v0.5.0

licenseid update now works where only raw.githubusercontent.com is reachable, such as locked-down sandboxes and CI runners, and even with no network at all.

• Three sources. update --source auto|compact|upstream|packaged picks where the SPDX License List comes from. auto (the default) tries them in turn.
  • compact: our 1 MB bundle (JSON and licence texts, no XML), published on this repository's data branch.
  • upstream: SPDX's own release tarball from https://github.com/spdx/license-list-data/releases (about 50 MB).
  • packaged: the bundle shipped inside the wheel and the sdist, of the SPDX release that was newest when the package was built.
• Works offline. A first update succeeds with no network, using the packaged bundle, whose data may be older than the latest release. --source packaged refuses to replace a newer database with an older one unless you pass --force.
• A smaller database. update no longer stores SPDX XML. The database is about 7 MB smaller; run licenseid update after upgrading to shrink an existing one.

See CHANGELOG.md for the full list.

Released from the ETSI Security Conference 2026.

What's changed

• Load SPDX data through one object; drop unused XML by @bact in #85
• Make fingerprints the same on every run by @bact in #86
• Add update --source: bundle, tarball or packaged by @bact in #90
• Cleanup and prepare for 0.5.0 by @bact in #91
• Refuse a tarball of the wrong release; tidy builds by @bact in #92
• Harden snapshot hook; slim bundle workflow by @bact in #93
• Reject lone surrogates; keep pipe tests from hanging by @bact in #94
• Rename license list sources by @bact in #95

Full Changelog: v0.4.3...v0.5.0