Skip to content

Pre-Release (Alpha) candidate for v6-series (v6.0.0a1) - #355

Closed
reactive-firewall wants to merge 184 commits into
masterfrom
alpha-v6.0.0
Closed

Pre-Release (Alpha) candidate for v6-series (v6.0.0a1)#355
reactive-firewall wants to merge 184 commits into
masterfrom
alpha-v6.0.0

Conversation

@reactive-firewall

@reactive-firewall reactive-firewall commented Aug 2, 2026 •
edited
Loading

Copy link
Copy Markdown
Collaborator

Patch Notes

A sneak peek at some of the changes coming in pip-licenses v6 and some minor documentation corrections.

Note

This will be an opt-in pre-release (via pip install --pre ... (and does not supersede the LTS v5.5.5)

Container version bump 📦

Include with this release is a preview of the next LTS container version via, a long overdue, updated Dockerfile

Documentation 📃 (because it's not really about security with these)

Important

pip-licenses was NOT impacted by CVE-2025-47273. pip install pip-licenses>=5 will not have install the affected package setuptools<78.1.1 (despite an outdated example in the README.md); Most users should have been unaffected (except possibly on outdated forks?) unless doing very strange (unsupported) things with pip-licenses's source builds like monkey-patching the build logic, then maybe 🙉.

Numerous examples throughout the README.md (which is included in the official distributions, and may worry your favorite security tools) have been updated thanks to work by @matejkloska 🎉

Security 🔏

Important

pip-licenses was NOT impacted by CVE-2026-4539 for normal use-cases. pip install pip-licenses>=5 will not install the affected developer package Pypgments; Most users should have been unaffected (except possibly on forked projects).

Fixed false positive of: CVE-2026-4539 reDoS. Removed optional (and historical) use of twine to fix alert.

Important

Furthermore, pip-licenses was NOT impacted by CVE-2026-44432.
Furthermore, pip-licenses was NOT impacted by CVE-2026-44431.

Fixed false positive of CVE-2026-44432. Removed optional (and historical) use of twine to fix alerts.
Fixed false positive of CVE-2026-44431.

Experimental flags 🎏

Important

🚧 Upgrades are in-progress, please pardon the noisy changes and dust.

  • --with-*-files (as originally suggested by @johnthagen) plural nomenclature (file vs files) will lead to a more intuitive usage - these will be formally introduced in a future stable release (but this is an early sneak peek currently based on work by @stefan6419846)

These initial new flags are currently implemented in a purely stop-gap form (as they are based on the PR stefan6419846/pip-licenses-cli#132 (which was originally a fix for stefan6419846/pip-licenses-cli#8 that @johnthagen is similar to #71 and #242). To completely fix GHI #71 and related, full support of multiple licenses for a single package will become the default. This seemingly small design change will have impacts throughout the entire codebase. But for most users this hopefully will just look like adding an s to the --with-license-file flag (and the plan is to replace the old flag mostly behind the scenes to minimize potential breaking changes) or even no change to usage just a noisy depreciation warning that can be ignored (this re-design is not really about removing any features)

So yeah this would-be the next v5.5.x if not for all that; hence the bump to v6 (alpha))

Impacted GHIs:

Included & Superseded PR/MRs

Special thanks to...

  • @matejkloska for requesting this pre-release
  • @johnthagen for motivating much of this work, and consistent interest
  • @stefan6419846 for inspiring fixes, sharing insights, and giving feedback and code-reviews!
  • @SAY-5 for their contributions

stefan6419846 and others added 30 commits May 16, 2025 07:48
@stefan6419846
initial upload
bee16a2
@stefan6419846
fix authors and maintainers
13b836a
@stefan6419846
include Python packages into Dependabot configuration
6c10ebb
@stefan6419846
pytest-runner is obsolete
ce49416
@stefan6419846
remove obsolete pytest-runner
4ba1e58
@dependabot
Bump cryptography from 44.0.3 to 45.0.2 (#4)
6a9d448 
Bumps [cryptography](https://github.com/pyca/cryptography) from 44.0.3 to 45.0.2.
- [Changelog](https://github.com/pyca/cryptography/blob/main/CHANGELOG.rst)
- [Commits](pyca/cryptography@44.0.3...45.0.2)

