Patch multi-licenses workaround #242 by reactive-firewall · Pull Request #346 · raimon49/pip-licenses

reactive-firewall · 2026-07-15T03:43:46Z

Patch Notes

Pre-GHI #316 work to mitigate GHI #242 (by introducing --with-license-files as workaround)

BREAKING CHANGES

Important

Moving forward all single file behavior is deprecated; Starting with v6.1 support for single license behavior will start shifting to always supporting multi licenses. The rationale is simple: pip-licenses does not intend to provide legal determinations and thus should always (while still allowing --from filtering, etc.) provide the more accurate state of multiple licenses when declared by a package.

Important

Due to fix in support of multiple license sources (metadata + file(s)) allow/fail logic differentiates between BSD License, BSD-2-Clause and BSD-3-Clause (where legacy classifier based logic may have previously treated both as "BSD License").

New CLI flags introduced in a dedicated `license_file_options` group:

--with-license-files: Multi-file variant (currently: JSON, PLAIN_VERTICAL formats only). Will eventually replace --with-license-file.
--no-file-paths: Suppresses all file path outputs
--with-notice-files: Multiple notice files. (will eventually replace deprecated --with-notice-file)
--with-other-files: Enables file discovery for unlisted: Authors, Copying, Legal files.
Validation in _verify_args() ensures these flags are only used with compatible combinations.

Impacted GHIs:

Contributes to work on Packages with multiple LICENSES files not shown in --with-license-file #71
Contributes to work on Fix/Improve handling of multiple license files per package in ALL formats #242

Resolves Refactor legacy license file search logic too #309

Opens CHORE: implement utility code for generating list of relevant warning diagnostics based on arguments #347

Included & Superseded PR/MRs

Includes & Supersedes [UPDATE] (deps): Bump actions/upload-artifact from 7.0.0 to 7.0.1 in /.github/workflows #325
Includes & Supersedes [UPDATE] (deps): Bump actions/checkout from 6.0.2 to 7.0.0 in /.github/workflows #341
Includes & Supersedes [UPDATE] (deps): Bump actions/attest from 4.1.0 to 4.1.1 in /.github/workflows #343
Derived from and Supersedes Add support for emitting multiple files and License-File entries stefan6419846/pip-licenses-cli#132 by Stefan under MIT License

Bumps [cryptography](https://github.com/pyca/cryptography) from 44.0.3 to 45.0.2. - [Changelog](https://github.com/pyca/cryptography/blob/main/CHANGELOG.rst) - [Commits](pyca/cryptography@44.0.3...45.0.2) --- updated-dependencies: - dependency-name: cryptography dependency-version: 45.0.2 dependency-type: direct:development update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

Closes #5.

Bumps [coverage[toml]](https://github.com/nedbat/coveragepy) from 7.8.0 to 7.8.1. - [Release notes](https://github.com/nedbat/coveragepy/releases) - [Changelog](https://github.com/nedbat/coveragepy/blob/master/CHANGES.rst) - [Commits](coveragepy/coveragepy@7.8.0...7.8.1) --- updated-dependencies: - dependency-name: coverage[toml] dependency-version: 7.8.1 dependency-type: direct:development update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

Bumps [cryptography](https://github.com/pyca/cryptography) from 45.0.2 to 45.0.3. - [Changelog](https://github.com/pyca/cryptography/blob/main/CHANGELOG.rst) - [Commits](pyca/cryptography@45.0.2...45.0.3) --- updated-dependencies: - dependency-name: cryptography dependency-version: 45.0.3 dependency-type: direct:development update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

Bumps [coverage[toml]](https://github.com/nedbat/coveragepy) from 7.8.1 to 7.8.2. - [Release notes](https://github.com/nedbat/coveragepy/releases) - [Changelog](https://github.com/nedbat/coveragepy/blob/master/CHANGES.rst) - [Commits](coveragepy/coveragepy@7.8.1...7.8.2) --- updated-dependencies: - dependency-name: coverage[toml] dependency-version: 7.8.2 dependency-type: direct:development update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

