## Description There are cases when SPDX license list doesn't contain license of dependency/package. We need to use [ExtractedLicensingInfo](https://spdx.github.io/spdx-spec/v2.3/other-licensing-information-detected/) field. Example: https://github.com/spdx/tools-java/blob/master/testResources/SPDXJSONExample-v2.2.spdx.json ### Discussed in https://github.com/aquasecurity/trivy/discussions/7366