Patch Notes for v6.0.0 Beta Candidate (v6.0.0b11)

A second peek at some of the big changes coming in pip-licenses v6.

Impacted GHIs:

• Contributes to work on #71 (W.I.P.)

  • And Related

    • Also Resolves #239
    • Also contributes to work on #240 (W.I.P.)
    • Also contributes to work on #241 (W.I.P.)
    • Also contributes to work on #242 (W.I.P.)

• Contributes to work on #81 (W.I.P.)

• Closes #194 (still unreleased)

• Resolves #309

• Resolves #316
• Resolves #319 (No longer relevant)

• Contributes to #327 (remains unresolved)

• Closes #328
• Resolves #329
• Closes #337
• Closes #338
• Resolves #365
• Resolves #366

Included & Superseded PR/MRs

• Supersedes #355
  • Supersedes #324
  • Includes & Supersedes #325
  • Includes & Supersedes #326
  • Includes & Supersedes #328
  • Supersedes #332
  • Includes & Supersedes #337
  • Supersedes #339
  • Supersedes #341
  • Supersedes #343
  • Supersedes #346
• Supersedes #350
• Supersedes #351
• Supersedes #357
• Includes & Supersedes #361
• Includes #362
• Includes & Supersedes #367

Copilot Summary

🎯 Major Changes

Complete Codebase Refactoring

• Moved from single-module to package structure: The monolithic piplicenses.py has been split into a modular package with organized submodules:
  • piplicenses/__init__.py - Main package entry point
  • piplicenses/__main__.py - CLI entry point
  • piplicenses/cli/ - Command-line argument parsing and configuration
  • piplicenses/core.py - Core license discovery logic
  • piplicenses/output/ - Output formatting (tables, JSON, CSV, HTML, etc.)
  • piplicenses/sorting.py - License comparison and filtering utilities
  • piplicenses/constants.py - Centralized constants and field definitions
  • piplicenses/tomli_bridge.py - TOML file handling shim

Configuration System Enhancement

• Replaced argparse.Namespace with dataclass-based Configuration object for better type safety and IDE support
• Improved configuration file loading and merging logic
• Support for environment-based Python executable selection

API Changes (Breaking Changes)

• Removed: Monolithic piplicenses.main() entry point moved to piplicenses.__main__.main()
• Renamed CLI arguments for consistency:
  • --with-license-file → --with-license-files (plural form added)
  • --with-notice-file → --with-notice-files (plural form added)
  • --no-version → --without-version (standardized naming)
  • --no-license-path → --without-license-paths (standardized naming)
• New CLI options:
  • --with-other-files - Include other licensing-related files
  • --no-file-paths - Suppress all file path outputs
  • --format=expression - Support for PEP-639 license expressions

✨ New Features

PEP-749 Compliance

• Aligned with PEP-749 (formerly PEP-753) regarding typing.TYPE_CHECKING deprecation
• Improved support for modern Python package metadata standards

Enhanced URL/Homepage Extraction

• New extract_urls() function for comprehensive Project-URL parsing
• Fallback to legacy home-page metadata field for compatibility
• Support for well-known project URL labels (source, repository, documentation, etc.)

Multiple License File Support

• Handle packages with multiple LICENSE files (GHI #71 - WIP)
• New --with-license-files flag for extracting all license files
• Support for license file deduplication

Extended Output Formats

• Improved HTML table generation with <thead> and <tbody> tags
• Enhanced JSON output for structured data processing
• Better CSV escaping for RFC 4180 compliance

🐛 Bug Fixes

Priority Logic Regressions (GHI #309)

• Fixed non-deterministic ordering of multiple-source license results
• Improved consistency in license resolution order

Test Regressions (GHI #337, #338)

• Resolved version bump incompatibilities affecting multiple test suites
• Updated test fixtures to match current package versions
• Fixed Python 3.9 coverage regression in CI

False Positive CVE Fixes

• CVE-2026-4539 ReDoS
• CVE-2026-44432 Leak
• CVE-2026-44431

📝 Documentation Updates

README Improvements (GHI #328 - WIP)

• Added Python 3.8 legacy installation instructions (pip-licenses <5.0)
• Updated command examples with current package versions
• Improved option table formatting
• Added HTML output with proper semantic structure
• Updated Dockerfile references from Python 3.11 to 3.14
• Fixed C/C++ Extensions notation ("C++" instead of "C ++")