---
updated-dependencies:
- dependency-name: cryptography
  dependency-version: 45.0.2
  dependency-type: direct:development
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
@johnthagen
Make tomli a dependency only on Python <3.11 (#6)
1bb19cf 
Closes #5.
@stefan6419846
Further cleanup
b94ca9d
@stefan6419846
fix typo
bab1086
@dependabot
Bump coverage[toml] from 7.8.0 to 7.8.1 (#9)
eb377e5 
Bumps [coverage[toml]](https://github.com/nedbat/coveragepy) from 7.8.0 to 7.8.1.
- [Release notes](https://github.com/nedbat/coveragepy/releases)
- [Changelog](https://github.com/nedbat/coveragepy/blob/master/CHANGES.rst)
- [Commits](coveragepy/coveragepy@7.8.0...7.8.1)

---
updated-dependencies:
- dependency-name: coverage[toml]
  dependency-version: 7.8.1
  dependency-type: direct:development
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
@dependabot
Bump cryptography from 45.0.2 to 45.0.3 (#10)
4a6a47e 
Bumps [cryptography](https://github.com/pyca/cryptography) from 45.0.2 to 45.0.3.
- [Changelog](https://github.com/pyca/cryptography/blob/main/CHANGELOG.rst)
- [Commits](pyca/cryptography@45.0.2...45.0.3)

---
updated-dependencies:
- dependency-name: cryptography
  dependency-version: 45.0.3
  dependency-type: direct:development
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
@dependabot
Bump coverage[toml] from 7.8.1 to 7.8.2 (#11)
29afe13 
Bumps [coverage[toml]](https://github.com/nedbat/coveragepy) from 7.8.1 to 7.8.2.
- [Release notes](https://github.com/nedbat/coveragepy/releases)
- [Changelog](https://github.com/nedbat/coveragepy/blob/master/CHANGES.rst)
- [Commits](coveragepy/coveragepy@7.8.1...7.8.2)

---
updated-dependencies:
- dependency-name: coverage[toml]
  dependency-version: 7.8.2
  dependency-type: direct:development
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
@stefan6419846
Version 1.1.0
b588459
@stefan6419846
Refactor dependencies to include type stubs in dev extra
7f74bbe
@stefan6419846
Remove obsolete mypy parameter
df6b537
@dependabot
Bump zipp from 3.21.0 to 3.22.0 (#12)
e1d6dc3 
Bumps [zipp](https://github.com/jaraco/zipp) from 3.21.0 to 3.22.0.
- [Release notes](https://github.com/jaraco/zipp/releases)
- [Changelog](https://github.com/jaraco/zipp/blob/main/NEWS.rst)
- [Commits](jaraco/zipp@v3.21.0...v3.22.0)

---
updated-dependencies:
- dependency-name: zipp
  dependency-version: 3.22.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
@stefan6419846
Test against Python 3.14
d837866
@dependabot
Bump mypy from 1.15.0 to 1.16.0 (#13)
7dc85ac 
Bumps [mypy](https://github.com/python/mypy) from 1.15.0 to 1.16.0.
- [Changelog](https://github.com/python/mypy/blob/master/CHANGELOG.md)
- [Commits](python/mypy@v1.15.0...v1.16.0)

---
updated-dependencies:
- dependency-name: mypy
  dependency-version: 1.16.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
@b-kamphorst
Allow SPDX OR clauses (#15)
4cecd92 
Related to #14.
@dependabot
Bump pytest from 8.3.5 to 8.4.0 (#16)
da8a2c3 
Bumps [pytest](https://github.com/pytest-dev/pytest) from 8.3.5 to 8.4.0.
- [Release notes](https://github.com/pytest-dev/pytest/releases)
- [Changelog](https://github.com/pytest-dev/pytest/blob/main/CHANGELOG.rst)
- [Commits](pytest-dev/pytest@8.3.5...8.4.0)

