path: root/CHANGELOG.md

# GitLab License management changelog

## v3.28.3

- Stream `npm ci` output to log. (https://gitlab.com/gitlab-org/security-products/analyzers/license-finder/-/merge_requests/16)

## v3.28.2

- Detect maven wrapper in nested directories. (https://gitlab.com/gitlab-org/security-products/analyzers/license-finder/-/merge_requests/15)
- Detect gradle wrapper in nested directories. (https://gitlab.com/gitlab-org/security-products/analyzers/license-finder/-/merge_requests/15)

## v3.28.1

- Set `golang` version to `1.15.2` in `.tool-versions` file. (https://gitlab.com/gitlab-org/security-products/analyzers/license-finder/-/merge_requests/6)
- Set `ruby` version to `2.7.2` in `.tool-versions` file and other places. (https://gitlab.com/gitlab-org/security-products/analyzers/license-finder/-/merge_requests/6)

## v3.28.0

- Move project from https://gitlab.com/gitlab-org/security-products/license-management to https://gitlab.com/gitlab-org/security-products/analyzers/license-finder/ https://gitlab.com/gitlab-org/security-products/analyzers/license-finder/-/merge_requests/3

## v3.27.0

- Parse SPDX License expressions. https://gitlab.com/gitlab-org/security-products/license-management/-/merge_requests/228

## v3.26.1

- Switch to working directory that contains the `go.mod` file. https://gitlab.com/gitlab-org/security-products/license-management/-/merge_requests/222

## v3.26.0

- Add Ruby version 2.7.2 to Docker image. https://gitlab.com/gitlab-org/security-products/license-management/-/merge_requests/226

## v3.25.8

- Remove bash functions that are not in use https://gitlab.com/gitlab-org/security-products/license-management/-/merge_requests/224

## v3.25.7

- Fix path to Java 11 keystore https://gitlab.com/gitlab-org/security-products/license-management/-/merge_requests/221

## v3.25.6

- Install `build-essential` for development https://gitlab.com/gitlab-org/security-products/license-management/-/merge_requests/219
- Export `NODE_EXTRA_CA_CERTS` for self signed certificates https://gitlab.com/gitlab-org/security-products/license-management/-/merge_requests/219

## v3.25.5

- Remove packages with known vulnerabilities https://gitlab.com/gitlab-org/security-products/license-management/-/merge_requests/218

## v3.25.4

- Fix patch number of `GOLANG_VERSION` being ignored, making the scan fail if there's no match for MAJOR.MINOR (https://gitlab.com/gitlab-org/security-products/license-management/-/merge_requests/215)

## v3.25.3

- Ensure `apt-get` db is valid for `before_script` blocks. (https://gitlab.com/gitlab-org/security-products/license-management/-/merge_requests/215)

## v3.25.2

- Roll out `golang` version `1.15.1` to more of the project. (https://gitlab.com/gitlab-org/security-products/license-management/-/merge_requests/216)

## v3.25.1

- Set `golang` version to `1.15.1` in `.tool-versions` file. (https://gitlab.com/gitlab-org/security-products/license-management/-/merge_requests/212)

## v3.25.0

- Install tools from Debian package. (https://gitlab.com/gitlab-org/security-products/license-management/-/merge_requests/188)

## v3.24.0

- Removes `BSD-4-Clause` from a list of normalized licenses. (https://gitlab.com/gitlab-org/security-products/license-management/-/merge_requests/196)

## v3.23.0

- Upgrade [LicenseFinder](https://github.com/pivotal/LicenseFinder/) to `6.8.1` (https://gitlab.com/gitlab-org/security-products/license-management/-/merge_requests/209)
- Update SPDX catalogue to  version `3.10` (https://gitlab.com/gitlab-org/security-products/license-management/-/merge_requests/209)

## v3.22.2

- Update default PHP to `7.4.8` (https://gitlab.com/gitlab-org/security-products/license-management/-/merge_requests/208)

## v3.22.1

- Fix bug with loading `.bashrc`. (https://gitlab.com/gitlab-org/security-products/license-management/-/merge_requests/206)
- Detect vendor directory for composer projects (https://gitlab.com/gitlab-org/security-products/license-management/-/merge_requests/207)

