Remixware 0.5.0 reads licences more carefully. The SIL Open Font License used to come out as MIT-0, which asks for nothing. A BSD-3 text worded as go-difflib words it came out as BSD-2. The Functional Source License read as MIT or Apache, and Sleepycat as BSD. Those are fixed, and so are the other misreads found by reading all 794 texts of the SPDX License List: none is now read as a licence that asks less than it does. A text Remixware can’t place needs review and its notice, so check fails until the notice is kept.
The dependency gate now reads Cargo.lock. With --online it downloads each added or updated crate and reports a build script or a procedural macro, which run code when the crate is compiled. Two new crates in ripgrep’s grep-index commit both have one, and 10 of the 29 crates in its “update everything” commit do. Go modules that compile C with cgo, link prebuilt objects or run SWIG get a new native-code status, read the way go build reads file names and build tags. So go-sqlite3 is flagged and golang.org/x/sys, whose cgo is AIX and Hurd only, isn’t.
Two rounds of independent review found 20 problems, all fixed with tests first, and a workflow checks the online parts against the real crates.io and Go module proxy. The release post has the details. Open source, with releases for Linux, macOS and Windows.