Is spdx-license-matcher safe to use?

spdx-license-matcher has no known vulnerabilities on the latest version (2.4). DepScope rates its health at 41/100 (high risk).

What is the latest version of spdx-license-matcher?

The latest version of spdx-license-matcher is 2.4, released 2025-04-22.

Does spdx-license-matcher have known vulnerabilities?

No known vulnerabilities on the latest version of spdx-license-matcher.

Is spdx-license-matcher deprecated?

No, spdx-license-matcher is actively maintained. Latest release: 2.4 (2025-04-22).

What are alternatives to spdx-license-matcher?

DepScope has no curated alternatives for spdx-license-matcher at this time.

What license does spdx-license-matcher use?

spdx-license-matcher is licensed under Apache-2.0.

spdx-license-matcher

condav2.4

A tool to match license text with SPDX license list using a an algorithm with finds close matches.

License Apache-2.0permissive3 versions1 maintainers0 deps36 weekly dl

/ 100

Health

use with caution

[email protected] low health (41/100) — consider alternatives

Moderate health score (41/100) — verify manually

Health breakdown0 – 100

5/25

maintenance

0/20

popularity

25/25

security

9/15

maturity

2/15

community

Vulnerabilities

none known

Health History

Dependency Tree

License Audit

API access

Get this data programmatically — free, no authentication.

curl https://depscope.dev/api/check/conda/spdx-license-matcher

First published · 2022-02-05 08:57:45.336000+00:00

Last updated · 2025-04-22 14:58:10.622000+00:00