## v3.22.0

- Unpack mono from custom built deb package (https://gitlab.com/gitlab-org/security-products/license-management/-/merge_requests/204)

## v3.21.1

- Unpack Rust Debian package before asdf attempts to compile and install it. (https://gitlab.com/gitlab-org/security-products/license-management/-/merge_requests/205)

## v3.21.0

- Provide limited network connectivity for [cargo](https://doc.rust-lang.org/cargo/) projects (https://gitlab.com/gitlab-org/security-products/license-management/-/merge_requests/201)
- Exclude development dependencies from [cargo](https://doc.rust-lang.org/cargo/) project scans (https://gitlab.com/gitlab-org/security-products/license-management/-/merge_requests/201)

## v3.20.1

- Ensure that error messages are converted to strings before writing to the log. (https://gitlab.com/gitlab-org/security-products/license-management/-/merge_requests/203)
- Do not reconfigure bundler from the scanners ruby process. (https://gitlab.com/gitlab-org/security-products/license-management/-/merge_requests/203)

## v3.20.0

- Fallback to parsing the `composer.lock` file when it is present (https://gitlab.com/gitlab-org/security-products/license-management/-/merge_requests/200)

## v3.19.5

- Fix failing dotnet tests. (https://gitlab.com/gitlab-org/security-products/license-management/-/merge_requests/199)

## v3.19.4

- Exclude development dependencies from [composer](https://getcomposer.org) project scans (https://gitlab.com/gitlab-org/security-products/license-management/-/merge_requests/198)

## v3.19.3

- Set `golang` version to `1.14.6` in `.tool-versions` file. (https://gitlab.com/gitlab-org/security-products/license-management/-/merge_requests/197)

## v3.19.2

- Combine default/custom x509 certificates in TLS validation. (https://gitlab.com/gitlab-org/security-products/license-management/-/merge_requests/194)

## v3.19.1

- Choose a version of the `org.codehaus.mojo:license-maven-plugin:aggregate-download-licenses` that is compatible with the version of Maven used by the project. (https://gitlab.com/gitlab-org/security-products/license-management/-/merge_requests/195)
- Print error messages to the console when a scan fails. (https://gitlab.com/gitlab-org/security-products/license-management/-/merge_requests/195)

## v3.19.0

- Include the latest LTS of the .NET SDK in the Docker image. (https://gitlab.com/gitlab-org/security-products/license-management/-/merge_requests/191)
- Include the latest LTS of Mono in the Docker image. (https://gitlab.com/gitlab-org/security-products/license-management/-/merge_requests/193)

## v3.18.1

- Fix failing composer tests.

## v3.18.0

- Improve license detection for NuGet packages (https://gitlab.com/gitlab-org/security-products/license-management/-/merge_requests/189)
- Detect `.vbproj` files (https://gitlab.com/gitlab-org/security-products/license-management/-/merge_requests/189)
- Detect `.fsproj` files (https://gitlab.com/gitlab-org/security-products/license-management/-/merge_requests/189)
- Detect `.sln` files (https://gitlab.com/gitlab-org/security-products/license-management/-/merge_requests/189)
- Parse SPDX license expressions from `.nuspec` files (https://gitlab.com/gitlab-org/security-products/license-management/-/merge_requests/189)
- Install custom `ADDITIONAL_CA_CERT_BUNDLE` for `dotnet` CLI projects (https://gitlab.com/gitlab-org/security-products/license-management/-/merge_requests/189)

## v3.17.2

- Return empty list of packages if bundler scanner fails. (https://gitlab.com/gitlab-org/security-products/license-management/-/merge_requests/181)

## v3.17.1

- Reset bundler config from within sub directories in project (https://gitlab.com/gitlab-org/security-products/license-management/-/merge_requests/188)

## v3.17.0

- Isolate the embedded LicenseFinder Ruby from the target project's Ruby (https://gitlab.com/gitlab-org/security-products/license-management/-/merge_requests/181)

