BUG: Pipeline failure when scanning pkg:github/facebook/react@v19.2.1

[DennisClark]

Describe the bug
Scan of pkg:github/facebook/react@v19.2.1 from DejaCode returns a pipeline failure.

System configuration

      "tool_name": "scanpipe",
      "tool_version": "36.0.0-dev",
      "other_tools": [
        "pkg:pypi/scancode-toolkit@32.4.0"
      ],
      "notice": "Generated with ScanCode.io and provided on an \"AS IS\" BASIS, WITHOUT WARRANTIES\nOR CONDITIONS OF ANY KIND, either express or implied.\nNo content created from ScanCode.io should be considered or used as legal advice.\nConsult an Attorney for any legal advice.\nScanCode.io is a free software code scanning tool from nexB Inc. and others\nlicensed under the Apache License version 2.0.\nScanCode is a trademark of nexB Inc.\nVisit https://github.com/nexB/scancode.io for support and download.\n",
      "uuid": "1781ff40-a593-4956-8e70-165c66c157eb",
      "created_date": "2025-12-05T23:29:23.815Z",
      "notes": "",
      "settings": {},
      "input_sources": [
        {
          "uuid": "9b321317-8e5b-4dbb-8293-7e91ef3a4064",
          "filename": "react-19.2.1.tar.gz",
          "download_url": "https://github.com/facebook/react/archive/refs/tags/v19.2.1.tar.gz",
          "is_uploaded": false,
          "tag": "",
          "size": 9107772,
          "is_file": true,
          "exists": true
        }
      ],
      "runs": [
        {
          "pipeline_name": "scan_single_package",
          "status": "failure",
          "description": "Scan a single package archive (or package manifest file).",
          "selected_groups": null,
          "selected_steps": null,
          "uuid": "6d42c8c8-4bc7-462b-9d03-5f48a0f0b902",
          "created_date": "2025-12-05T23:29:23.824718Z",
          "scancodeio_version": "36.0.0-dev",
          "task_id": "6d42c8c8-4bc7-462b-9d03-5f48a0f0b902",
          "task_start_date": "2025-12-05T23:29:23.894974Z",
          "task_end_date": "2025-12-05T23:34:34.216024Z",
          "task_exitcode": 1,

To Reproduce
Scan pkg:github/facebook/react@v19.2.1 from DejaCode

Expected behavior
complete scan results, rather than an error

Results attached. There was no summary generated.

react-19.2.1.tar.gz_scan.zip

[tdruez]

['“true” value must be either True or False.']

