License data quality improvements

GitHub now sources license information for dependency graph entries directly from package registries such as npmjs.org, PyPI, NuGet, RubyGems, crates.io, pkg.go.dev, deps.dev, pub.dev, and packagist.org, rather than relying primarily on ClearlyDefined. This change improves accuracy across dependency insights, SBOMs, license compliance in GitHub Advanced Security, and the dependency review action. GitHub reports missing license data dropped from 45% to 24% of the 170 million packages tracked, and the system now stores license info as version ranges (e.g., Grafana's Apache-2.0 for 1.0.0–7.5.17 and AGPLv3 for 8.0.0+) instead of requiring per-version entries.

Source: https://github.blog/changelog/2026-08-13-license-data-quality-improvements. 8 Sync News only summarizes and links out; content copyright belongs to the authors and original sources.