v2.0.2

Release v2.0.2

A bug-fix release for SBOM generation. Upgrade if you use lcc sbom generate.

Fixed

• SBOMs were empty in 2.0.1. lcc sbom generate did not understand the report written by lcc scan --format json. It printed "SBOM generated successfully" and wrote a CycloneDX or SPDX SBOM with no components. It now reads that report, so every scanned component appears with its licence.
• No more silent empty SBOMs. If the input file is not an LCC scan report, lcc sbom generate now stops with a clear error.
• Correct tool version. SBOMs record the installed LCC version as the generating tool (2.0.1 wrote 0.1.0).
• Project details are kept. --project-name and --project-version were accepted but ignored. CycloneDX SBOMs now include them as the root component, with the scanned components as its dependencies.

Documentation

• Quick Start step 2 now saves scan-report.json, which step 4 (lcc sbom generate) reads.

Upgrade

pip install --upgrade license-compliance-checker==2.0.2
lcc scan . --format json --output scan-report.json
lcc sbom generate scan-report.json --format cyclonedx --output sbom.json

Full changes: #55

v2.0.1

Release v2.0.1

🚀 What's Changed

Quality & Type Safety

• Hard-Gated CI Type Checking: Removed continue-on-error: true from the mypy step in CI. Resolved all 142 typing errors across 36 files, achieving 0 type errors across all 99 source files.
• Python 3.13 Support: Expanded CI test matrix to run unit test suites against Python 3.11, 3.12, and 3.13.
• GitHub Actions Normalization: Normalized all workflow actions (publish-pypi.yml, docs.yml, ci.yml, test-pypi.yml, lcc-scan.yml) to official LTS releases (actions/checkout@v4, actions/setup-python@v5, etc.).

Documentation & Supply Chain Clarity

• Live MkDocs Portal: Surfaced and directly linked the live Material for MkDocs documentation portal at https://aiexponent.github.io/license-compliance-checker/ in README.md and pyproject.toml packaging metadata.
• Export Formats Reference Matrix: Documented all 8 supported export formats (JSON, Markdown, HTML, CSV, Attribution, CycloneDX JSON, SPDX JSON, Compliance Pack) with command examples and regulatory mappings.
• Clarified Capabilities: Removed phantom SARIF capability claims and added explicit non-support callouts.
• Organization Links: Updated repository and project links to point to aiexponent.

Bug Fixes & Improvements

• Policy Testing: Fixed latent runtime generator chaining bug (itertools.chain instead of bitwise |).
• Queue Worker: Added missing Job import for background scan queue processing.
• SPDX Serialization: Replaced missing writer call with standard in-memory stream buffer.
• Filesystem Resolver: Improved license detection to prioritize primary license over arbitrary keywords.
• Deployment Hardening: Clearly labeled Kubernetes example secret templates.

📦 Distribution Artifacts

• license_compliance_checker-2.0.1-py3-none-any.whl
• license_compliance_checker-2.0.1.tar.gz

v2.0.0

This release bundles a seven-phase release-readiness cleanup. It is a major version because several changes are breaking (see below). Install with pip install license-compliance-checker for the scanner core, or license-compliance-checker[all] for the API, database, and AI features.

Breaking changes

• The default install is the scanner core only. The REST API, database, and job
  queue move to the server extra and the AI provider to the ai extra. Install
  license-compliance-checker[all] for the full stack.
• lcc server binds to 127.0.0.1 by default. Pass --host 0.0.0.0 to expose it
  on all interfaces.
• The scan API rejects an arbitrary local filesystem path by default. Provide a
  GitHub repo_url, or set LCC_API_ALLOW_LOCAL_PATH to opt in.

Added

• lcc assess and lcc compliance-pack commands for EU AI Act Article 53.
• AI model license resolution from model-card metadata, with restrictive licenses
  (Llama, Gemma, OpenRAIL) surfaced rather than passed silently.
• A pip-audit dependency-vulnerability gate in CI.
• .pre-commit-hooks.yaml so the scanner can run as a pre-commit hook.