---
updated-dependencies:
- dependency-name: pytest
  dependency-version: 8.4.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
@stefan6419846
Improve coverage (#17)
da208ac
@stefan6419846
version 1.2.0
a019711
@dependabot
Bump types-docutils from 0.21.0.20250526 to 0.21.0.20250604 (#18)
776b6b3 
Bumps [types-docutils](https://github.com/typeshed-internal/stub_uploader) from 0.21.0.20250526 to 0.21.0.20250604.
- [Commits](https://github.com/typeshed-internal/stub_uploader/commits)

---
updated-dependencies:
- dependency-name: types-docutils
  dependency-version: 0.21.0.20250604
  dependency-type: direct:development
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
@stefan6419846
Replace pycodestyle with flake8 (#19)
3674e4d 
Previously, we would run *pycodestyle* through *pytest*. This is not
ideal because it connects static analysis with actual testing. Additionally,
previous runs showed that *pycodestyle* would not discover violations
like unused imports or "bad" non-PEP8 names.

Now, the linting is mostly unified with the library version (except that we
are still missing strict typing for the CLI). I decided to raise the line length
from 79 to 160 characters in the same step to improve readability, especially
since most devices are large enough nowadays to still display this in one line
without soft wrapping.
@dependabot
Bump zipp from 3.22.0 to 3.23.0 (#20)
ef662ee 
Bumps [zipp](https://github.com/jaraco/zipp) from 3.22.0 to 3.23.0.
- [Release notes](https://github.com/jaraco/zipp/releases)
- [Changelog](https://github.com/jaraco/zipp/blob/main/NEWS.rst)
- [Commits](jaraco/zipp@v3.22.0...v3.23.0)

---
updated-dependencies:
- dependency-name: zipp
  dependency-version: 3.23.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
@dependabot
Bump cryptography from 45.0.3 to 45.0.4 (#21)
e67744f 
Bumps [cryptography](https://github.com/pyca/cryptography) from 45.0.3 to 45.0.4.
- [Changelog](https://github.com/pyca/cryptography/blob/main/CHANGELOG.rst)
- [Commits](pyca/cryptography@45.0.3...45.0.4)

---
updated-dependencies:
- dependency-name: cryptography
  dependency-version: 45.0.4
  dependency-type: direct:development
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
@dependabot
Bump requests from 2.32.3 to 2.32.4 (#22)
0bee653 
Bumps [requests](https://github.com/psf/requests) from 2.32.3 to 2.32.4.
- [Release notes](https://github.com/psf/requests/releases)
- [Changelog](https://github.com/psf/requests/blob/main/HISTORY.md)
- [Commits](psf/requests@v2.32.3...v2.32.4)

---
updated-dependencies:
- dependency-name: requests
  dependency-version: 2.32.4
  dependency-type: direct:development
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
@dependabot
Bump coverage[toml] from 7.8.2 to 7.9.0 (#23)
593b2ec 
Bumps [coverage[toml]](https://github.com/nedbat/coveragepy) from 7.8.2 to 7.9.0.
- [Release notes](https://github.com/nedbat/coveragepy/releases)
- [Changelog](https://github.com/nedbat/coveragepy/blob/master/CHANGES.rst)
- [Commits](coveragepy/coveragepy@7.8.2...7.9.0)

---
updated-dependencies:
- dependency-name: coverage[toml]
  dependency-version: 7.9.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
@dependabot
Bump pytest-cov from 6.1.1 to 6.2.0 (#24)
26c86ec 
Bumps [pytest-cov](https://github.com/pytest-dev/pytest-cov) from 6.1.1 to 6.2.0.
- [Changelog](https://github.com/pytest-dev/pytest-cov/blob/master/CHANGELOG.rst)
- [Commits](pytest-dev/pytest-cov@v6.1.1...v6.2.0)