Contributing Guidelines

• Added make local-ci-check target for pre-push validation
• Fixed typos in contribution documentation

🔧 Infrastructure Changes

CI/CD Pipeline Updates

• Updated GitHub Actions versions:
  • actions/checkout@v7.0.0 (from v6.0.2)
  • actions/attest@v4.1.1 (from v4.1.0)
  • codecov/codecov-action@v7.0.0 (from v6.0.0)
  • actions/upload-artifact@v7.0.1 (from v7.0.0)
• Updated Python version from 3.13 to 3.14 as default
• Bumped build tool requirements:
  • pip ≥26.0.1 (from ≥26.0)
  • setuptools ≥83.0 (from ≥82.0)
  • wheel ≥0.47 (from ≥0.45)

Dependabot Configuration

• Improved pip dependency grouping and scheduling
• Added build/packaging dependency tracking
• Configured separate tracking for different target branches

Development Dependencies

• Major version bumps across the stack
• Removed twine from development dependencies (simplified build process)
• Pinned mypy==1.19.1 for Python 3.9 support
• Updated test framework versions
• Enhanced linting with Ruff configuration adjustments

Project Configuration

• Updated pyproject.toml structure for modern Python packaging standards
• Reorganized setuptools configuration
• Improved metadata field definitions (PEP-621 compliance)

📚 Version Information

• Current Version: 6.0.0b10 (Beta)
• Status: Subject to change in next release
• Python Support: 3.9.6+
• Target Release: 6.0.0 final

⚠️ Breaking Changes Summary

1. Module structure - Import paths have changed due to package refactoring
2. CLI argument names - Standardized naming conventions (see API Changes above)
3. Type changes - Configuration is now a dataclass instead of Namespace
4. Behavior changes - License file handling now supports multiples

🔮 Upcoming Work (In Progress)

• GHI #316: Complete modularization refactoring
• GHI #242: New flags implementation (W.I.P)
• GHI #71: Improved handling of multiple license files (partially implemented)

🙇 Special thanks to...

• @matejkloska for their interest, and contributions in keeping the documentation updated
• @johnthagen for motivating much of this work, and again for their consistent interest
• @stefan6419846 for inspiring fixes, sharing insights, and giving feedback and code-reviews!
• @SAY-5 for their contributions
• Everyone else who opened a GHI or contributed (you now who you are)

Full Changelog: v-6.0.0a1...v-6.0.0b11

What's Changed

• Multiple Development (v6 betas) re-joined by @reactive-firewall in #361
• DRAFT - Patch known fixes for tests by @reactive-firewall in #362
• New Feature: markdown support for license files (paths only) by @reactive-firewall in #367

Full Changelog: v-6.0.0a1...v-6.0.0b10

Patch Notes

A sneak peek at some of the changes coming in pip-licenses v6 and some minor documentation corrections.

Container version bump 📦

Include with this release is a preview of the next LTS container version via, a long overdue, updated Dockerfile

Documentation 📃 (because it's not really about security with these)

Numerous examples throughout the README.md (which is included in the official distributions, and may worry your favorite security tools) have been updated thanks to work by @matejkloska 🎉

Security 🔏

Fixed false positive of: CVE-2026-4539 reDoS. Removed optional (and historical) use of twine to fix alert.

Fixed false positive of CVE-2026-44432. Removed optional (and historical) use of twine to fix alerts.
Fixed false positive of CVE-2026-44431.

Experimental flags 🎏

• --with-*-files (as originally suggested by @johnthagen) plural nomenclature (file vs files) will lead to a more intuitive usage - these will be formally introduced in a future stable release (but this is an early sneak peek currently based on work by @stefan6419846)

These initial new flags are currently implemented in a purely stop-gap form (as they are based on the PR stefan6419846/pip-licenses-cli#132 (which was originally a fix for stefan6419846/pip-licenses-cli#8 that @johnthagen is similar to #71 and #242). To completely fix GHI #71 and related, full support of multiple licenses for a single package will become the default. This seemingly small design change will have impacts throughout the entire codebase. But for most users this hopefully will just look like adding an s to the --with-license-file flag (and the plan is to replace the old flag mostly behind the scenes to minimize potential breaking changes) or even no change to usage just a noisy depreciation warning that can be ignored (this re-design is not really about removing any features)

So yeah this would-be the next v5.5.x if not for all that; hence the bump to v6 (alpha))

Impacted GHIs:

• Closes #194

• Contributes to #309 (WIP)

• Closes #328

• Contributes to #327 (remains unresolved)

• Closes #329
• Closes #337
• Closes #338

• Contributes to #242 (WIP)
  • and related...