## v3.16.0

- Install `dotnet` and `mono` at scan time to decrease size of Docker image. (https://gitlab.com/gitlab-org/security-products/license-management/-/merge_requests/185)

## v3.15.0

- Detect `gems.rb` and `gems.locked` in `Bundler` projects. (https://gitlab.com/gitlab-org/security-products/license-management/-/merge_requests/186)

## v3.14.0

- Export `BUNDLE_SSL_CA_CERT` when a `ADDITIONAL_CA_CERT_BUNDLE` is provided. (https://gitlab.com/gitlab-org/security-products/license-management/-/merge_requests/177)

## v3.13.0

- Upgrade to [`license_finder`](https://github.com/pivotal/LicenseFinder/) [`6.6.0`](https://github.com/pivotal/LicenseFinder/releases/tag/v6.6.0). (https://gitlab.com/gitlab-org/security-products/license-management/-/merge_requests/162) (https://gitlab.com/gitlab-org/security-products/license-management/-/merge_requests/166)

## v3.12.3

- Update default Java versions to match [new naming convention](https://github.com/halcyon/asdf-java/pull/87 (https://gitlab.com/gitlab-org/security-products/license-management/-/merge_requests/176)

## v3.12.2

- Publish latest major version to registry.gitlab.com/gitlab-org/security-products/analyzers/license-finder:3 (https://gitlab.com/gitlab-org/security-products/license-management/-/merge_requests/175)
- Print version of license in log output. (https://gitlab.com/gitlab-org/security-products/license-management/-/merge_requests/175)

## v3.12.1

- Detect variations of the "Eclipse Public License" (https://gitlab.com/gitlab-org/security-products/license-management/-/merge_requests/174)

## v3.12.0

- Update default name of the generated report. (https://gitlab.com/gitlab-org/security-products/license-management/-/merge_requests/167)

## v3.11.2

- Ensure `LM_*_VERSION` variables take precedence over `ASDF_*_VERSION` variables. (https://gitlab.com/gitlab-org/security-products/license-management/-/merge_requests/163)

## v3.11.1

- Fix dependency scanning in golang projects. (https://gitlab.com/gitlab-org/security-products/license-management/-/merge_requests/160)
- Parse `go.sum` files to support offline environments (https://gitlab.com/gitlab-org/security-products/license-management/-/merge_requests/161)

## v3.11.0

- Add support for providing custom [Conan](https://conan.io/) configuration. (https://gitlab.com/gitlab-org/security-products/license-management/-/merge_requests/159)

## v3.10.0

- Add initial support for the [Conan](https://conan.io/) package manger. (https://gitlab.com/gitlab-org/security-products/license-management/-/merge_requests/156)
- Add preview of report version `2.1`. (https://gitlab.com/gitlab-org/security-products/license-management/-/merge_requests/156)

## v3.9.2

- Pass `bower_ca` to bower install step. (https://gitlab.com/gitlab-org/security-products/license-management/-/merge_requests/151)

## v3.9.1

- Add `--allow-root` option when install bower packages. (https://gitlab.com/gitlab-org/security-products/license-management/-/merge_requests/150)
- Include nested dependencies in scan report for bower projects. (https://gitlab.com/gitlab-org/security-products/license-management/-/merge_requests/150)
- Pass `NPM_CONFIG_CAFILE` to bower install step. (https://gitlab.com/gitlab-org/security-products/license-management/-/merge_requests/150)

## v3.9.0

- Update go list command to be compatible with 1.14 (https://gitlab.com/gitlab-org/security-products/license-management/-/merge_requests/143)
- Forward the NPM [cafile](https://docs.npmjs.com/using-npm/config#cafile) option to `yarn`. (https://gitlab.com/gitlab-org/security-products/license-management/-/merge_requests/148)

## v3.8.1

- Exclude `devDependencies` from `yarn` scan report. (https://gitlab.com/gitlab-org/security-products/license-management/-/merge_requests/147)
- Remove `spandx` dependency and bring back Ruby 2.4+ support. (https://gitlab.com/gitlab-org/security-products/license-management/-/merge_requests/147)

