Weave Code
Spdx Licenses Laravel Package
composer/spdx-licenses
Standalone PHP library for SPDX license data and validation. Look up licenses and exceptions by identifier or name, check OSI approval and deprecation status, and validate SPDX license expressions. Lightweight and dependency-free, originally extracted from Composer. Requires PHP 5.3.2+.
Tools for working with the SPDX license list and validating licenses.
Frequently asked questions about Spdx Licenses
- How do I install composer/spdx-licenses in a Laravel application?
- Run composer require composer/spdx-licenses in the same project as your Laravel app. The package is a standalone PHP library, so no Laravel service provider is required. For convenience, bind Composer\Spdx\SpdxLicenses as a singleton in a service provider if you inject it into rules or commands.
- Does composer/spdx-licenses support Laravel 10 and Laravel 11?
- It has no Laravel-specific integration or framework version constraint, so it can be used with Laravel 10, Laravel 11, and other modern releases. Compatibility is driven by PHP: current package releases require PHP 7.2 or newer, while your Laravel version imposes its own PHP floor. Check the package version constraints before pinning in an older application.
- How do I validate SPDX license expressions in a Laravel FormRequest?
- Create a custom validation Rule that calls SpdxLicenses::validate() on the input and returns a failure message when it is false. Resolve SpdxLicenses through the container or instantiate it directly, then attach the rule to the relevant field in your FormRequest rules. Keep in mind that validate() returns only a boolean, not a parsed expression tree.
- What is the difference between SPDX expression validation and license compatibility checking?
- composer/spdx-licenses validates syntax and whether identifiers exist in the SPDX list, including expressions such as MIT OR Apache-2.0. It does not determine whether licenses are compatible with each other or with your distribution model. Questions like whether GPL code can be used in a proprietary SaaS module require legal and policy logic outside this package.
- How can I check OSI approval and deprecation status for an SPDX license?
- Use isOsiApprovedByIdentifier() to check OSI approval and isDeprecatedByIdentifier() to check whether an identifier is deprecated. Both methods take the SPDX identifier string, such as MIT. This is useful for warning on legacy or non-OSI dependencies in CI or procurement workflows.
- How should I validate SPDX license exceptions and WITH expressions?
- Pass the full expression, such as GPL-2.0-or-later WITH Classpath-exception-2.0, to validate() so the WITH clause is checked as part of the expression. Use getExceptionByIdentifier() when you need metadata for a specific exception identifier. Avoid naive substring checks, because WITH exceptions only make sense when paired with a license.
- Can composer/spdx-licenses scan composer.lock for license problems?
- The package does not scan files or read composer.lock by itself; it provides lookup and validation primitives. You can write an Artisan command that reads composer.lock, extracts package license metadata, and calls methods like isDeprecatedByIdentifier() or isOsiApprovedByIdentifier(). Treat that command as your own policy layer, including how to handle missing or compound license data.
- Is composer/spdx-licenses safe to use in production?
- Yes, it is a small, dependency-free library with no I/O or service dependencies, so runtime risk is low. The production concerns are semantic and operational: validate() does not assess license compatibility, and the bundled SPDX data can become stale. Pin a version, own the upgrade cadence, and test the expressions your application actually receives.
- How often is the SPDX license data updated, and how do I avoid stale identifiers?
- The package ships a bundled snapshot of the SPDX license list, so the data updates when you upgrade composer/spdx-licenses. The list changes over time, and a pinned old release can reject newly added identifiers or accept deprecated ones. Add an upgrade task to your maintenance schedule and keep a test corpus of real license expressions.
- What alternatives exist to composer/spdx-licenses for Laravel projects?
- Because this package is extracted from Composer, many Laravel projects effectively already carry the same license data through Composer itself. Alternatives include consuming the official SPDX license-list-data directly or using broader SBOM and compliance tooling if you need policy enforcement. For simple identifier lookup and expression validation, composer/spdx-licenses is the focused, dependency-free option.
Weaver
How can I help you explore Laravel packages today?