Registry / serialization / spdx-satisfies

spdx-satisfies

library6.0.0jsnpmunverified

The `spdx-satisfies` library provides a robust utility for programmatically validating whether a given SPDX license expression is satisfied by a predefined list of approved licenses. Currently at version 6.0.0, this package is a direct successor to the deprecated `spdx.js` and focuses specifically on accurate satisfaction checks against the SPDX specification. It supports complex license expressions involving `OR` and `WITH` operators for the license expression being checked, but strictly requires that the 'approved licenses' list contains only simple identifiers, plus-ranges (e.g., `GPL-2.0+`), or licenses with exceptions (e.g., `Apache-2.0 WITH LLVM`), prohibiting compound expressions in the approved list. This strictness makes it a critical tool for open-source license compliance, software supply chain security, and automated dependency scanning, offering precise and machine-readable license verification.

serialization auth-security

npm install spdx-satisfies

github ↗package ↗

INSTALL

IMPORT

SIG · SPDX-SATISFIES

spdx-satisfies

serializationjavascriptv6.0.0

Install

—

Import

—

Disk

—

Pass rate

0/ 6

Env Coverage0 / 6

glibc

18–22

musl

18–22

Install & Compatibility

Where this runs

tested against v? · npm install

Install × environment matrix

Each cell = how many times install + import succeeded across repeated harness runs. Partial = flaky.
glibc = Debian/Ubuntu slim · musl = Alpine Linux

musl

node 18–226 runs

build_error

glibc

node 18–226 runs

build_error

Code

Verified usage

Verified import paths — ran on the pinned version, not inferred.

satisfies

✓ import satisfies from 'spdx-satisfies';

✗ import { satisfies } from 'spdx-satisfies';

The package uses a CommonJS-style default export. For TypeScript or modern ESM, use a default import.

satisfies (CommonJS)

✓ const satisfies = require('spdx-satisfies');

✗ const { satisfies } = require('spdx-satisfies');

For CommonJS environments, the main `satisfies` function is the default export.

Demonstrates how to use the `satisfies` function with various SPDX expressions and an array of approved licenses, including basic, OR, AND, plus-ranges, and WITH clauses.

import satisfies from 'spdx-satisfies'; import assert from 'assert'; const approvedLicenses = ['MIT', 'ISC', 'BSD-2-Clause', 'Apache-2.0', 'GPL-2.0+']; // Basic satisfaction assert.ok(satisfies('MIT', approvedLicenses), 'MIT should satisfy'); assert.ok(satisfies('ISC', approvedLicenses), 'ISC should satisfy'); // Complex expressions with OR assert.ok(satisfies('GPL-2.0 OR MIT', approvedLicenses), 'GPL-2.0 OR MIT should satisfy if MIT is approved'); assert.ok(satisfies('BSD-3-Clause OR Apache-2.0', approvedLicenses), 'BSD-3-Clause OR Apache-2.0 should satisfy if Apache-2.0 is approved'); // Complex expressions with AND (requires both to be approved) assert.ok(!satisfies('GPL-2.0 AND MIT', approvedLicenses), 'GPL-2.0 AND MIT should NOT satisfy if GPL-2.0 is not exact'); // Plus-ranges assert.ok(satisfies('GPL-3.0', approvedLicenses), 'GPL-3.0 should satisfy GPL-2.0+'); assert.ok(!satisfies('GPL-1.0', approvedLicenses), 'GPL-1.0 should NOT satisfy GPL-2.0+'); // License with exception assert.ok(satisfies('Apache-2.0 WITH LLVM-exception', approvedLicenses), 'Apache-2.0 WITH LLVM-exception should satisfy if Apache-2.0 is approved'); console.log('All satisfaction checks passed!');

spdx-satisfies --version

Debug

Known issues

gotchaThe array of 'approved licenses' passed to `satisfies` must only contain simple SPDX identifiers (e.g., `MIT`), plus-ranges (e.g., `GPL-2.0+`), or licenses with exceptions (e.g., `Apache-2.0 WITH LLVM-exception`). It explicitly does NOT support compound expressions using `AND` or `OR` within the approved licenses list itself.

fix

Ensure your `approvedLicenses` array contains only simple, atomic license identifiers, not compound SPDX expressions. If you need to check for a compound approved license, you might need to split it or handle it externally.

affects: >=1.0.0

breakingPrior versions of the underlying SPDX specification (e.g., SPDX 2.x to 3.0) have introduced structural and semantic changes. While `spdx-satisfies` aims to be robust, ensure your SPDX expressions adhere to the expected format, especially if migrating from very old data sources or different SPDX tooling.

fix

Refer to the official SPDX specification (currently 3.0) for updated syntax and best practices. Use tools like `spdx-correct` for validating expression syntax if parsing issues arise.

affects: >=3.0.0

gotchaThe Node.js ecosystem has evolving module system standards (CommonJS vs. ESM). Incorrect module import syntax (e.g., named import for a default export) can lead to runtime errors or unexpected behavior.

fix

Always use `import satisfies from 'spdx-satisfies';` for ESM contexts and `const satisfies = require('spdx-satisfies');` for CommonJS. Avoid named imports `{ satisfies }` as it is a default export.

affects: >=1.0.0

Errors

Common errors & fixes

TypeError: (0 , spdx_satisfies_1.default) is not a function

Attempting to use a named import syntax for what is a default export in an ESM context, particularly when TypeScript is configured to transpile to ESM.

fix

Change `import { satisfies } from 'spdx-satisfies';` to `import satisfies from 'spdx-satisfies';`

Error: Cannot find module 'spdx-satisfies'

The package `spdx-satisfies` is not installed or not resolvable in the current environment, or there's a mismatch in CommonJS/ESM resolution.

fix

Run `npm install spdx-satisfies` or `yarn add spdx-satisfies`. If using ESM, ensure your `package.json` has `"type": "module"` or that import paths are correctly specified (e.g., with `.js` extension if explicit).

Result is unexpectedly `false` when a license should be satisfied.

The approved licenses array contains a compound SPDX expression (e.g., `['MIT AND GPL-2.0']`) which is not permitted, or the SPDX expression being checked is malformed.

fix

Review the `approvedLicenses` array; it should only contain simple license identifiers (e.g., `['MIT', 'GPL-2.0']`). Also, validate the `spdxExpression` string for correct SPDX syntax.

Upgrade

Version history

6.0.0latest on npm

Audit

Dependencies

No dependency data recorded yet.

Agent activity

14 hits · last 30 days

node

OpenAI (training)

Resources

githubhttps://github.com/kemitchell/spdx-satisfies.js ↗

packagehttps://www.npmjs.com/package/spdx-satisfies ↗