Update npm: License Cop to v2

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
@license-cop/permissive (source)	^1.8.1 → ^2.0.0
license-cop (source)	^1.8.1 → ^2.0.0

---

Release Notes

tobysmith568/license-cop (@​license-cop/permissive)

v2.2.0

Compare Source

Added

• Yarn Plug'n'Play support. license-cop can now scan a yarn 2+ project that uses Plug'n'Play (yarn's default), which has no node_modules. It reads the project's .pnp.cjs and the packages in your yarn cache (including the global cache and zero-install repositories) or in .yarn/unplugged. Yarn 3 and 4 are tested. Previously this was refused with an error asking you to set nodeLinker: node-modules; that is no longer needed. Reading a Plug'n'Play project loads its .pnp.cjs, which is JavaScript that yarn generates, so only scan a project you trust (see "Supported projects" in the docs).

v2.1.2

Compare Source

Release v2.1.2

Download from npm: npm install [email protected] --save-dev

What's Changed

• Switch the core package over to an OO design by @​tobysmith568 in #​271

Full Changelog: tobysmith568/license-cop@v2.1.1...v2.1.2

v2.1.1

Compare Source

Release v2.1.1

Download from npm: npm install [email protected] --save-dev

Full Changelog: tobysmith568/license-cop@v2.1.0...v2.1.1

v2.1.0

Compare Source

Added

• bun support. license-cop can now scan a project installed with bun, both of its linker modes: the default flat, npm-compatible node_modules for a single-package project, and the isolated linker (bun's default for a workspace, or set explicitly via bunfig.toml's [install] linker = "isolated"), which it reads the same way it already reads a pnpm install.

v2.0.0

Compare Source

Breaking Changes

• The programmatic API moved to @license-cop/core. license-cop is now bin-only; checkLicenses, LicenseCopOptions and the result types (CheckLicensesResult, AllowedPackage, LicensedPackage, NoLicenseResult, ForbiddenLicenseResult) are no longer exported from it. Run npm install @license-cop/core and import from there instead. The exports are unchanged, only the package.
• The published file layout changed. The CLI entry point is now dist/bin.js (was src/bin/license-cop), and internal files are bundled into dist/ instead of shipped one file per module. Invoke the command by name (npx license-cop, an npm script, or node_modules/.bin/license-cop) rather than by path, and replace any deep imports from license-cop/src/... with the public exports of @license-cop/core.
• Both packages are now ESM-only. There is no CommonJS build. require("@license-cop/core") no longer works; switch to import, or await import("@license-cop/core") if the caller can't move off CommonJS. The CLI itself is unaffected, however it's invoked.
• --init flag removed. Run license-cop init instead; it does exactly the same thing.
• -D, --include-dev and --dev-only replaced by --dev-dependencies <mode>. -D/--include-dev becomes --dev-dependencies include; --dev-only becomes --dev-dependencies only. The config file's includeDevDependencies and devDependenciesOnly keys are unchanged.
• init no longer overwrites an existing config. It now fails and names the file if the project already has one (any supported name/location, or a licensecop key in package.json). Delete the existing config first if you want to regenerate it.
• Unexpected errors no longer print a raw stack trace. They print error: <message> on stderr and exit 1. Pass --verbose to get the stack trace back.
• The failure report now goes entirely to stderr. The Found the following issues... header used to go to stdout while the details went to stderr, splitting the report across streams. Read stderr (or both streams), or rely on the exit code, which is unchanged (1 when there are issues).
• A project with no installed dependencies now fails instead of passing. Previously an unscanned project (no node_modules) reported success. Install dependencies before running license-cop. For a workspace member under npm or yarn, where dependencies are hoisted to the root, run it from the workspace root instead.
• Workspace members are no longer scanned as if they were dependencies. A member without a license field used to fail the check; members are now treated as the project's own code and skipped (their dependencies are still checked). You can remove any allow-list entry you added only to work around this.
• pnpm workspace roots now scan every member's dependencies, not just the root's own. This can surface dependencies, and licenses, that the check previously never looked at.
• pnpm: --dev-dependencies only now actually scans dev dependencies. It previously scanned nothing on pnpm and always passed.
• pnpm: optional dependencies are now scanned, matching npm and yarn. An installed optional dependency with a forbidden or missing license can now fail the check where it previously passed.
• A child config now inherits the parent's dev-dependency settings through extends, when it doesn't set them itself, instead of silently resetting them to false. If you rely on a child not scanning dev dependencies even though its parent does, set includeDevDependencies/devDependenciesOnly to false explicitly in the child.
• OR license expressions are now satisfied by either side. A package licensed e.g. (MIT OR GPL-3.0) now passes if either license is allowed, not only if both are. You can remove any allow-list entry you added only to work around the old, stricter behaviour.

v1.9.0

Compare Source

Release v1.9.0

Download from npm: npm install [email protected] --save-dev

What's Changed

• Update pipelines to Node 24 by @​tobysmith568 in #​219
• Bump deps by @​tobysmith568 in #​234

Full Changelog: tobysmith568/license-cop@v1.8.1...v1.9.0

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about these updates again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 43.41%. Comparing base (365c96a) to head (855e037).
⚠️ Report is 2 commits behind head on main.

Additional details and impacted files

@@           Coverage Diff           @@
##             main     #897   +/-   ##
=======================================
  Coverage   43.41%   43.41%           
=======================================
  Files          25       25           
  Lines         258      258           
  Branches       46       46           
=======================================
  Hits          112      112           
  Misses        146      146           

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.