## v3.8.0

- Add support for NPM [cafile](https://docs.npmjs.com/using-npm/config#cafile) option. (https://gitlab.com/gitlab-org/security-products/license-management/-/merge_requests/145)
- Specify path to Java keystore file when listing contents. (https://gitlab.com/gitlab-org/security-products/license-management/-/merge_requests/45)

## v3.7.6

- Exclude `devDependencies` from scan report. (https://gitlab.com/gitlab-org/security-products/license-management/-/merge_requests/141)
- Include latest NodeJS 12.16.3, 10.20.1 LTS. (https://gitlab.com/gitlab-org/security-products/license-management/-/merge_requests/141)
- Update version of PHP to 7.4.5. (https://gitlab.com/gitlab-org/security-products/license-management/-/merge_requests/141)
- Update Python to 2.7.18. (https://gitlab.com/gitlab-org/security-products/license-management/-/merge_requests/141)
- Update Ruby to 2.6.6. (https://gitlab.com/gitlab-org/security-products/license-management/-/merge_requests/141)

## v3.7.5

- Install multiple x509 certificates from `ADDITIONAL_CA_CERT_BUNDLE` into system trust store. (https://gitlab.com/gitlab-org/security-products/license-management/-/merge_requests/144)
- Install multiple x509 certificates from `ADDITIONAL_CA_CERT_BUNDLE` into java trust store. (https://gitlab.com/gitlab-org/security-products/license-management/-/merge_requests/144)

## v3.7.4

- Install Java key store when `ADDITIONAL_CA_CERT_BUNDLE` is provided. (https://gitlab.com/gitlab-org/security-products/license-management/-/merge_requests/139)

## v3.7.3

- Add `--local` option to `gem install` step to speed up initial scan time. (https://gitlab.com/gitlab-org/security-products/license-management/-/merge_requests/135)

## v3.7.2

- Forward custom `GRADLE_CLI_OPTS` to `gradle downloadLicenses` and skip additional install step. (https://gitlab.com/gitlab-org/security-products/license-management/-/merge_requests/121)

## v3.7.1

- Export `PIP_CERT` when invoking `pip` when a custom root certificate is specified. (https://gitlab.com/gitlab-org/security-products/license-management/-/merge_requests/133)

## v3.7.0

- Add `ADDITIONAL_CA_CERT_BUNDLE` to list of trusted root certificates. (https://gitlab.com/gitlab-org/security-products/license-management/-/merge_requests/126)

## v3.6.0

- Change default log level to `warn`. (https://gitlab.com/gitlab-org/security-products/license-management/-/merge_requests/132)
- Allow control of the log level via the `LOG_LEVEL` environment variable. (https://gitlab.com/gitlab-org/security-products/license-management/-/merge_requests/132)

## v3.5.0

- Improve license detection in go modules projects. (https://gitlab.com/gitlab-org/security-products/license-management/-/merge_requests/129)
- Update gradle to version `6.3`. (https://gitlab.com/gitlab-org/security-products/license-management/-/merge_requests/129)
- Update nodejs to version `10.19.0`. (https://gitlab.com/gitlab-org/security-products/license-management/-/merge_requests/129)
- Update php to version `7.4.4`. (https://gitlab.com/gitlab-org/security-products/license-management/-/merge_requests/129)
- Update python to version `3.8.2`. (https://gitlab.com/gitlab-org/security-products/license-management/-/merge_requests/129)

## v3.4.0

- Scan pipenv projects with [pip-licenses](https://pypi.org/project/pip-licenses/). (https://gitlab.com/gitlab-org/security-products/license-management/-/merge_requests/130)
- Read pipenv spec data from the sources listed in `Pipfile.lock`. (https://gitlab.com/gitlab-org/security-products/license-management/-/merge_requests/130)

## v3.3.1

- Fix bug with forwarding `LICENSE_FINDER_CLI_OPTS` (https://gitlab.com/gitlab-org/security-products/license-management/-/merge_requests/131)

## v3.3.0

- Scan Python projects with [pip-licenses](https://pypi.org/project/pip-licenses/). (https://gitlab.com/gitlab-org/security-products/license-management/-/merge_requests/128)

