Jeremy Long

Many technology stacks will likely have a blank license as identification of the license is a best effort. In most cases this may only be populated on Java libraries.

Have you considered not scanning the dist directory?

Any suggestion on where this should be documented?

resolved with comment https://github.com/dependency-check/dependency-check-gradle/issues/22#issuecomment-575568801. Leaving #22 open for now as documentation - until I get a chance to update the official documentation.

Anyone have an example project that fails? From the above question - I have no clue what is going on. If we have a concrete example I can help.

The solution to the problem is the above comment: https://github.com/dependency-check/dependency-check-gradle/issues/22#issuecomment-575568801