Patch Notes

A sneak peek at some of the changes coming in pip-licenses v6 and some minor documentation corrections.

Container version bump 📦

Include with this release is a preview of the next LTS container version via, a long overdue, updated Dockerfile

Documentation 📃 (because it's not really about security with these)

Numerous examples throughout the README.md (which is included in the official distributions, and may worry your favorite security tools) have been updated thanks to work by @matejkloska 🎉

Security 🔏

Fixed false positive of: CVE-2026-4539 reDoS. Removed optional (and historical) use of twine to fix alert.

Fixed false positive of CVE-2026-44432. Removed optional (and historical) use of twine to fix alerts.
Fixed false positive of CVE-2026-44431.

Experimental flags 🎏

• --with-*-files (as originally suggested by @johnthagen) plural nomenclature (file vs files) will lead to a more intuitive usage - these will be formally introduced in a future stable release (but this is an early sneak peek currently based on work by @stefan6419846)

These initial new flags are currently implemented in a purely stop-gap form (as they are based on the PR stefan6419846/pip-licenses-cli#132 (which was originally a fix for stefan6419846/pip-licenses-cli#8 that @johnthagen is similar to #71 and #242). To completely fix GHI #71 and related, full support of multiple licenses for a single package will become the default. This seemingly small design change will have impacts throughout the entire codebase. But for most users this hopefully will just look like adding an s to the --with-license-file flag (and the plan is to replace the old flag mostly behind the scenes to minimize potential breaking changes) or even no change to usage just a noisy depreciation warning that can be ignored (this re-design is not really about removing any features)

So yeah this would-be the next v5.5.x if not for all that; hence the bump to v6 (alpha))

Impacted GHIs:

• Closes #194

• Contributes to #309 (WIP)

• Closes #328

• Contributes to #327 (remains unresolved)

• Closes #329
• Closes #337
• Closes #338

• Contributes to #242 (WIP)
  • and related...

    • Contributes to #71 (WIP)
    • Contributes to #240 (WIP)
    • Contributes to #241 (remains unresolved)

• Resolves/Closed #352

Included & Superseded PR/MRs

• Supersedes #324
• Supersedes #325
• Includes & Supersedes #326
• Includes & Supersedes #328
• Supersedes #332
• Includes & Supersedes #337
• Includes #339
• Supersedes #341
• Supersedes #343
• Includes #346

Full Changelog: v-5.5.5...v-6.0.0a1

Special thanks to...

• @matejkloska for requesting this pre-release
• @johnthagen for motivating much of this work, and consistent interest
• @stefan6419846 for inspiring fixes, sharing insights, and giving feedback and code-reviews!
• @SAY-5 for their contributions

Patch Notes for 5.5.5

Combines recent pre-releases (including 5.5.2-5.5.4) to deliver significant codebase cleanup and lays the groundwork for upcoming changes planned for version v6.0.

What's Changed

• (RC-3) Additional tweaks to CHANGELOG and various comments.
• (RC-2) Updated Copyright lines and made note of new maintainer
• (RC-1) Reverts experiments from PR #313 to prepare for a proper release.

Full Changelog: v-5.5.4...v-5.5.5

Patch Notes for 5.5.4

Notable Changes

Fixes #288. See GHI #288 & PR #313 for more info and relevant discussion.

• Implements/Configures support for prek
  • Implemented initial pre-commit-config.yaml based on work by @DimitriPapadopoulos
• Implements additional support for typing
  • Extended recent ruff configurations
    • Aligned ruff rules for style a more black compatible experience
    • Enabled rules for linting type annotations with ruff
  • Added new type annotations through-out the codebase, including for test-code
  • Added new experimental linter that aims to support the entire Python Typing spec.
• Updated and re-tooled development dependencies
  • Refactored tooling with more robust handling of pinning the known filelock dependency across python versions
  • Several version bumps (still targeting Python 3.9+)
  • re-factored/re-tooled the Makefile for developer workflows

Impacted GHI

• Closes #288 (Wontfix)
  • Closes #314 (fixed)
  • Closes #315 (fixed)

• Contributes to #319

Included and superseded PRs

• Includes & supersedes #298
• Includes & supersedes #304
• Includes & supersedes #305
• Includes & supersedes #306
• Includes & supersedes #310
• Includes & supersedes #311
• Supersedes #313
• Includes & supersedes #317
• Includes & supersedes #318

Patch Notes for 5.5.3

Notable Changes

🎉 A huge thanks to @DimitriPapadopoulos for their contributions.

• Aligned parsing logic with PEP 753
• Refactored to better leverage f-strings to improve performance slightly

Included and superseded PRs

• Includes & supersedes #300
• Includes & supersedes #301
• Supersedes #302

What's Changed

• Fix warning in tests by @DimitriPapadopoulos in #304
• Get rid of Python 3.5 left-over by @DimitriPapadopoulos in #305
• Use f-strings by @DimitriPapadopoulos in #301
• Improve package home page discovery by @DimitriPapadopoulos in #306
• Additional codebase cleanup

Full Changelog: v-5.5.2...v-5.5.3

Patch Notes for 5.5.2

This update migrates from the linters black and isort to ruff (Code style remains PEP-8 aligned, but should be slightly more readable).

