From 9b70b8f0853231ca23d7e7e1d477be1c416b2259 Mon Sep 17 00:00:00 2001 From: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com> Date: Sun, 26 Jul 2026 18:03:57 +0000 Subject: [PATCH] Migrate dependency-review from deprecated deny-licenses to allow-licenses (#160) Co-Authored-By: Andreas Igel --- .github/workflows/dependency-review.yml | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/.github/workflows/dependency-review.yml b/.github/workflows/dependency-review.yml index 19d92324..9357cf6e 100644 --- a/.github/workflows/dependency-review.yml +++ b/.github/workflows/dependency-review.yml @@ -56,5 +56,6 @@ jobs: # and still passes. dependency-submission.yml provides snapshots for main. # Fail the PR when it introduces a vulnerability at or above this severity. fail-on-severity: high - # Block copyleft / incompatible licenses that conflict with this MIT project. - deny-licenses: GPL-1.0-or-later, GPL-2.0-or-later, GPL-3.0-or-later, LGPL-2.0-or-later, LGPL-2.1-or-later, LGPL-3.0-or-later, AGPL-3.0-or-later + # Fail closed with licenses derived from the project's full dependency tree, + # replacing the deprecated deny-licenses option. + allow-licenses: MIT, Apache-2.0, BSD-2-Clause, BSD-3-Clause, EPL-1.0, EPL-2.0, CDDL-1.0, CDDL-1.1, ISC, Unlicense, CC0-1.0