Bumps [zipp](https://github.com/jaraco/zipp) from 3.21.0 to 3.22.0. - [Release notes](https://github.com/jaraco/zipp/releases) - [Changelog](https://github.com/jaraco/zipp/blob/main/NEWS.rst) - [Commits](jaraco/zipp@v3.21.0...v3.22.0) --- updated-dependencies: - dependency-name: zipp dependency-version: 3.22.0 dependency-type: direct:development update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

Bumps [mypy](https://github.com/python/mypy) from 1.15.0 to 1.16.0. - [Changelog](https://github.com/python/mypy/blob/master/CHANGELOG.md) - [Commits](python/mypy@v1.15.0...v1.16.0) --- updated-dependencies: - dependency-name: mypy dependency-version: 1.16.0 dependency-type: direct:development update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

Related to #14.

Bumps [pytest](https://github.com/pytest-dev/pytest) from 8.3.5 to 8.4.0. - [Release notes](https://github.com/pytest-dev/pytest/releases) - [Changelog](https://github.com/pytest-dev/pytest/blob/main/CHANGELOG.rst) - [Commits](pytest-dev/pytest@8.3.5...8.4.0) --- updated-dependencies: - dependency-name: pytest dependency-version: 8.4.0 dependency-type: direct:development update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

Bumps [types-docutils](https://github.com/typeshed-internal/stub_uploader) from 0.21.0.20250526 to 0.21.0.20250604. - [Commits](https://github.com/typeshed-internal/stub_uploader/commits) --- updated-dependencies: - dependency-name: types-docutils dependency-version: 0.21.0.20250604 dependency-type: direct:development update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

Previously, we would run *pycodestyle* through *pytest*. This is not ideal because it connects static analysis with actual testing. Additionally, previous runs showed that *pycodestyle* would not discover violations like unused imports or "bad" non-PEP8 names. Now, the linting is mostly unified with the library version (except that we are still missing strict typing for the CLI). I decided to raise the line length from 79 to 160 characters in the same step to improve readability, especially since most devices are large enough nowadays to still display this in one line without soft wrapping.

Bumps [zipp](https://github.com/jaraco/zipp) from 3.22.0 to 3.23.0. - [Release notes](https://github.com/jaraco/zipp/releases) - [Changelog](https://github.com/jaraco/zipp/blob/main/NEWS.rst) - [Commits](jaraco/zipp@v3.22.0...v3.23.0) --- updated-dependencies: - dependency-name: zipp dependency-version: 3.23.0 dependency-type: direct:development update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

Bumps [cryptography](https://github.com/pyca/cryptography) from 45.0.3 to 45.0.4. - [Changelog](https://github.com/pyca/cryptography/blob/main/CHANGELOG.rst) - [Commits](pyca/cryptography@45.0.3...45.0.4) --- updated-dependencies: - dependency-name: cryptography dependency-version: 45.0.4 dependency-type: direct:development update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

Bumps [requests](https://github.com/psf/requests) from 2.32.3 to 2.32.4. - [Release notes](https://github.com/psf/requests/releases) - [Changelog](https://github.com/psf/requests/blob/main/HISTORY.md) - [Commits](psf/requests@v2.32.3...v2.32.4) --- updated-dependencies: - dependency-name: requests dependency-version: 2.32.4 dependency-type: direct:development update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

Bumps [coverage[toml]](https://github.com/nedbat/coveragepy) from 7.8.2 to 7.9.0. - [Release notes](https://github.com/nedbat/coveragepy/releases) - [Changelog](https://github.com/nedbat/coveragepy/blob/master/CHANGES.rst) - [Commits](coveragepy/coveragepy@7.8.2...7.9.0) --- updated-dependencies: - dependency-name: coverage[toml] dependency-version: 7.9.0 dependency-type: direct:development update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

