Read the report#
licenseal check prints a table. -f markdown and -f json give the same report as Markdown or as JSON.
A line above the table names the project license that every row is judged against, and the file it was read from. Proprietary (assumed: …) means that licenseal found no license for the project.
The table#
| Column | What it shows |
|---|---|
| Package | The package and the version that was checked. A transitive dependency is indented under the direct dependency that pulls it in |
| Ecosystem | python, npm, rust, go, java, dotnet, php, ruby, hex, or r |
| Group | prod or dev |
| Source | The manifest that declares a direct dependency. Empty for a transitive |
| License | The license, as an SPDX expression; UNKNOWN when none could be read. For a reviewed dependency, the reviewed license |
| Risk | The risk level: permissive, weak-copyleft, strong-copyleft, network-copyleft, or unknown |
| Status | The verdict: ✓ compatible, ⚠ warning, ✗ violation, ? unknown |
A ~ before a version or a license marks an estimate.
A report has one row per package, resolved version, and origin (the repository, URL, or path of an off-registry dependency). Several versions of one package can be in it, each with its own license lookup: a graph can hold lodash@4.x and lodash@3.x through different paths, and the manifests of one tree can ask for different versions.
- Direct dependencies are listed alphabetically, each with its transitives indented beneath it, also alphabetically, so a flagged transitive leads back to the direct dependency you would remove to drop it.
- A transitive that several direct dependencies pull in is listed once, under the alphabetically first, with an
(also: X, Y)annotation. JSON has the full list indirect_ancestors(withdepthandis_transitive).
Piped, or written with -o, the table is at its full width with one line per dependency. On a terminal narrower than the table, cells wrap and no column is dropped. When stdout's encoding cannot represent the report's glyphs (a legacy Windows code page), OK, !, and X are printed for ✓, ⚠, and ✗.
Under the table#
- Summary: how many dependencies are violations, warnings, unknown, and ok, how many of them are reviewed, and the number of analysis gaps and estimated manifests.
- Analysis gaps and Estimates: each file the scan could not fully read, or whose dependencies were estimated, with the reason. See What fails a check.
- Details: the reason for every dependency that is not compatible.
- Reviewed: each reviewed dependency, with its detected license, its reviewed license, and the note.
A flagged row#
A row marked ⚠, ✗, or ? is flagged, and by default it fails the check. Details gives the reason.
- How licenseal decides says what each verdict means.
- Fix a failing check says what to do, symptom by symptom.
- The Claude Code skill walks you through each flagged row.
- Review flagged dependencies shows how to record a decision about a dependency you have looked into.
Write it to a file#
-o FILE writes the report as UTF-8 (the table without ANSI escapes). The file is written even when findings or analysis gaps fail the check, so CI can publish it (an error, such as an invalid review file or unreachable registries, writes none); a failing check then also prints the summary and the findings that failed it, with the number of analysis gaps, to stderr.
The table and Markdown formats escape the strings that come from registries and scanned files (control characters, and Markdown and HTML syntax), so a package name or a license string cannot add a link, markup, or a table column. JSON reports the original strings.