Changed

• The REST API compliance-pack download returns the same four-file pack as the
  CLI: report JSON, report HTML, training-data summary, and copyright template.
• CI enforces the test suite; a failing test now fails the build.

Fixed

• The lcc sbom subcommands and lcc report generate crashed on invocation and
  now run. The SBOM validator and generators work against cyclonedx v11 and
  spdx-tools 0.8.
• Offline mode no longer calls the HuggingFace Hub API.
• A stale or invalid active policy no longer aborts a scan.
• README command examples and capability claims were corrected: SBOM input is a
  positional argument, there is no SARIF output, and the AI license list and
  assessment scope now match the code.

Security

• Removed the fixed default admin credential. The initial admin password comes
  from LCC_ADMIN_PASSWORD, or is generated and logged once.
• JWT tokens are validated by type, so a refresh token cannot authenticate a
  request that expects an access token.
• Repository clone URLs are validated, blocking non-http(s) transports and
  command-line option injection.
• Raised security floors for gitpython, python-multipart, starlette, urllib3,
  idna, cryptography, mako, click, and pyjwt.

v1.1.0 — Security hardening + Agentic AI era capabilities

What's new in v1.1.0

Security (5 blockers fixed)

• POST /scans rate limited to 10/minute — was unprotected
• CORS default changed from * to "" — must be explicitly configured
• /admin/reset now only deletes LCC-scoped Redis keys (scan:*, lcc:*), not flushdb()
• Worker path containment: validates scan path stays within LCC_WORKSPACE or /tmp
• Confirmed git history clean — no secrets ever committed

Code quality

• datetime.utcnow() → datetime.now(UTC) (Python 3.12 deprecation fix)
• warnings_count now computed via WarningAnalyzer — was always 0 before
• /scans/{id}/warnings returns real analysis instead of empty stub
• Performance tests: fixed Scanner(detectors, resolvers, config) constructor signature
• Integration tests: removed 500 from acceptable status codes

Agentic AI era (4 new capabilities)

• HuggingFace Hub API resolver — scans Python/YAML/JSON files for from_pretrained("org/model") and similar references; fetches license from HF API without requiring local download
• GGUF/ONNX detection — detects Ollama (.gguf) and ONNX (.onnx) model formats; infers model family from filename
• Dataset risk registry — 15 datasets classified; OpenAI API outputs, ChatGPT, ShareGPT, Books3 flagged as high/critical risk
• Honest Article 53 framing — scope note added to all assessments clarifying this is audit evidence, not full legal compliance

CLI

• --include-transitive flag added with lock file validation

Tests

393 passing (was 228 before this release)

Release v1.0.0: Initial Release

License Compliance Checker (LCC) is now officially released! This enterprise-grade tool helps organizations manage open-source license compliance with ease.

Key Features
🛡️ Automated Policy Enforcement: Define and enforce license policies (e.g., Ban GPL-3.0 in proprietary projects).
📦 Recursive Dependency Scanning: Automatically detects manifests (
package.json
, requirements.txt, pom.xml, etc.) deep within your project structure.
🤖 AI-Powered Analysis: specialized LLM integration (using Fireworks AI) for analyzing unknown or custom license texts.
📊 Comprehensive Reporting: Generate reports in JSON, Markdown, HTML, and CSV formats.
🐳 Docker Ready: Full microservices architecture (API, Worker, Dashboard, Redis, Postgres) ready for deployment.
🔌 CI/CD Integration: Seamlessly integrates with GitHub Actions for automated compliance checks.
Installation
You can install LCC directly from source or via the built artifacts:

pip install license-compliance-checker
Or using Docker:

docker-compose -f docker-compose.prod.yml up -d
Changelog
Initial public release.
Added recursive directory scanning.
Integrated Fireworks AI for license text classification.
Polished documentation and architecture diagrams.
Fixed identified bugs in scanning and UI.
Artifacts
Find the wheel and source distribution attached to this release.