Notable Changes:

• Added support for multi-line allow-only and fail-on arguments
  • Relaxed parsing of most whitespace around semicolon delimeter
• Added simple SECURITY.md policy document
• Fixed a duplication behavior in output when a package was found at multiple paths (e.g., symlinks)
• Fixed issue where lowercase license filenames were ignored
• Improved project Makefile stability for developers
• Migrated from the linters black and isort to ruff
  • Code style remains PEP-8 aligned, but should be slightly more readable.
  • Linting configuration remains in pyproject.toml
• Updated CONTRIBUTORS.md guide with related changes

Impacted GHI

• Closes #208
• Closes #250
• Closes #273
• Closes #290
  • Closes #296
• Closes #292

Included and superseded PRs

• Supersedes #221
• Includes and supersedes #261
• Includes and supersedes #287
• Includes and supersedes #289
• Includes and supersedes #291
• Includes and supersedes #297

Full Changelog: v-5.5.1...v-5.5.2

Patch Notes for 5.5.1

Contains packaging and CI updates, dependency/dev-dependency security updates, small code/style fixes (typos, formatting), and preparation for PEP-compliant metadata and sdist behaviour.

Notable user-visible changes

• Version bump: version set to 5.5.1 (piplicenses.py).
• Typos fixed: README examples and internal docstrings (codespell fix).
• Formatting: Applied black 26.1.0 changes across the codebase.
• CI/CD:
  • Upgraded GitHub Actions runners/actions versions used in workflows:
    • actions/checkout → v6.0.1
    • actions/setup-python → v6.1.0
    • actions/upload-artifact → v6.0.0
    • actions/download-artifact → v7.0.0
    • codecov/codecov-action → v5.5.2
  • Workaround to bypass black lint step for Python 3.9 (black GHA failures with v3.9).
• Packaging & metadata:
  • pyproject.toml: made PEP-compliant changes:
    • build-system requires reviewed
      • project URLs normalized to "homepage", "releasenotes", "issues" (PEP-753 well-known labels)
      • MANIFEST.in updated to use a prune/exclude strategy suitable for setuptools-scm (avoid duplicative explicit include lists).
    • project.license and license-files fields normalized (PEP-639)
    • requires-python remains >=3.9 (note: CI deprecates 3.9 for black)

Developer dependencies updated (security/maintenance):

• urllib3 bumped 2.5.0 → 2.6.3
• wheel bumped 0.45.1 → 0.46.2

Small code cleanups:

• minor whitespace/annotation/style alignment and improved tuple assignment readability in piplicenses.py
• some filename/text extraction behavior unchanged but formatting and docstrings clarified.

Files (high-level) changed in this PR

piplicenses.py — version bump, docstring typo fix, style/formatting adjustments
CHANGELOG.md — added 5.5.1 notes
pyproject.toml — PEP-639/753 packaging metadata and URL label normalisation
MANIFEST.in — adapted for setuptools-scm (prune/exclude)
dev-requirements.txt — urllib3, wheel updates
.github/workflows/python-package.yml and .github/workflows/CD-PyPi.yml — updated action references, black job conditional, upload/download artifact and codecov action upgrades

Impacted GitHub Issues (GHI)

• Closes #209
• Closes #264
• Opened #265
• Closes #266
• Closes #269
• Closes #270

Included / Supersedes PRs

• Supersedes #251
• Includes and Supersedes #252
• Includes and Supersedes #253
• Includes and Supersedes #254
• Includes and Supersedes #255
• Includes and Supersedes #256
• Includes and Supersedes #257
• Includes and Supersedes #258
• Includes and Supersedes #259
• Includes and Supersedes #260
• Includes and Supersedes #263
• Includes and Supersedes #271
• Includes and Supersedes #275
• Supersedes #278
• Supersedes #281

Thanks to these Contributors 🙇

• @Akshat1931 made their first contribution in #244
• @kaine-bruce-dmt made their first contribution in #245
• @cnaples79 made their first contribution in #249
• @DimitriPapadopoulos made their first contribution in #260

Full Changelog: v-5.5.0...v-5.5.1

Patch Notes for 5.5.0

• Minor Security updates
• Initial Implementation of PEP-639 support
• Initial support for builtin tomllib for Python 3.11+ (reducing external dependencies by 1)
• Fixes an edge case where packages are named with version info.
• Declares support for Python 3.13 & 3.14

Impacted GHI:

• Closes #225
• Closes #232

• Contributed to #236

Included and Superseded PRs

• includes and supersedes #210
• includes and supersedes #213
• includes and supersedes #214
• includes and supersedes #215
• includes and supersedes #218
• includes and supersedes #219
• includes and supersedes #222
• includes and supersedes #230

• Dropped support Python 3.8
• Clarified support for Python 3.12
• Migration pyproject.toml about this package
• Breaking changes
  • Implicitly depends on tomli library since version 4.5.0

• Fixes "tomli" to be output only with --with-system option

• Implement new feature pyproject.toml support