    • Contributes to #71 (WIP)
    • Contributes to #240 (WIP)
    • Contributes to #241 (remains unresolved)

• Resolves/Closed #352

Included & Superseded PR/MRs

• Supersedes #324
• Supersedes #325
• Includes & Supersedes #326
• Includes & Supersedes #328
• Supersedes #332
• Includes & Supersedes #337
• Includes #339
• Supersedes #341
• Supersedes #343
• Includes #346

Full Changelog: v-5.5.5...v-6.0.0a1

Special thanks to...

• @matejkloska for requesting this pre-release
• @johnthagen for motivating much of this work, and consistent interest
• @stefan6419846 for inspiring fixes, sharing insights, and giving feedback and code-reviews!
• @SAY-5 for their contributions

Patch Notes for 5.5.5

Combines recent pre-releases (including 5.5.2-5.5.4) to deliver significant codebase cleanup and lays the groundwork for upcoming changes planned for version v6.0.

What's Changed

• (RC-3) Additional tweaks to CHANGELOG and various comments.
• (RC-2) Updated Copyright lines and made note of new maintainer
• (RC-1) Reverts experiments from PR #313 to prepare for a proper release.

Full Changelog: v-5.5.4...v-5.5.5

Patch Notes for 5.5.4

Notable Changes

Fixes #288. See GHI #288 & PR #313 for more info and relevant discussion.

• Implements/Configures support for prek
  • Implemented initial pre-commit-config.yaml based on work by @DimitriPapadopoulos
• Implements additional support for typing
  • Extended recent ruff configurations
    • Aligned ruff rules for style a more black compatible experience
    • Enabled rules for linting type annotations with ruff
  • Added new type annotations through-out the codebase, including for test-code
  • Added new experimental linter that aims to support the entire Python Typing spec.
• Updated and re-tooled development dependencies
  • Refactored tooling with more robust handling of pinning the known filelock dependency across python versions
  • Several version bumps (still targeting Python 3.9+)
  • re-factored/re-tooled the Makefile for developer workflows

Impacted GHI

• Closes #288 (Wontfix)
  • Closes #314 (fixed)
  • Closes #315 (fixed)

• Contributes to #319

Included and superseded PRs

• Includes & supersedes #298
• Includes & supersedes #304
• Includes & supersedes #305
• Includes & supersedes #306
• Includes & supersedes #310
• Includes & supersedes #311
• Supersedes #313
• Includes & supersedes #317
• Includes & supersedes #318

Patch Notes for 5.5.3

Notable Changes

🎉 A huge thanks to @DimitriPapadopoulos for their contributions.

• Aligned parsing logic with PEP 753
• Refactored to better leverage f-strings to improve performance slightly

Included and superseded PRs

• Includes & supersedes #300
• Includes & supersedes #301
• Supersedes #302

What's Changed

• Fix warning in tests by @DimitriPapadopoulos in #304
• Get rid of Python 3.5 left-over by @DimitriPapadopoulos in #305
• Use f-strings by @DimitriPapadopoulos in #301
• Improve package home page discovery by @DimitriPapadopoulos in #306
• Additional codebase cleanup

Full Changelog: v-5.5.2...v-5.5.3

Patch Notes for 5.5.2

This update migrates from the linters black and isort to ruff (Code style remains PEP-8 aligned, but should be slightly more readable).

