License Lantern
Review local dependency-license inventories with SPDX and attribution drafts, validating npm lockfile v2/v3 structures before producing output.
The problem it solves
License Lantern License Lantern builds a reviewable dependency-license inventory, SPDX 2.3 draft, and third-party attribution draft from local project files.
Who License Lantern is for
- Developers and maintainers who need reviewable evidence before changing or releasing software.
- Users working with licenses, SPDX, SBOM who want the documented v1.1.1 behavior.
- People who prefer an open-source release with visible limitations, source, and license terms.
Intended result
Review local dependency-license inventories with SPDX and attribution drafts, validating npm lockfile v2/v3 structures before producing output.
This summary is reconciled from the current catalog and repository documentation.
Features in v1.1.1
Capabilities below come from the current project README and release documentation.
License Lantern builds a reviewable dependency-license inventory, SPDX 2.3 draft, and third-party attribution draft from local project files.
Version 1 reads npm package-lock.json, Python pyproject.toml, requirements files, and CycloneDX JSON. It preserves unresolved licenses as NOASSERTION instead of guessing and can fail CI when human review remains.
Verified examples
Screenshots are shown only when the current README references a local source image. Otherwise, repository example files are linked directly.
Verified release evidence
This project does not currently publish a screenshot or dedicated example folder. The current README, tests, changelog, tagged release, and source repository remain the verified examples of its behavior.
Platforms and implementation
The public release claims only the cataloged platforms and technologies.
Supported platforms
- Windows
- macOS
- Linux
Built with
- Python
- SPDX
- CycloneDX
Changelog
Release notes from the canonical v1.1.1 source tag.
npm package-lock.json inputs must declare integer lockfileVersion 2 or 3 and an object-valued packages map. Empty maps and root-only maps are valid empty inventories. Every package entry must be an object, with non-empty text name/version fields when present. Unsupported versions and malformed structures fail before inventory, SPDX or NOTICE output. Alias identities, reviewer overrides, unresolved declarations and deterministic inventory hashes retain their existing meaning.
- Parse SPDX expressions, include nested CycloneDX components and declared npm alias identities, and add sourced attribution overrides with deterministic inventory diffs.
- Added regression coverage for the audited behavior and invalid inputs.
- Added local npm, Python, and CycloneDX dependency inventory readers.
- Added unresolved-license review evidence and deterministic inventory fingerprints.
- Added SPDX 2.3 and third-party attribution drafts without legal compatibility claims.
Quick start
The shortest documented path into the current release.
Before running these source commands, download the v1.1.1 source archive, extract it, and open a terminal in the extracted project folder containing README.md. Follow the tagged README for required runtimes and any platform-specific setup.
python -m pip install .
license-lantern package-lock.json --inventory licenses.json --spdx sbom.spdx.json --notice THIRD-PARTY.txt
license-lantern requirements.txt --fail-unresolvedCurrent limitations
These boundaries are part of the product and prevent the page from implying unverified capability.
- Output is an evidence draft, not legal advice, a compatibility ruling, or proof that an upstream declaration is correct.
- Lockfiles often omit license text and copyright notices; those must be verified and added before distribution.
- Python requirement specifications normally lack license metadata and remain unresolved without a supplied SBOM.
- No package registry, network service, vulnerability database, telemetry, or source-code scanner is used.
- Input files are read-only and outputs cannot replace them.
Python 3.11+ on Windows, macOS, and Linux. Current release: v1.1.1. Pull requests are reviewed. MIT licensed.
Privacy and licensing
Review the actual data boundary before using a tool with sensitive inputs.
Privacy and safety
No privacy behavior beyond the current repository documentation is claimed. Review the source, security policy, and input/output behavior before using sensitive material.
License and release
License Lantern is published under MIT. The current cataloged release is v1.1.1, published 2026-10-16.
Related projects
Related projects are selected deterministically from shared catalog tags, category, and implementation technologies—not popularity or paid placement.
License Lantern v1.1.1
Use the tagged release for downloads and release notes. Use the repository for source, issues, contribution guidance, security reporting, and complete documentation.
Page source: current Forge catalog plus README and CHANGELOG from the canonical GitHub release tag. Fingerprint: 9a28d29aeace018b.