Augustus Kling

I'd argue it's okay to refuse to generate an SBOM if any version number not confirming to semver is encountered. This is because https://docs.npmjs.com/cli/v10/configuring-npm/package-json#version explicitly says "version must be parseable...

@jkowalleck I'm still willing to provide code to add the license gathering. That said, I'm somewhat occupied these days so I don't know when this will happen. So far I...