License "GPL-2.0+" is a deprecated SPDX license identifier, use "GPL-2.0+-only" or "GPL-2.0+-or-later" instead

This has to be merged in all branches.

I could imagine that drupal's packagist stopped working properly as well as https://packagist.org/ does for Thunder because of:

Reading composer.json of burdamagazinorg/thunder (master)
Importing branch master (dev-master)
Skipped branch master, Invalid package information: 
License "GPL-2.0+" is a deprecated SPDX license identifier, use "GPL-2.0-or-later" instead

Seems that the infrastructure team is already aware of that: https://github.com/composer/packagist/issues/858

Quoting the Packagist maintainer from the GitHub issue linked in #5:

Alright sorry everyone.. I was hoping this would push all projects to move to the new identifiers quickly but I realize this was probably too hopeful given the amount of projects involved and the fact that as you say many historical branches are to be fixed and that blocks updates.

I tweaked the code in composer/composer@5a1765c so that only new/updated branches will fail the validation and need to be updated. Old branches will be treated as valid even if they use deprecated license identifiers.

I hope that's a compromise everyone can live with.

This means we won't have to update the historical 8.0.x, 8.1.x, 8.2.x, 8.3.x and 8.4.x branches. In principle, we don't even have to update 8.5.x and 8.6.x. But we probably do want to update those.

This still blocks packagist from updating the 8.5.x and 8.6.x branches (and 8.4.x branches if there were any security releases), meaning that nobody is able to get the latest versions of those branches. Additionally, we are going to need to update this everywhere that we make a subtree split, so core/composer.json and all of the components under core/lib/Drupal/Component/* as well.

and 8.4.x branches if there were any security releases

I think that makes this critical

Tested each composer.json file in core.
find . -name composer.json|grep -v vendor|while read r;do cd ~/git/core/drupal;cd `dirname $r`;echo $r;composer validate;done

./core/lib/Drupal/Component/Bridge/composer.json
./composer.json is valid
./core/lib/Drupal/Component/ProxyBuilder/composer.json
./composer.json is valid
./core/lib/Drupal/Component/Graph/composer.json
./composer.json is valid
./core/lib/Drupal/Component/DependencyInjection/composer.json
./composer.json is valid
./core/lib/Drupal/Component/Render/composer.json
./composer.json is valid
./core/lib/Drupal/Component/FileSystem/composer.json
./composer.json is valid
./core/lib/Drupal/Component/Uuid/composer.json
./composer.json is valid
./core/lib/Drupal/Component/HttpFoundation/composer.json
./composer.json is valid
./core/lib/Drupal/Component/Assertion/composer.json
./composer.json is valid
./core/lib/Drupal/Component/Annotation/composer.json
./composer.json is valid
./core/lib/Drupal/Component/Datetime/composer.json
./composer.json is valid
./core/lib/Drupal/Component/PhpStorage/composer.json
./composer.json is valid
./core/lib/Drupal/Component/FileCache/composer.json
./composer.json is valid
./core/lib/Drupal/Component/Discovery/composer.json
./composer.json is valid
./core/lib/Drupal/Component/EventDispatcher/composer.json
./composer.json is valid
./core/lib/Drupal/Component/Utility/composer.json
./composer.json is valid
./core/lib/Drupal/Component/Plugin/composer.json
./composer.json is valid
./core/lib/Drupal/Component/Diff/composer.json
./composer.json is valid
./core/lib/Drupal/Component/ClassFinder/composer.json
./composer.json is valid
./core/lib/Drupal/Component/Serialization/composer.json
./composer.json is valid
./core/lib/Drupal/Component/Transliteration/composer.json
./composer.json is valid
./core/lib/Drupal/Component/Gettext/composer.json
./composer.json is valid
./core/composer.json
./composer.json is valid
./composer.json
./composer.json is valid

Committed as b159de5 and pushed to 8.6.x.

Cherry-picked as 8d0135d and pushed to 8.5.x.

Cherry-picked as 6b3c4ef and pushed to 8.4.x.

@Mixologic could our CI run composer validate and throw an error if it failed to validate?

@larowlan: https://www.drupal.org/project/drupalci_testbot/issues/2938861 yes, yes we can and should do that. I'll add it to the list of things to fix.