Fall Back On Licenses Field if License Field is Missing

[Kurt-von-Laven]

Is your feature request related to a problem? Please describe.

Some old packages like [email protected] and [email protected] use the deprecated licenses property in their package.json without using the recommended license property.

Describe the solution you'd like

It would be ideal if the license were extracted from these packages when the license property is missing (perhaps only in --loose mode or behind a separate flag), and the type of all licenses in the array were combined into a single conjunctive (ANDs, not ORs) SPDX expression. It seems ambiguous whether these arrays are intended to represent conjunctive or disjunctive SPDX expressions, and I imagine anyone who cares enough about licenses to use your most excellent plugin would prefer to err on the side of caution.

Describe alternatives you've considered

As a workaround, one can manually validate license compatibility for these packages and then configure CI to ignore specific test failures. A more convenient workaround might be to offer the package name and version number as parameters to isValidLicense so that the configuration can contain an allow list of manually validated licenses.

A more ambitious alternative is for all users of this plugin to open pull requests against all packages that still use the licenses property in their package.json and subsequently nudge all downstream packages to upgrade to the newer version of this package. That is a great civic action to take regardless, but this significantly increases the amount of friction involved in the typically thankless task of license auditing that is rarely prioritized to begin with.

Additional context

[email protected] and [email protected] are indirect dependencies of [email protected]. exit is no longer maintained; a pull request moving from licenses to license in its package.json has been ignored for 6 years.