Traceback:
  File "/opt/scancodeio/aboutcode/pipeline/__init__.py", line 199, in execute
    step(self)
    ~~~~^^^^^^
  File "/opt/scancodeio/scanpipe/pipelines/scan_single_package.py", line 131, in load_inventory_from_toolkit_scan
    input.load_inventory_from_toolkit_scan(self.project, self.scan_output_location)
    ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/opt/scancodeio/scanpipe/pipes/input.py", line 106, in load_inventory_from_toolkit_scan
    scancode.create_discovered_packages(project, scanned_codebase)
    ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/opt/scancodeio/scanpipe/pipes/scancode.py", line 1001, in create_discovered_packages
    pipes.update_or_create_package(project, package_data)
    ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~^^^^^^^^^^^^^^^^^^^^^^^
  File "/opt/scancodeio/scanpipe/pipes/__init__.py", line 217, in update_or_create_package
    package = DiscoveredPackage.create_from_data(project, package_data)
  File "/opt/scancodeio/scanpipe/models.py", line 3817, in create_from_data
    discovered_package.save(save_error=False, capture_exception=False)
    ~~~~~~~~~~~~~~~~~~~~~~~^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/opt/scancodeio/scanpipe/models.py", line 1827, in save
    super().save(*args, **kwargs)
    ~~~~~~~~~~~~^^^^^^^^^^^^^^^^^
  File "/opt/scancodeio/scanpipe/models.py", line 2680, in save
    super().save(*args, **kwargs)
    ~~~~~~~~~~~~^^^^^^^^^^^^^^^^^
  File "/opt/scancodeio/.venv/lib/python3.13/site-packages/django/db/models/base.py", line 902, in save
    self.save_base(
    ~~~~~~~~~~~~~~^
        using=using,
        ^^^^^^^^^^^^
    ...<2 lines>...
        update_fields=update_fields,
        ^^^^^^^^^^^^^^^^^^^^^^^^^^^^
    )
    ^
  File "/opt/scancodeio/.venv/lib/python3.13/site-packages/django/db/models/base.py", line 1008, in save_base
    updated = self._save_table(
        raw,
    ...<4 lines>...
        update_fields,
    )
  File "/opt/scancodeio/.venv/lib/python3.13/site-packages/django/db/models/base.py", line 1169, in _save_table
    results = self._do_insert(
        cls._base_manager, using, fields, returning_fields, raw
    )
  File "/opt/scancodeio/.venv/lib/python3.13/site-packages/django/db/models/base.py", line 1210, in _do_insert
    return manager._insert(
           ~~~~~~~~~~~~~~~^
        [self],
        ^^^^^^^
    ...<3 lines>...
        raw=raw,
        ^^^^^^^^
    )
    ^
  File "/opt/scancodeio/.venv/lib/python3.13/site-packages/django/db/models/manager.py", line 87, in manager_method
    return getattr(self.get_queryset(), name)(*args, **kwargs)
           ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~^^^^^^^^^^^^^^^^^
  File "/opt/scancodeio/.venv/lib/python3.13/site-packages/django/db/models/query.py", line 1873, in _insert
    return query.get_compiler(using=using).execute_sql(returning_fields)
           ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~^^^^^^^^^^^^^^^^^^
  File "/opt/scancodeio/.venv/lib/python3.13/site-packages/django/db/models/sql/compiler.py", line 1881, in execute_sql
    for sql, params in self.as_sql():
                       ~~~~~~~~~~~^^
  File "/opt/scancodeio/.venv/lib/python3.13/site-packages/django/db/models/sql/compiler.py", line 1806, in as_sql
    self.prepare_value(field, self.pre_save_val(field, obj))
    ~~~~~~~~~~~~~~~~~~^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/opt/scancodeio/.venv/lib/python3.13/site-packages/django/db/models/sql/compiler.py", line 1741, in prepare_value
    return field.get_db_prep_save(value, connection=self.connection)
           ~~~~~~~~~~~~~~~~~~~~~~^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/opt/scancodeio/.venv/lib/python3.13/site-packages/django/db/models/fields/__init__.py", line 1012, in get_db_prep_save
    return self.get_db_prep_value(value, connection=connection, prepared=False)
           ~~~~~~~~~~~~~~~~~~~~~~^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/opt/scancodeio/.venv/lib/python3.13/site-packages/django/db/models/fields/__init__.py", line 1005, in get_db_prep_value
    value = self.get_prep_value(value)
  File "/opt/scancodeio/.venv/lib/python3.13/site-packages/django/db/models/fields/__init__.py", line 1190, in get_prep_value
    return self.to_python(value)
           ~~~~~~~~~~~~~~^^^^^^^
  File "/opt/scancodeio/.venv/lib/python3.13/site-packages/django/db/models/fields/__init__.py", line 1180, in to_python
    raise exceptions.ValidationError(
    ...<3 lines>...
    )

[tdruez]

This looks like a scancode-toolkit bug, returning 'is_private': 'true' instead of 'is_private': True

{'type': 'npm', 'namespace': None, 'name': 'react-devtools-fusebox', 'version': '0.0.0', 'qualifiers': {}, 'subpath': None, 'primary_language': 'JavaScript', 'description': None, 'release_date': None, 'parties': [], 'keywords': [], 'homepage_url': None, 'download_url': 'https://registry.npmjs.org/react-devtools-fusebox/-/react-devtools-fusebox-0.0.0.tgz', 'size': None, 'sha1': None, 'md5': None, 'sha256': None, 'sha512': None, 'bug_tracking_url': None, 'code_view_url': None, 'vcs_url': None, 'copyright': None, 'holder': None, 'declared_license_expression': 'mit', 'declared_license_expression_spdx': 'MIT', 'license_detections': [{'license_expression': 'mit', 'license_expression_spdx': 'MIT', 'matches': [{'license_expression': 'mit', 'license_expression_spdx': 'MIT', 'from_file': 'codebase/react-19.2.1/packages/react-devtools-fusebox/package.json', 'start_line': 1, 'end_line': 1, 'matcher': '1-spdx-id', 'score': 100.0, 'matched_length': 1, 'match_coverage': 100.0, 'rule_relevance': 100, 'rule_identifier': 'spdx-license-identifier-mit-5da48780aba670b0860c46d899ed42a0f243ff06', 'rule_url': None, 'matched_text': 'MIT'}], 'identifier': 'mit-a822f434-d61f-f2b1-c792-8b8cb9e7b9bf'}], 'other_license_expression': None, 'other_license_expression_spdx': None, 'other_license_detections': [], 'extracted_license_statement': '- MIT\n', 'notice_text': None, 'source_packages': [], 'is_private': 'true', 'is_virtual': False, 'extra_data': {}, 'repository_homepage_url': None, 'repository_download_url': None, 'api_data_url': None, 'package_uid': 'pkg:npm/react-devtools-fusebox@0.0.0?uuid=a3f14bc7-06a8-47f0-a6b1-42bb5e0fac37', 'datafile_paths': ['codebase/react-19.2.1/packages/react-devtools-fusebox/package.json'], 'datasource_ids': ['npm_package_json'], 'purl': 'pkg:npm/react-devtools-fusebox@0.0.0'}