Bumps [pytest-cov](https://github.com/pytest-dev/pytest-cov) from 6.1.1 to 6.2.0. - [Changelog](https://github.com/pytest-dev/pytest-cov/blob/master/CHANGELOG.rst) - [Commits](pytest-dev/pytest-cov@v6.1.1...v6.2.0) --- updated-dependencies: - dependency-name: pytest-cov dependency-version: 6.2.0 dependency-type: direct:development update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

Bumps [typing-extensions](https://github.com/python/typing_extensions) from 4.13.2 to 4.14.0. - [Release notes](https://github.com/python/typing_extensions/releases) - [Changelog](https://github.com/python/typing_extensions/blob/main/CHANGELOG.md) - [Commits](python/typing_extensions@4.13.2...4.14.0) --- updated-dependencies: - dependency-name: typing-extensions dependency-version: 4.14.0 dependency-type: direct:development update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

* updates GHA for releases

* version bump GHA for dev branches

This work is from review of PR #346 and part of resolving GHI #242

johnthagen · 2026-07-30T12:01:13Z

@reactive-firewall Does this fix:

Packages with multiple LICENSES files not shown in --with-license-file #71

I see mentions of "contributes" to, so I was curious what parts are still left pending, if any.

And is the plan for this to be included in pip-licenses 6?

Release v6.0.0 (Alpha release) preparation #352

reactive-firewall · 2026-07-31T01:42:52Z

@reactive-firewall Does this fix:

Packages with multiple LICENSES files not shown in --with-license-file #71

I see mentions of "contributes" to, so I was curious what parts are still left pending, if any.

Not fully, no (I'd call this a workaround, not a fix), this does improve the situation; however only for some formats, namely --format=json and --format=plain-vertical. Notably HTML and CSV formats are unresolved / not implemented yet (and of-course the rest of GHI #242 enhancements are un-implemented still).

There is also a bunch of technical debt around documentation and functional testing for #71.

This workaround is something that I've had git stashed in my local repo for almost a year now (from September 2025), and needed to be merged before the WIP on #316 could be litmus tested) and fixes #309 in such a way that can be migrated.

And is the plan for this to be included in pip-licenses 6?

Kinda. This is a transitional step included in the Major updates planned for the pip-licenses 6 series. Although I categorized this as part of Initial Compliance with Python Standards.

Regarding

Release v6.0.0 (Alpha release) preparation #352

This is not set in stone yet. Honestly, the biggest factor is: I'll really don't care to maintain this fix (as-is) long-term, not until the maintainability improvements for #316 have landed (but I also didn't want regressions in the middle of that work).

The main goal of #352 is to land some documentation improvements that were specifically requested there; That will only be a pre-release for those interested in the latest cutting-edge.

hopefully that helps answers your questions @johnthagen

…n than in Alpha-v6 (SUPERSEDES PR #346) (- WIP #242 -). Specifically, fix for multiple values (including licenses) in plain vertical format. Note: **PRIOR** GHI #242 workarounds were initially explored by including work inspired by stefan6419846/pip-licenses-cli#32 (this targeted RE-FIX might be in-turn inspired in part by that work, as it avoids pitfalls from testing that workaround on the old codebase) Supersedes PR #346 (as an alternative Fix from before that PR merged)

* dev-v6-split-output-plain: Selectively Re-fixed PlainVerticalTable in simpler more direct fashion than in Alpha-v6 (SUPERSEDES PR #346) (- WIP #242 -). Minor fix for fragil types with python 3.9 (- WIP #316 -) Further split off the plain format as per GHI #316

* lower: Further split off the plain format as per GHI #316 Further split off tables factory for building outputs as per #316 Add simple stubs for imports and public API for pip-licenses.output (part of GHI #316) Minor fix for fragil types with python 3.9 (- WIP #316 -) Minor refactoring for even more fragile types with python 3.9 (- WIP #316 -) Selectively Re-fixed PlainVerticalTable in simpler more direct fashion than in Alpha-v6 (SUPERSEDES PR #346) (- WIP #242 -).

