noUntrustedLicenses

JSON (and super languages)

Summary

Rule available since: v2.4.9
Diagnostic Category: lint/nursery/noUntrustedLicenses
This rule doesn’t have a fix.
The default severity of this rule is warning.
This rule belongs to the following domains:
- project

How to configure

1
{
2
  "linter": {
3
    "rules": {
4
      "nursery": {
5
        "noUntrustedLicenses": "error"
6
      }
7
    }
8
  }
9
}

Description

Disallow dependencies with untrusted licenses.

When you install a dependency, it comes with a license that defines how you can use it. Some licenses may not be compatible with your project’s requirements. For example, a proprietary project may not be allowed to use copyleft-licensed dependencies, or your organization may require all dependencies to use OSI-approved licenses.

This rule reads the license field from each dependency’s package.json inside node_modules and checks it against the SPDX license list. It supports compound expressions like MIT OR Apache-2.0.

By default, the rule flags dependencies that:

Have no license field.
Have a license that is not a valid SPDX identifier.
Have a license deprecated in the SPDX standard.

Examples

Invalid

A dependency whose package.json has "license": "my-custom-license" is flagged because the identifier is not part of the SPDX standard:

1
{
2
    "dependencies": {
3
        "untrusted-pkg": "^1.0.0"
4
    }
5
}

A dependency whose package.json has no license field at all is also flagged:

1
{
2
    "devDependencies": {
3
        "no-license-pkg": "^1.0.0"
4
    }
5
}

Valid

A dependency whose package.json has "license": "MIT" passes because MIT is a valid, non-deprecated SPDX identifier:

1
{
2
    "dependencies": {
3
        "trusted-pkg": "^1.0.0"
4
    }
5
}

Options

`allow`

A list of extra license identifiers to accept, even if they are not part of the SPDX standard. This is useful for custom or proprietary licenses used inside your organization.

Default: []

1
{
2
  "linter": {
3
    "rules": {
4
      "nursery": {
5
        "noUntrustedLicenses": {
6
          "options": {
7
            "allow": [
8
              "LicenseRef-Company",
9
              "my-org-license"
10
            ]
11
          }
12
        }
13
      }
14
    }
15
  }
16
}

`deny`

A list of license identifiers to explicitly reject, even if they are valid SPDX identifiers. This lets you block specific licenses that your project cannot use, for example, copyleft licenses in a proprietary codebase.

Deny always takes precedence over allow and SPDX validity.

Default: []

1
{
2
  "linter": {
3
    "rules": {
4
      "nursery": {
5
        "noUntrustedLicenses": {
6
          "options": {
7
            "deny": [
8
              "GPL-3.0-only",
9
              "AGPL-3.0-only"
10
            ]
11
          }
12
        }
13
      }
14
    }
15
  }
16
}

`requireOsiApproved`

When enabled, only licenses that have been approved by the Open Source Initiative are accepted. Licenses in the allow list bypass this check.

Default: false

1
{
2
  "linter": {
3
    "rules": {
4
      "nursery": {
5
        "noUntrustedLicenses": {
6
          "options": {
7
            "requireOsiApproved": true
8
          }
9
        }
10
      }
11
    }
12
  }
13
}

`requireFsfLibre`

When enabled, only licenses that are recognized as free/libre by the Free Software Foundation are accepted. Licenses in the allow list bypass this check.

Default: false

1
{
2
  "linter": {
3
    "rules": {
4
      "nursery": {
5
        "noUntrustedLicenses": {
6
          "options": {
7
            "requireFsfLibre": true
8
          }
9
        }
10
      }
11
    }
12
  }
13
}

`ignoreDeprecated`

When enabled, deprecated SPDX license identifiers are accepted without being flagged. By default, deprecated identifiers such as GPL-2.0 (which should be GPL-2.0-only or GPL-2.0-or-later) produce a diagnostic.

Default: false

1
{
2
  "linter": {
3
    "rules": {
4
      "nursery": {
5
        "noUntrustedLicenses": {
6
          "options": {
7
            "ignoreDeprecated": true
8
          }
9
        }
10
      }
11
    }
12
  }
13
}

noUntrustedLicenses

Summary

How to configure

Description

Examples

Invalid

Valid

Options

allow

deny

requireOsiApproved

requireFsfLibre

ignoreDeprecated

Related links

`allow`

`deny`

`requireOsiApproved`

`requireFsfLibre`

`ignoreDeprecated`