Changed

• The minimum-supported Gradle version is now (tested as) 8.12. What was it before? Entirely unspecified!

New

• Support overriding artifacts.json report path bundled into your Android APK (under assets/ path).

  licensee {
    bundleAndroidAsset = true
    androidAssetReportPath = "example/licenses.json"
  }
  

• Update SPDX database to version 3.27 (2025-07-01).

Changed

• In-development snapshots are now published to the Central Portal Snapshots repository at https://central.sonatype.com/repository/maven-snapshots/.

• Limit the plugin used Kotlin language version to 1.8 to ensure support for Gradle 8.

  This is the last release with Gradle 8 support.

New

• DSL now has a type-safe version of allow which accepts a SpdxId constant.

  licensee {
    allow(SpdxId.Apache_20)
  }
  

• The artifacts.json report can now be automatically bundled into your Android APK (at app/cash/licensee/artifacts.json path).

  licensee {
    bundleAndroidAsset = true
  }
  

• Update SPDX database to version 3.26 (2024-12-30).

Changed

• Removed Kotlin stdlib dependency. This is provided by the enclosing Gradle classpath in which the plugin is running.

Changed

• Update SPDX database to version 3.25 (2024-08-19).
• Add fallback URL for popular MIT variant.

New

• LicenseeTask exposes jsonOutput and validationOutput properties which are providers of the generated file that you can use to copy elsewhere or bundle into binaries.

Changed

• Invalid SPDX identifiers passed to allow will now throw an exception.
• Update SPDX database to version 3.23 (2024-02-08).

New

• Gradle platform dependencies (also sometimes called BOMs) are now ignored since they only contribute version constraints and no code.

Fixed

• Avoid task name showing up in logs when logging is disabled but unused licenses are present.

Added

• Add configuration option for behavior on unused license. By default we log, but you can now choose to ignore.

  licensee {
    unusedAction(IGNORE)
  }

• New fallback URL for ISC.

Changed

• Update SPDX database to version 3.22 (2023-10-05).

Changed

• Fallback URLs now map to multiple license SPDX IDs where appropriate.
  For example, https://opensource.org/license/gpl-2-0 matches both GPL-2.0 and GPL-2.0-or-later.

• Remove the use of afterEvalute internally. This causes some task names to slightly change and the output folders
  to slightly change when used with the Android Gradle plugin.

• Update SPDX database to version 3.21 (2023-06-18).

• Minimum Gradle version is now 8.0

Added

• When allowing a URL, a reason can now be provided using the because method.

  allowUrl("https://example.com/license.html") {
    because("is Apache-2.0")
  }

• Custom tasks can be created to check custom configurations or language plugins which do not have first-party support.

  tasks.register('licenseeFoo', app.cash.licensee.LicenseeTask) {
    configurationToCheck configurations.foo
    outputDir.set(layout.buildDirectory.dir('reports/licenseeFoo'))
  }

• Version catalog references are now supported by allowDependency.

  allowDependency(libs.exam) {
    because("there are reasons!")
  }

Changed

• License URLs which map to multiple SPDX identifiers will now match against any of those identifiers.

  For example, if a license URL matches both EXAMPLE and EXAMPLE-with-exemption you can mark either of those
  IDs as allowed and the dependency will be allowed.

Fixed

• Support reading Maven pom files which use property substitution (${something}) in their XML.
• Support for Gradle configuration cache.
• LicenseeTask is now cachable.