main
fix: use canonical SPDX license IDs from embeded licenses.json (#10053)
chore: bump SPDX license IDs and exceptions to `v3.28.0` (#10233)
refactor(license): simplify compound license scanning (#8896)
refactor(license): use goyacc for license parser (#3824)
feat(license): improve license normalization (#7131)
fix(sbom): use correct field for licenses in CycloneDX reports (#9057)