Fixup more fragile types with Python3.9 (- WIP #316 -) Further split off the rest of the json stuff (- WIP #316 -) Futher split off JsonPrettyTable into own module (- WIP #316 -) Further split off CSV output stuff (- WIP #316 -) Minor refactoring for even more fragile types with python 3.9 (- WIP #316 -) Selectively Re-fixed PlainVerticalTable in simpler more direct fashion than in Alpha-v6 (SUPERSEDES PR #346) (- WIP #242 -). Minor fix for fragil types with python 3.9 (- WIP #316 -) Further split off the plain format as per GHI #316 WIP -- Add simple stubs for imports and public API for pip-licenses.output (part of GHI #316) Further split off tables factory for building outputs as per #316

…oin-output-316 * dev-v6-re-join-output-316: Minor refactoring for even more fragile types with python 3.9 (- WIP #316 -) Selectively Re-fixed PlainVerticalTable in simpler more direct fashion than in Alpha-v6 (SUPERSEDES PR #346) (- WIP #242 -). Minor fix for fragil types with python 3.9 (- WIP #316 -) Fixup more fragile types with Python3.9 (- WIP #316 -) Add simple stubs for imports and public API for pip-licenses.output (part of GHI #316) Further split off the rest of the json stuff (- WIP #316 -) Futher split off JsonPrettyTable into own module (- WIP #316 -) Further split off CSV output stuff (- WIP #316 -) Further split off the plain format as per GHI #316 Further split off tables factory for building outputs as per #316

…n-316 (- WIP #316 -) * dev-v6-beta-re-join-output-316: Minor fixup after merge (- WIP #316 -) Minor refactoring for even more fragile types with python 3.9 (- WIP #316 -) Selectively Re-fixed PlainVerticalTable in simpler more direct fashion than in Alpha-v6 (SUPERSEDES PR #346) (- WIP #242 -). Minor fix for fragil types with python 3.9 (- WIP #316 -) Fixup more fragile types with Python3.9 (- WIP #316 -) Post-split tweaks to fix fragile type annotations with Python3.9 (- WIP #316 -) Further split off the rest of the json stuff (- WIP #316 -) Futher split off JsonPrettyTable into own module (- WIP #316 -) Further split off CSV output stuff (- WIP #316 -) Further split off the plain format as per GHI #316 Add simple stubs for imports and public API for pip-licenses.output (part of GHI #316) Further split off tables factory for building outputs as per #316 Split off just outputs for GHI #316

…rom the Alpha-v6 branch (to-be Superseded) Namely: this patch backports my opertunistic improvements and related changes from the old fix in PR #346 (pre-GHI-316 workaround) but this backport carfully excluds any changes directly related to the fix of #242 (and from closely related GHI #71) This patch should thus create an improved base (more maintainable and closer to stable) upon which the workaround for #242 (or more likly a derivitive, so not to pull in **hundreds** of unfiltered history) This branch will supersede previous v6 development branches (included, or otherwise).

@stefan6419846

#346) (- WIP #71 & #242 -) 🎉 A big, heart-felt thank you to @stefan6419846 for their work on stefan6419846/pip-licenses-cli#32 and for also reviewing #346 (upon which this workaround is closely based) Implements some upcoming flags (plural) and contributes to supporting for multiple licenses in a single package for JSON and plain-vertical formats (but not others, e.g., HTML, etc.) **IMPORTANT** This workaround for GHI-71 (and related GHI-242) is ported from the Alpha-v6.0.0 branch and includes portions of PR #346 that was inspired by stefan6419846/pip-licenses-cli#32 (and thus SHOULD NOT be included as is in a release) See also: stefan6419846/pip-licenses-cli#32

reactive-firewall · 2026-08-22T00:46:46Z

Caution

PR Superseded

This transitional patch has now been mostly (except for test_piplicenses.py) superseded by work in #361 (circa development Beta 6.0.0b7)

stefan6419846 and others added 30 commits May 16, 2025 07:48

initial upload

bee16a2

fix authors and maintainers

13b836a

include Python packages into Dependabot configuration

6c10ebb

pytest-runner is obsolete

ce49416

remove obsolete pytest-runner

4ba1e58

Make tomli a dependency only on Python <3.11 (#6)

1bb19cf

Closes #5.