{'type': 'npm', 'namespace': None, 'name': 'react-devtools-fusebox', 'version': '0.0.0', 'qualifiers': {}, 'subpath': None, 'primary_language': 'JavaScript', 'description': None, 'release_date': None, 'parties': [], 'keywords': [], 'homepage_url': None, 'download_url': 'https://registry.npmjs.org/react-devtools-fusebox/-/react-devtools-fusebox-0.0.0.tgz', 'size': None, 'sha1': None, 'md5': None, 'sha256': None, 'sha512': None, 'bug_tracking_url': None, 'code_view_url': None, 'vcs_url': None, 'copyright': None, 'holder': None, 'declared_license_expression': 'mit', 'declared_license_expression_spdx': 'MIT', 'license_detections': [{'license_expression': 'mit', 'license_expression_spdx': 'MIT', 'matches': [{'license_expression': 'mit', 'license_expression_spdx': 'MIT', 'from_file': 'codebase/react-19.2.1/packages/react-devtools-fusebox/package.json', 'start_line': 1, 'end_line': 1, 'matcher': '1-spdx-id', 'score': 100.0, 'matched_length': 1, 'match_coverage': 100.0, 'rule_relevance': 100, 'rule_identifier': 'spdx-license-identifier-mit-5da48780aba670b0860c46d899ed42a0f243ff06', 'rule_url': None, 'matched_text': 'MIT'}], 'identifier': 'mit-a822f434-d61f-f2b1-c792-8b8cb9e7b9bf'}], 'other_license_expression': None, 'other_license_expression_spdx': None, 'other_license_detections': [], 'extracted_license_statement': '- MIT\n', 'notice_text': None, 'source_packages': [], 'is_private': 'true', 'is_virtual': False, 'extra_data': {}, 'repository_homepage_url': None, 'repository_download_url': None, 'api_data_url': None, 'package_uid': 'pkg:npm/react-devtools-fusebox@0.0.0?uuid=9802b5e3-488d-4fdc-a5eb-9fb320f9172f', 'datafile_paths': ['codebase/react-19.2.1/packages/react-devtools-fusebox/package.json'], 'datasource_ids': ['npm_package_json'], 'purl': 'pkg:npm/react-devtools-fusebox@0.0.0'}

[tdruez]

Using https://github.com/facebook/react/blob/main/packages/react-devtools-fusebox/package.json

scancode --package /Users/operator/Downloads/package.json --json-pp -

...
 "packages": [
    {
      "type": "npm",
      "namespace": null,
      "name": "react-devtools-fusebox",
      "version": "0.0.0",
      "qualifiers": {},
      "subpath": null,
      "primary_language": "JavaScript",
      ...
      "is_private": "true",    <------------------
      "is_virtual": false,
...

[tdruez]

Entered as aboutcode-org/scancode-toolkit#4631

[zeba-source]

Hello everyone , I am Zeba . I would like to work on this issue from what I understand is that the is_private is returning true which is a string instead of a Boolean True . I can work on handling this bug and submit the PR.
Thank You

[tdruez]

Hi @zeba-source this has already been fixed on the toolkit side afaik: aboutcode-org/scancode-toolkit#4631

Edit: fix confirmed on the ScanCode.io side as well.

[zeba-source]

Thanks for the clarification! I’ll look into other open issues where I can contribute.