The Local Update

After some fabulous feedback, I've been able to change the tasks to get all their information locally. We're getting license info directly from the hex metadata file in deps/, so now you get feedback on the exact versions of the dependencies you're using.

Since we're now caching a version of the SPDX license list locally, it's possible that this may become out-of-date. However, the SPDX list does not change very often, so this is a good trade-off. If the list does update and you need that new information, give the --update flag to any task in order to pull fresh data.

I also made the remaining two prod dependencies optional, because they are now only used for the --update flag and nothing else. Might as well try to keep the number of dependencies down.

Added

• All tasks now accept the --update flag to pull down a fresh copy of the license list instead of using the version checked into this repo.

Changed

• No longer makes HTTP calls to Hex and SPDX, and instead uses locally-available information.
• httpoison and poison deps are now optional, since using --update is optional.