Follow CycloneDX 1.4 spec for SPDX license expressions for npm.

[ansonallard]

Support spdx expressions for CycloneDX 1.4 Spec

[prabhu]

@ansonallard any ideas about the test failures?

[ansonallard]

@prabhu Is there a way to see what the inputs were to the test that failed? I just see that the schema validation failed, but I don't have the data to determine why.

[prabhu]

@ansonallard I could never get the jsonschema to return that information. Usually I would run the same test locally and use jq :(

[prabhu]

@ansonallard, could you kindly rebase since we have refactored things a bit. Also, could you take a look at the new known-licenses.json to see if this bug could be resolved with an entry there?

[validide]

Is there any progress on this?

If not I would like move the changes to a new branch and try to fix it.

[prabhu]

@validide New branches are better. Also why are people still using 1.4?

[validide]

It's not just 1.4 I think. I just created an SBOM to test and got the following:

I hope to have this done over the weekend.