Hi Steve,
The license is known from the parent and it is available at maven as well:
https://mvnrepository.com/artifact/commons-io/commons-io/2.14.0

POM:
Maven Repository: commons-io » commons-io » 2.14.0
https://repo1.maven.org/maven2/commons-io/commons-io/2.14.0/commons-io-2.14.0.pom
-> Parent is
https://repo1.maven.org/maven2/org/apache/commons/commons-parent/62/commons-parent-62.pom
-> Parent is
https://repo1.maven.org/maven2/org/apache/apache/30/apache-30.pom

The license is included in the latter and is inherited.

Thanks,
Frank

Hi Steve,
no changes with the new version. I did a reanalyze by clicking 'analyze' in Build Details under Reporting & SCA.
Did I miss anything?

Thanks,
Frank

Hi Steve,
I will look at an audit report to see if this can be used.

Thanks,
Frank

Hi Steve,
the caching is enabled and the data was downloaded from maven during the night.
This shows the detected license is Apache 2.0 for the version 2.14 of the library:

But why is it still 'none' in the Metadata?

If I pull the libary version to ProGet, the license information is gone:

Looks like local packages 'forget' their license?

Hi,
in the license documentation here
https://docs.inedo.com/docs/proget/administration/license
under SCA & Build Restrictions
there it is mentioned that 'Generate license attribution reports' is available for Enterprise licenses.
I tried to find the feature in the web interface and also looked at all the API functions which are documented but did not find it. How can I create attribution reports for projects?
An attribution report for me lists all libraries/packages, their licenses and copyright details and all licenses are made available as amendment.

Hi,
In Reporting & SCA under projects, builds I can see unknown licenses but they are known:

It should show Apache 2.0.
For newer versions of this library it shows this:

But next to 'maven' in the builds list, it is still unknown also for the newer version.

BTW, dependency track does find the attached license.
I am using the latest version of ProGet.