---
updated-dependencies:
- dependency-name: pytest-cov
  dependency-version: 6.2.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
@dependabot
Bump typing-extensions from 4.13.2 to 4.14.0 (#25)
8aaec49 
Bumps [typing-extensions](https://github.com/python/typing_extensions) from 4.13.2 to 4.14.0.
- [Release notes](https://github.com/python/typing_extensions/releases)
- [Changelog](https://github.com/python/typing_extensions/blob/main/CHANGELOG.md)
- [Commits](python/typing_extensions@4.13.2...4.14.0)

---
updated-dependencies:
- dependency-name: typing-extensions
  dependency-version: 4.14.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
@reactive-firewall reactive-firewall added the python Pull requests that update python code label Aug 2, 2026
@reactive-firewall reactive-firewall linked an issue Aug 2, 2026 that may be closed by this pull request
FEATURE: add JSON support for --with-license-files #240
Open
@reactive-firewall reactive-firewall added documentation This is about documentation breaking change ⚠️ This change in not something that just goes unnoticed and requires a major version bump user requested This request came from a user, not the project maintainers chore Chores are miscellaneous tasks that are neither fixing a bug nor adding a feature. follow-up This requires some next step(s) labels Aug 2, 2026
@codecov

codecov Bot commented Aug 2, 2026

Copy link
Copy Markdown

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 100.00%. Comparing base (2a8cfbc) to head (9d2b039).

Additional details and impacted files 
@@             Coverage Diff             @@
##           master      #355      +/-   ##
===========================================
+ Coverage   99.59%   100.00%   +0.40%     
===========================================
  Files           1         1              
  Lines         491       614     +123     
===========================================
+ Hits          489       614     +125     
+ Misses          2         0       -2

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

@reactive-firewall reactive-firewall added release candidate This may be ready for release and removed chore Chores are miscellaneous tasks that are neither fixing a bug nor adding a feature. labels Aug 2, 2026
This was linked to issues Aug 2, 2026
Root Cause Analysis of CI/CD v5.6 regression from filelock #338
Closed
CHORE: Update test-cases to workaround change in filelock (e.g., 3.1.9 uses "unlicensed" license) #337
Closed
Chore - add common options table to documentation #328
Closed
Dev 5.6.0 makefile regressions #296
Closed
REGRESSION: some tests are invalid due to migration of dependency licenses being refactored #292
Closed
Refactor legacy license file search logic too #309
Open
Chore - Update documentation with example for python 3.8 hints. #329
Open
@reactive-firewall reactive-firewall mentioned this pull request Aug 3, 2026
Open
@reactive-firewall reactive-firewall linked an issue Aug 3, 2026 that may be closed by this pull request
Add support to "alternate license files" (e.g. LICENSE.BSD, LICENSE.APACHE) --with-license-file #194
Open
@reactive-firewall
reactive-firewall marked this pull request as ready for review August 10, 2026 02:50
@reactive-firewall reactive-firewall changed the title DRAFT: Pre-Release (Alpha) candidate for v6-series (v6.0.0a1) Pre-Release (Alpha) candidate for v6-series (v6.0.0a1) Aug 10, 2026
@reactive-firewall

reactive-firewall commented Aug 10, 2026

Copy link
Copy Markdown
Collaborator Author

Warning

The alpha pre-release has been released as version 6.0.0a1 and is an OPT-IN pre-release.
This PR however, is NOT ready to be merged to the default branch.

@reactive-firewall reactive-firewall added wontfix This will not be worked on resolved This is considered resolved and removed release candidate This may be ready for release follow-up This requires some next step(s) labels Aug 10, 2026
@reactive-firewall reactive-firewall mentioned this pull request Aug 22, 2026
Merged
2 tasks
@reactive-firewall

reactive-firewall commented Aug 22, 2026

Copy link
Copy Markdown
Collaborator Author

Caution

PR Superseded

This pre-release has now been mostly (except for test_piplicenses.py) superseded by work in #361 (circa development Beta 6.0.0b7).

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment