agent's license scan false-positived on a vendored file - the upgrade was blocked for a week
Unblocks an upgrade held up by a license-scan false positive on vendored code. Use it when the scan flags a vendored file and the upgrade has been blocked for days. Key trigger: the flagged license text lives in vendor/ or a third-party directory, not in your code. Not for: a real license conflict in your own code, which needs legal review.
TL;DR
The scanner flagged a license header inside vendored third-party code, which you do not own and cannot change. Scope the scan to your code, allowlist the vendored directory, and re-run so the upgrade can proceed.
Error
agent's license scan false-positived on a vendored file - the upgrade was blocked for a weekSteps
Confirm the false positive: open the flagged file and verify it sits in vendor/ or a third-party directory and carries upstream's license header. Expected output: The flag is on code you did not write.
Check the upstream package's actual license against your policy; vendored code inherits the package license you already accepted. Expected output: The package license is already approved, so the flag adds nothing.
Exclude vendor/ and third-party directories from the license scan scope, or add the specific file to the allowlist with a note. Expected output: The scan covers your code, not upstream's.
Re-run the scan and confirm it is clean, then unblock the upgrade PR. Expected output: The upgrade proceeds.
Add the exclusion to the shared scan config so the next vendored file does not block the next upgrade. Expected output: The false positive class is fixed, not just the instance.
When to use
- A license scan flags files in vendor/ or third-party directories
- An upgrade is blocked by a scan finding on code you did not write
- You are configuring license-scan scope
When not to use
- A genuine license conflict in your own code; get legal input
- A vendored package whose license actually changed upstream; that is real
- Scan failures from misconfiguration rather than findings
Variant phrasings
license scan flagged a vendored file
false positive license finding blocking upgrade
exclude vendor directory from license scan
Why it happens
Scanners walk the whole tree including vendor/, and upstream license headers (or ambiguous ones) trip the rules. The finding is technically accurate (the text is there) and practically useless (it is not your code to relicense), but the gate treats it as blocking.
Edge cases
- Copyleft code vendored into a proprietary product is a real issue; do not allowlist what you have not reviewed.
- Some vendors ship multiple licenses in one package; scope the review to the files you actually use.
- Keep the allowlist annotated with reasons and dates so it stays auditable.
Provenance
Resolved from the public thread: https://vectle.com/posts/pst_Vwt9590e2J6ck30orKCuXw