## v3.2.0

- Install packages from `PIP_INDEX_URL`. (https://gitlab.com/gitlab-org/security-products/license-management/-/merge_requests/125)

## v3.1.4

- Print `license-maven-plugin` logs to console. (https://gitlab.com/gitlab-org/security-products/license-management/-/merge_requests/127)

## v3.1.3

- Install `license-maven-plugin` into local repository. (https://gitlab.com/gitlab-org/security-products/license-management/-/merge_requests/124)

## v3.1.2

- Use `license-maven-plugin:aggreate-download-licenses` for multi-module projects. (https://gitlab.com/gitlab-org/security-products/license-management/-/merge_requests/123)

## v3.1.1

- Fix invocation of `SETUP_CMD`. (https://gitlab.com/gitlab-org/security-products/license-management/-/merge_requests/122)

## v3.1.0

- Forward custom `MAVEN_CLI_OPTS` to `LicenseFinder` so that it can use it in the license scan task. (https://gitlab.com/gitlab-org/security-products/license-management/-/merge_requests/120)

## v3.0.0

- Use asdf version manager to install custom tools (https://gitlab.com/gitlab-org/security-products/license-management/-/merge_requests/98)

## v2.8.0

- Install `php-gd` package to support default Drupal configurations. (https://gitlab.com/gitlab-org/security-products/license-management/-/merge_requests/114)
- Allow to set JAVA_VERSION when you use SETUP_CMD. (https://gitlab.com/gitlab-org/security-products/license-management/-/merge_requests/119)

## v2.7.0

- Install project specific versions of gradle at scan time. (https://gitlab.com/gitlab-org/security-products/license-management/-/merge_requests/118)

## v2.6.0

- Upgrade to license finder 6.0.0 docker image (https://gitlab.com/gitlab-org/security-products/license-management/-/merge_requests/115)

## v2.5.2

- Exclude development/test dependencies by default (https://gitlab.com/gitlab-org/security-products/license-management/-/merge_requests/117)

## v2.5.1

- Install bundler `1.x` and `2.x` (https://gitlab.com/gitlab-org/security-products/license-management/-/merge_requests/116)

## v2.5.0

- Upgrade [LicenseFinder](https://github.com/pivotal/LicenseFinder/releases/tag/v6.0.0) to version `6.0.0` (https://gitlab.com/gitlab-org/security-products/license-management/-/merge_requests/112)

## v2.4.3

- Add support for `gradlew` (https://gitlab.com/gitlab-org/security-products/license-management/-/merge_requests/109)
- Install [license-gradle-plugin](https://github.com/hierynomus/license-gradle-plugin) in gradle init script. (https://gitlab.com/gitlab-org/security-products/license-management/-/merge_requests/109)

## v2.4.2

- Fix word splitting in default gradle options (https://gitlab.com/gitlab-org/security-products/license-management/-/merge_requests/110)

## v2.4.1

- Include a default NuGet configuration file (https://gitlab.com/gitlab-org/security-products/license-management/-/merge_requests/105)

## v2.4.0

- Add support for `Pipfile.lock` (https://gitlab.com/gitlab-org/security-products/license-management/-/merge_requests/103)

## v2.3.1

- Run gradle without tests by default. (https://gitlab.com/gitlab-org/security-products/license-management/-/merge_requests/102)

## v2.3.0

- Install Python 3.8.1 as the default python (https://gitlab.com/gitlab-org/security-products/license-management/-/merge_requests/101)

## v2.2.3

- Add a mapping for `BSD-like` software licenses. (https://gitlab.com/gitlab-org/security-products/license-management/-/merge_requests/97)

## v2.2.2

- Install the latest version of pip for both Python 2 and 3 at build time (https://gitlab.com/gitlab-org/security-products/license-management/-/merge_requests/99)

## v2.2.1

- Use `--prepare-no-fail` option to try to scan as much as possible. (https://gitlab.com/gitlab-org/security-products/license-management/-/merge_requests/92)

## v2.2.0

- Update LicenseFinder to 5.11.1 [Diff](https://github.com/pivotal/LicenseFinder/compare/v5.9.2...v5.11.1)

## v2.1.1

- Sort license identifiers associated with each dependency

## v2.1.0

- Bump LicenseFinder to 5.9.2
- Add support for PHP language

## v2.0.2

- Fix mismatch between dependency versions listed in `package-lock.json` and reported versions.