Notable Changes:

• Added support for multi-line allow-only and fail-on arguments
  • Relaxed parsing of most whitespace around semicolon delimeter
• Added simple SECURITY.md policy document
• Fixed a duplication behavior in output when a package was found at multiple paths (e.g., symlinks)
• Fixed issue where lowercase license filenames were ignored
• Improved project Makefile stability for developers
• Migrated from the linters black and isort to ruff
  • Code style remains PEP-8 aligned, but should be slightly more readable.
  • Linting configuration remains in pyproject.toml
• Updated CONTRIBUTORS.md guide with related changes

Impacted GHI

• Closes #208
• Closes #250
• Closes #273
• Closes #290
  • Closes #296
• Closes #292

Included and superseded PRs

• Supersedes #221
• Includes and supersedes #261
• Includes and supersedes #287
• Includes and supersedes #289
• Includes and supersedes #291
• Includes and supersedes #297

Full Changelog: v-5.5.1...v-5.5.2

Patch Notes for 5.5.1

Contains packaging and CI updates, dependency/dev-dependency security updates, small code/style fixes (typos, formatting), and preparation for PEP-compliant metadata and sdist behaviour.

Notable user-visible changes

• Version bump: version set to 5.5.1 (piplicenses.py).
• Typos fixed: README examples and internal docstrings (codespell fix).
• Formatting: Applied black 26.1.0 changes across the codebase.
• CI/CD:
  • Upgraded GitHub Actions runners/actions versions used in workflows:
    • actions/checkout → v6.0.1
    • actions/setup-python → v6.1.0
    • actions/upload-artifact → v6.0.0
    • actions/download-artifact → v7.0.0
    • codecov/codecov-action → v5.5.2
  • Workaround to bypass black lint step for Python 3.9 (black GHA failures with v3.9).
• Packaging & metadata:
  • pyproject.toml: made PEP-compliant changes:
    • build-system requires reviewed
      • project URLs normalized to "homepage", "releasenotes", "issues" (PEP-753 well-known labels)
      • MANIFEST.in updated to use a prune/exclude strategy suitable for setuptools-scm (avoid duplicative explicit include lists).
    • project.license and license-files fields normalized (PEP-639)
    • requires-python remains >=3.9 (note: CI deprecates 3.9 for black)

Developer dependencies updated (security/maintenance):

• urllib3 bumped 2.5.0 → 2.6.3
• wheel bumped 0.45.1 → 0.46.2

Small code cleanups:

• minor whitespace/annotation/style alignment and improved tuple assignment readability in piplicenses.py
• some filename/text extraction behavior unchanged but formatting and docstrings clarified.

Files (high-level) changed in this PR

piplicenses.py — version bump, docstring typo fix, style/formatting adjustments
CHANGELOG.md — added 5.5.1 notes
pyproject.toml — PEP-639/753 packaging metadata and URL label normalisation
MANIFEST.in — adapted for setuptools-scm (prune/exclude)
dev-requirements.txt — urllib3, wheel updates
.github/workflows/python-package.yml and .github/workflows/CD-PyPi.yml — updated action references, black job conditional, upload/download artifact and codecov action upgrades

Impacted GitHub Issues (GHI)

• Closes #209
• Closes #264
• Opened #265
• Closes #266
• Closes #269
• Closes #270

Included / Supersedes PRs

• Supersedes #251
• Includes and Supersedes #252
• Includes and Supersedes #253
• Includes and Supersedes #254
• Includes and Supersedes #255
• Includes and Supersedes #256
• Includes and Supersedes #257
• Includes and Supersedes #258
• Includes and Supersedes #259
• Includes and Supersedes #260
• Includes and Supersedes #263
• Includes and Supersedes #271
• Includes and Supersedes #275
• Supersedes #278
• Supersedes #281

Thanks to these Contributors 🙇

• @Akshat1931 made their first contribution in #244
• @kaine-bruce-dmt made their first contribution in #245
• @cnaples79 made their first contribution in #249
• @DimitriPapadopoulos made their first contribution in #260

Full Changelog: v-5.5.0...v-5.5.1

Patch Notes for 5.5.0

• Minor Security updates
• Initial Implementation of PEP-639 support
• Initial support for builtin tomllib for Python 3.11+ (reducing external dependencies by 1)
• Fixes an edge case where packages are named with version info.
• Declares support for Python 3.13 & 3.14

Impacted GHI:

• Closes #225
• Closes #232

• Contributed to #236

Included and Superseded PRs

• includes and supersedes #210
• includes and supersedes #213
• includes and supersedes #214
• includes and supersedes #215
• includes and supersedes #218
• includes and supersedes #219
• includes and supersedes #222
• includes and supersedes #230

• Dropped support Python 3.8
• Clarified support for Python 3.12
• Migration pyproject.toml about this package
• Breaking changes
  • Implicitly depends on tomli library since version 4.5.0