Bug: AttributeError: 'LicenseWithExceptionSymbol' object has no attribute 'key'

[elizabethmcnish]

Before You Begin

Before proceeding, please make sure to follow these steps:

• I have checked for similar issues in the project's issue tracker.
• I have searched closed issues to see if a similar problem was reported
  before.

Issue Details

Licensecheck is suddenly failing for one of our requirements.txt files, with:

AttributeError: 'LicenseWithExceptionSymbol' object has no attribute 'key'

We have neither updated this file or licensecheck itself recently.

Description

This has just suddenly started happening. We have neither updated this file or licensecheck itself recently.
This error is resolved when we comment out the following libraries:

shap, particles, numba, llvmlite

These libraries have existed in the requirements.txt for many months.

Possible issue (from ChatGPT):
One (or more) of these packages has an SPDX-style license with a WITH exception in its metadata (or something else that makes license-expression return a LicenseWithExceptionSymbol).

licensecheck is assuming every symbol has a .key attribute, which is not true for LicenseWithExceptionSymbol, so it dies.

[gudbrandtandberg]

Hello. I am getting the same error.

Summary

When a dependency’s license expression includes an SPDX exception (e.g., “Apache-2.0 WITH LLVM-exception AND BSD-2-Clause”), licensecheck crashes while constructing the display string because it assumes every literal token has a .key attribute. LicenseWithExceptionSymbol does not, causing an AttributeError.

Repro

1. Create a requirements.txt file containing "llvmlite==0.46.0" (or any other dependency with an exception-bearing SPDX)
2. python -m licensecheck --requirements-paths requirements.txt
3. Fails while formatting parsed license tokens.

Environment

licensecheck: 2025.1
license_expression: 30.4.4
Python: 3.11.3
OS: Window 11 Pro

Workaround

Run with --skip-dependencies llvmlite to bypass the offending package.

[FredHappyface]

Thanks for this, I'll look at the linked merge request when I get some more time to work on things. Some massaging may be needed as said pr makes changes across the resolver and licensecheck logic