Dependency review fails on file-licensed packages (LibGit2Sharp, WindowsAppSDK, SDK BuildTools) #53

New Issue

2026-10-09T11:21:35Z

KofTwentyTwo commented

2026-10-09 11:21:35 +00:00

(Migrated from github.com)

Problem

The Dependency Review check on the dev → main PR (#51) failed on licenses only (no vulnerabilities): LibGit2Sharp, Microsoft.WindowsAppSDK and Microsoft.Windows.SDK.BuildTools declare their license as a file in the nuspec rather than an SPDX expression, so the dependency graph reports LicenseRef-scancode-unknown / NOASSERTION. Any version bump of these three therefore fails the gate, even though all three have been dependencies since the first commit.

Resolution (in PR #51)

allow-dependencies-licenses in .github/workflows/dependency-review.yml exempts exactly those three package URLs from the license check, with their actual licenses recorded beside the exemption (LibGit2Sharp: MIT; Microsoft.WindowsAppSDK: Microsoft Software License Terms; Microsoft.Windows.SDK.BuildTools: Windows SDK license). Vulnerability scanning is unchanged for them.

## Problem The Dependency Review check on the `dev → main` PR (#51) failed on **licenses only** (no vulnerabilities): LibGit2Sharp, Microsoft.WindowsAppSDK and Microsoft.Windows.SDK.BuildTools declare their license as a *file* in the nuspec rather than an SPDX expression, so the dependency graph reports `LicenseRef-scancode-unknown` / `NOASSERTION`. Any version bump of these three therefore fails the gate, even though all three have been dependencies since the first commit. ## Resolution (in PR #51) `allow-dependencies-licenses` in `.github/workflows/dependency-review.yml` exempts exactly those three package URLs from the license check, with their actual licenses recorded beside the exemption (LibGit2Sharp: MIT; Microsoft.WindowsAppSDK: Microsoft Software License Terms; Microsoft.Windows.SDK.BuildTools: Windows SDK license). Vulnerability scanning is unchanged for them.

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: KofTwentyTwo/gclo#53