A NuGet package declares its license in the nuspec license element, either as an SPDX expression such as MIT or BSD-2-Clause OR MIT, or as a path to a license file packaged inside it. The older licenseUrl element is deprecated, so a scanner that relies on it will miss newer packages.
What the nuspec reference says
The license element is supported from NuGet 4.9.0. It holds an SPDX license expression or a path to a license file in the package. For common licenses, the documentation tells authors to use the SPDX identifier. For several licenses it allows a composite expression with operators such as OR. If the license is custom, the author packages a text or Markdown file and points to it.
nuget.org accepts only license expressions approved by the Open Source Initiative or the Free Software Foundation, according to the reference. The expression grammar also allows WITH for exceptions and the UNLICENSED value.
The requireLicenseAcceptance element is separate. It tells the client whether to prompt the consumer to accept the license before installing.
Reading each form
| Nuspec content | Meaning | Audit action |
|---|---|---|
| license type expression, MIT | One SPDX license | Match to policy |
| license type expression, A OR B | Choice | Record your choice |
| license type file | Custom text inside the package | Read the file |
| licenseUrl only | Legacy pointer to a web page | Fetch and read, treat as lower confidence |
| UNLICENSED | No rights granted | Do not use without permission |
Audit steps for a .NET solution
- Restore packages and list all of them, including transitive ones.
- Read the nuspec inside each package, since it ships with the package.
- Normalize expressions and apply your policy tiers. See allow, review, deny tiers.
- For file type licenses, read the text and send unfamiliar terms to review.
- For licenseUrl only packages, fetch the page, save the text, and note the date, since web pages change.
- Ship notices for the packages you distribute.
Why the web link is weak
A URL can change or disappear after you approve a package. Prefer the license text that travels inside the package.
Try it yourself
Click through it at your own pace, or open it full screen.
Open a few components and see what license data an inventory holds for each.
Safeguard scans dependencies and builds SBOMs, and a free scan shows how it reads a project.
Quick check
Is licenseUrl still valid?
The reference marks it deprecated and says to use the license element instead.
Does requireLicenseAcceptance mean the license was reviewed?
No. It only makes the client prompt the consumer. Your own review is separate.
Sources
- Microsoft Learn, .nuspec File Reference for NuGet: https://learn.microsoft.com/en-us/nuget/reference/nuspec#license
Last reviewed: 19 October 2026.
