usePackageJsonValidLicense (JSON)

Language JSON (and super languages)

Summary

Rule available since: v2.6.8
Diagnostic Category: lint/nursery/usePackageJsonValidLicense
This rule doesn’t have a fix.
The default severity of this rule is warning.
Sources:
- Same as package-json/valid-license

How to configure

1
{
2
  "linter": {
3
    "rules": {
4
      "nursery": {
5
        "usePackageJsonValidLicense": "error"
6
      }
7
    }
8
  }
9
}

Description

Require the license field in package.json to be a valid license.

The license field tells people how they’re allowed to use, change, and share a package. Package registries, such as the npm registry, and license checking tools read this field. They only understand a license that is written in a standard way. A misspelled or made-up name, such as GPL3 or Apache 2.0, leaves the terms of the package unclear.

This rule checks the license field of the outermost object in a package.json file. The field is also checked when it’s spelled licence. The rule reports the field when its value isn’t a string, when the string is empty, and when the string isn’t one of the following:

An identifier from the SPDX license list, such as MIT or Apache-2.0. SPDX is a standard that gives each common license a short, unique name. Identifiers are case-sensitive, so mit isn’t accepted.
An identifier followed by +, such as LGPL-2.1+, which means “this version of the license or any later version”.
Several identifiers combined with AND, OR, and parentheses, such as (MIT OR Apache-2.0). An identifier can also be followed by WITH and the name of an exception to the license, such as GPL-2.0-only WITH Classpath-exception-2.0. The rule doesn’t check the name of the exception.
UNLICENSED, which means that the package isn’t licensed for use by others.
SEE LICENSE IN followed by the name of a file, such as SEE LICENSE IN LICENSE.md, for a license that isn’t on the SPDX list. The rule doesn’t check that the file exists.

The rule doesn’t report a package.json file that has no license field.

Examples

Invalid

The value must be the SPDX identifier of the license:

1
{
2
    "license": "GPL3"
3
}

/package.json:2:16 lint/nursery/usePackageJsonValidLicense ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━

  ⚠ The value of the license field isn't a valid license.
  
    1 │ {
  > 2 │     "license": "GPL3"
      │                ^^^^^^
    3 │ }
    4 │ 
  
  ℹ Package registries and license checking tools read this field to tell people how they're allowed to use the package. They only understand a license that is written in a standard way.
  
  ℹ Replace the value with the SPDX identifier of the license, for example MIT. You can find the identifier of your license at https://spdx.org/licenses/. If the license isn't on that list, use SEE LICENSE IN followed by the name of the file that contains it. If others aren't allowed to use the package, use UNLICENSED.
  
  ℹ This rule belongs to the nursery group, which means it is not yet stable and may change in the future. Visit https://biomejs.dev/linter/#nursery for more information.

The value must be a string:

1
{
2
    "license": { "type": "MIT" }
3
}

/package.json:2:16 lint/nursery/usePackageJsonValidLicense ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━

  ⚠ The value of the license field isn't a string.
  
    1 │ {
  > 2 │     "license": { "type": "MIT" }
      │                ^^^^^^^^^^^^^^^^^
    3 │ }
    4 │ 
  
  ℹ Package registries and license checking tools read this field to tell people how they're allowed to use the package. They only understand a license that is written in a standard way.
  
  ℹ Write the license as a string that contains its SPDX identifier, for example "MIT". You can find the identifier of your license at https://spdx.org/licenses/.
  
  ℹ This rule belongs to the nursery group, which means it is not yet stable and may change in the future. Visit https://biomejs.dev/linter/#nursery for more information.

The value can’t be empty or contain only spaces:

1
{
2
    "license": ""
3
}

/package.json:2:16 lint/nursery/usePackageJsonValidLicense ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━

  ⚠ The value of the license field is empty or contains only spaces.
  
    1 │ {
  > 2 │     "license": ""
      │                ^^
    3 │ }
    4 │ 
  
  ℹ Package registries and license checking tools read this field to tell people how they're allowed to use the package. They only understand a license that is written in a standard way.
  
  ℹ Write the license as a string that contains its SPDX identifier, for example "MIT". You can find the identifier of your license at https://spdx.org/licenses/.
  
  ℹ This rule belongs to the nursery group, which means it is not yet stable and may change in the future. Visit https://biomejs.dev/linter/#nursery for more information.

Valid

1
{
2
    "license": "GPL-3.0-only"
3
}