GitHub Enhances Dependency License Data Quality with Package Registries
GitHub now leverages package registries like npmjs.org and PyPI to determine license information for software components within its dependency graph. This change significantly improves the accuracy and completeness of licenses displayed in dependency insights, software bills of materials (SBOMs), and GitHub Advanced Security's open source license compliance feature. By prioritizing registry data over the previous primary source, ClearlyDefined, GitHub has halved the number of missing licenses, dropping from 45% to 24% across 170 million packages. The system also tracks license history via version ranges, streamlining data management and ensuring more comprehensive coverage.
Enhancements (1) ›
- Improved License Data Quality for Dependency Graph
GitHub's dependency graph service now uses canonical package registries (e.g., npmjs.org, PyPI) as the primary source for license information, enhancing accuracy and completeness. This update benefits dependency insights, SBOMs, GitHub Advanced Security's license compliance, and the dependency review action. The shift has reduced missing licenses in the dependency graph by half and supports tracking license changes across version ranges.
https://github.blog/changelog/2026-08-13-license-data-quality-improvements
Related releases
- Gemini 3.7 Flash now available in GitHub Copilot GitHub Changelog ·
- Block users from comments in personal repositories on GitHub GitHub Changelog ·
- GitHub Copilot introduces Agent Plugins 1.0 for cross-client development GitHub Changelog ·
- GitHub Details Organization-Level Repository Rule Insights GitHub Changelog ·
- GitHub Enterprise Server 3.22 Release Candidate Now Available GitHub Changelog ·
- GitHub Copilot for JetBrains adds persistent memory, Ollama integration, and enterprise controls GitHub Changelog ·