Further cleanup

b94ca9d

fix typo

bab1086

Version 1.1.0

b588459

Refactor dependencies to include type stubs in dev extra

7f74bbe

Remove obsolete mypy parameter

df6b537

Test against Python 3.14

d837866

Allow SPDX OR clauses (#15)

4cecd92

Related to #14.

Improve coverage (#17)

da208ac

version 1.2.0

a019711

reactive-firewall added 9 commits July 29, 2026 22:09

[TESTING] Updated various tests for GHI #242 and #71 (WIP)

cbe1184

[TESTING] Minor tweaks to improve code coverage slightly (- WIP #309 -)

789780b

[UPDATE] Supperceeds PR #343

6eb56b6

* updates GHA for releases

[UPDATE] superceeds PR #325

7679c47

[UPDATE] Supperceeds PR #341

8b17bd7

* version bump GHA for dev branches

[TESTING] Imporved test coverage slightly.

0d91f3c

This work is from review of PR #346 and part of resolving GHI #242

[TESTING] slight improved coverage

a584608

[TESTING] Possible fix for regression due to fine-grain controls

b444f8a

[PATCH] Apply changes discussed in review of PR #346

9dfc692

reactive-firewall force-pushed the patch-multi-license-242 branch from 0102803 to 9dfc692 Compare July 30, 2026 05:12

reactive-firewall merged commit 141ede4 into dev-v6.0 Jul 30, 2026
10 checks passed

reactive-firewall linked an issue Aug 1, 2026 that may be closed by this pull request

FEATURE: add JSON support for --with-license-files #240

Open

reactive-firewall removed a link to an issue Aug 1, 2026

FEATURE: add JSON support for --with-license-files #240

Open

This was referenced Aug 1, 2026

Packages with multiple LICENSES files not shown in --with-license-file #71

Open

Pre-Release (Alpha) candidate for v6-series (v6.0.0a1) #355

Closed

reactive-firewall mentioned this pull request Aug 20, 2026

Multiple Development (v6 betas) re-joined #361

Merged

2 tasks

reactive-firewall added resolved This is considered resolved and removed help wanted Extra attention is needed labels Aug 22, 2026

reactive-firewall deleted the patch-multi-license-242 branch August 22, 2026 00:49

Navigation Menu

Patch multi-licenses workaround #242 - #346

Patch multi-licenses workaround #242#346
reactive-firewall merged 154 commits into
dev-v6.0from
patch-multi-license-242

reactive-firewall commented Jul 15, 2026 •

edited

Loading

Uh oh!

Uh oh!

johnthagen commented Jul 30, 2026 •

edited

Loading

Uh oh!

reactive-firewall commented Jul 31, 2026

Uh oh!

reactive-firewall commented Aug 22, 2026

PR Superseded

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

8 participants

Conversation

reactive-firewall commented Jul 15, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Patch Notes

BREAKING CHANGES

New CLI flags introduced in a dedicated license_file_options group:

Impacted GHIs:

Included & Superseded PR/MRs

Uh oh!

Uh oh!

johnthagen commented Jul 30, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

reactive-firewall commented Jul 31, 2026

Uh oh!

reactive-firewall commented Aug 22, 2026

PR Superseded

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

8 participants

reactive-firewall commented Jul 15, 2026 •

edited

Loading

New CLI flags introduced in a dedicated `license_file_options` group:

johnthagen commented Jul 30, 2026 •

edited

Loading