[rajanpanth]

Description

A SpdxLicense whose id is not a known SPDX id is normalized as a named license. That fallback only passed url on, so the license text, acknowledgement and properties were lost in JSON and XML. It now passes all four, and the result is the same as for a NamedLicense with the same data. The per-spec handling of acknowledgement and properties is unchanged, since the value still goes through the named-license normalizer.

One test added to each of Serialize.JsonNormalize.test.js and Serialize.XmlNormalize.test.js; both fail without the fix. No snapshot changes. All 4227 tests pass; tsc --noEmit and ESLint are clean.

Resolves or fixes issue: #1539

AI Tool Disclosure

• My contribution does not include any AI-generated content
• My contribution includes AI-generated content, as disclosed below:
  • AI Tools: Claude Code
  • LLMs and versions: Claude Fable 5
  • Prompts: Look for cases where the library's output loses data or breaks the bundled schemas, reproduce each with a script, then fix this one with a test in each normalizer test file.

Affirmation

• My code follows the CONTRIBUTING.md guidelines

[codacy-production]

Up to standards ✅

🟢 Issues 0 issues

Results:
0 new issues

View in Codacy

🟢 Metrics 0 complexity · 0 duplication

Metric	Results
Complexity	0
Duplication	0

View in Codacy

_{NEW Get contextual insights on your PRs based on Codacy's metrics, along with PR and Jira context, without leaving GitHub. Enable AI reviewer
TIP This summary will be updated as you push new changes.}

[read-the-docs-community]

Documentation build overview

📚 CycloneDX JavaScript Library | 🛠️ Build #35813206 | 📁 Comparing 61ed46a against latest (33ba0ca)

  🔍 Preview build  

1 file changed

± changelog.html

[kmlyz]

The fallback in src/serialize/json/normalize.ts and src/serialize/xml/normalize.ts correctly forwards acknowledgement, text, url, and properties to NamedLicense, resolving data loss for unknown SPDX IDs without schema regression.

• TypeScript build (build:node) and typecheck (tsc --noEmit) complete with zero errors.
• Test suite passes cleanly with 4,919 tests passing and 97.9% code coverage.
• JSON and XML serialization of unknown SPDX IDs maintain parity with NamedLicense outputs.

Disclosure: Review and test verification conducted with assistance from Google Antigravity (Gemini 4 Carbon).