Provide a license summary command

[woifes]

Thank you for the license list command in one of the latest releases. If I compare to the package license-checker I would love to see a command which outputs something like the --summary flag of license-checker does.

Example:

npx license-checker --summary
├─ MIT: 6
└─ UNLICENSED: 1

Such an output could be checked by hand or (if provided in a more parseable way) automatically. You can easily see if you have for example a GPL in your dependencies.
License-checker also has an --failOn switch where the command would fail if a certain license is found

Example:

npx license-checker --failOn GPL
Found license defined by the --failOn flag: "GPL". Exiting.

license-checker walks through the node_modules folder, but can not handle the pnpm style node_modules. Additionally it can not separate the output for packages in a monorepo. That is the reason why I am here.

[woifes]

I have an custom made (and little bit of quick and dirty) solution: license-report
Unfortunately I could not get it working with importing the "list" or other packages form pnpm. Therefore I fetch the license over the npm API

[weyert]

What's wrong with using pnpm licenses list --json ?

Gives for example:

{
  "MIT": [
    {
      "name": "is-buffer",
      "version": "1.1.6",
      "path": "/Users/weyert/tijdelijk/license-proto/pnpm-licenses-workspaces-v2/node_modules/.pnpm/[email protected]/node_modules/is-buffer",
      "license": "MIT",
      "author": "Feross Aboukhadijeh",
      "homepage": "https://github.com/feross/is-buffer#readme"
    },
  ],
  "Apache-2.0": [
    {
      "name": "typescript",
      "version": "4.8.4",
      "path": "/Users/weyert/tijdelijk/license-proto/pnpm-licenses-workspaces-v2/node_modules/.pnpm/[email protected]/node_modules/typescript",
      "license": "Apache-2.0",
      "author": "Microsoft Corp.",
      "homepage": "https://www.typescriptlang.org/"
    }
  ]
}

Personally, I think --failOn is a bit out of the scope of the current command. Especially, when you have existing tools like https://github.com/pivotal/LicenseFinder. This tool was the main reason I worked on adding the licenses-command

[woifes]

Hello, there is absolutely nothing wrong with the command. In fact it is really good. For the purpose of having a quick overview it is a little bit to verbose.
So my implementation should only be seen as an example for what I want to achive:

• Get a summery of what licenses I have (implemented)
• Mark licenses which are not proberly defined (mabye the package.json license field is wrong)
• Get a quick overview of the dependency tree with the corresponding licenses to check where a license is comming from (implemented)

You are right I could have used the output of pnpm licenses list --json in order to not have to fetch every license from npm. Maybe I change my implementation in that way.
In the end the output of my implementation should be enough to check the licenses "by hand" in order to decied if you (or your subdependencies) are compatible.
Edit:
Additionally in a monorepo I will atm get always all dependencies of the whole repo with pnpm licenses list and not just the package I am checking. pnpm list does not have this limitation.