## v2.0.1

- Sort dependencies by name then by version

## v2.0.0

- Update the default report version to v2.0 (https://gitlab.com/gitlab-org/security-products/license-management/-/merge_requests/66)

## v1.8.3

- Update java 11 from 11.0.2 to 11.0.5

## v1.8.2

- Ignore node version for installing npm dependencies(https://gitlab.com/gitlab-org/security-products/license-management/-/merge_requests/79)

## v1.8.1

- Add mapping for `Apache License v2.0` to `Apache-2.0` (https://gitlab.com/gitlab-org/security-products/license-management/-/merge_requests/78)

## v1.8.0

- Add ability to configure the `license_finder` execution via `LICENSE_FINDER_CLI_OPTS` (https://gitlab.com/gitlab-org/security-products/license-management/-/merge_requests/77)

## v1.7.4

- Install [.NET Core 2.2, 3.0](https://github.com/pivotal/LicenseFinder/pull/632) so that we can install packages for .NET Core 2.2, 3.0 projects.
- Parse SPDX identifier from license URL sourced from `licenses.nuget.org` and `opensource.org`.
- Use lower case license name as identifier for unknown licenses to remove ambiguity.

## v1.7.3

- Update SPDX.org catalogue from version `3.6` to `3.7`.

## v1.7.2

- Remove `LM_V1_CANONICALIZE` feature flag
- Remove `FEATURE_RUBY_REPORT` feature flag
- Remove `html2json.js` script

## v1.7.1

- Add mappings for legacy license names
- Use the license url instead of details url

## v1.7.0

- Convert HTML to JSON transformation to generating a JSON report directly.
- Introduce version 1.1 of the gl-license-management-report.json
- Introduce version 2 of the gl-license-management-report.json.
- Add support for multiple licenses.
- Normalize license names to produce consistent results.

## v1.6.1

- Fix `The engine "node" is incompatible with this module.` error (https://gitlab.com/gitlab-org/security-products/license-management/-/merge_requests/61)

## v1.6.0

- Make Python 3.5 the default. (https://gitlab.com/gitlab-org/security-products/license-management/-/merge_requests/56)

## v1.5.0

- Reverts 1.4.0

## v1.4.0

- Bump LicenseFinder to 5.9.2
- Add support for PhP language

## v1.3.0

- Add `LM_PYTHON_VERSION` variable, to be set to `3` to switch to Python 3.5, pip 19.1.1. (https://gitlab.com/gitlab-org/security-products/license-management/-/merge_requests/36)

## v1.2.6

- Fix: better support of go projects (https://gitlab.com/gitlab-org/security-products/license-management/-/merge_requests/31)

## v1.2.5

- Feature: support Java 11 via an ENV variable (@haynes https://gitlab.com/gitlab-org/security-products/license-management/-/merge_requests/26)

## v1.2.4

- Fix: support multiple MAVEN_CLI_OPTS options (@haynes https://gitlab.com/gitlab-org/security-products/license-management/-/merge_requests/27)

## v1.2.3

- Add ability to configure the `mvn install` execution for Maven projects via `MAVEN_CLI_OPTS` (https://gitlab.com/gitlab-org/security-products/license-management/-/merge_requests/24)
- Skip `"test"` phase by default when running `mvn install` for Maven projects (https://gitlab.com/gitlab-org/security-products/license-management/-/merge_requests/24)

## v1.2.2

- Bump LicenseFinder to 5.6.2

## v1.2.1

- Better support for js npm projects (https://gitlab.com/gitlab-org/security-products/license-management/-/merge_requests/14)

## v1.2.0

- Bump LicenseFinder to 5.5.2

## v1.1.0

- Allow `SETUP_CMD` to skip auto-detection of build tool

## v1.0.0

- Initial release