build(deps): bump github.com/posit-dev/go-python-packaging from 0.7.0 to 0.8.0

[dependabot]

Bumps github.com/posit-dev/go-python-packaging from 0.7.0 to 0.8.0.

Changelog

Sourced from github.com/posit-dev/go-python-packaging's changelog.

[0.8.0] - 2026-08-19

Breaking

• license: Types takes a third argument, the raw free-form License field. Callers that pass only the expression and the classifiers must add it; pass "" to keep the previous behaviour exactly.

Added

• license: Types now derives a license from the legacy free-form License field when neither License-Expression nor a License :: classifier says anything. This is the population that previously derived to Unknown.

  The tier is deliberately strict: one unrecognized token rejects the whole field. The field resolves only when it is itself a published, non-deprecated SPDX identifier, or an SPDX expression whose every identifier is one. That is what stops an unrecognized token from producing a license — 3-Clause BSD License tokenizes to 3-Clause / BSD / License, and accepting the plausible part would attribute BSD-3-Clause to a package on the strength of a word. It is not a guarantee that a recognized token was meant as an identifier: SPDX publishes around 120 single-word identifiers, some of them ordinary words or company names, so a package whose License field reads Intel resolves to the Intel Open Source License.

  The tier is also suppressed entirely when the package carries any License :: classifier, including one SPDX has no identifier for. Such a classifier still says something — License :: Other/Proprietary License is a positive statement — and it would otherwise reach this tier looking identical to a package that declared nothing, letting a stray free-form MIT overrule it.

  The rule settles the ambiguous spellings without anyone adjudicating them. Bare GPL and GPLv3 are not identifiers, so they are rejected rather than resolved to a guessed version; bare BSD names a family with several incompatible members; aliases in real use such as Apache 2.0 and MIT License are rejected for the same reason, and recognizing them is a separate decision requiring per-entry review. Matching is case-insensitive, so mit resolves to MIT.

  Because it runs last, the tier can only move a package out of Unknown, never overrule a license the package declared through a structured field.

  Measured against the live PyPI corpus (1,745,000 free-form-only (name, version) pairs, 17,846 distinct strings, captured 2026-08-18): 48.35% resolve, from 278 distinct strings. The largest remaining rejections are UNKNOWN (69,824), Apache 2.0 (63,176), Apache License 2.0 (57,107), BSD (44,585) and MIT License (40,663).

• license: the free-form tier checks identifiers against the published SPDX

... (truncated)

Commits

• cb5d9cd chore(release): date 0.8.0
• 9c866d5 license: derive a license from the free-form License field (#40)
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[dependabot]

Superseded by #57.