diff --git a/go.mod b/go.mod
index 7bf0353..9c5730f 100644
--- a/go.mod
+++ b/go.mod
@@ -10,7 +10,7 @@ require (
 	github.com/git-pkgs/registries v0.6.4
 	github.com/git-pkgs/sbom v0.1.3
 	github.com/git-pkgs/sigstore v0.1.2
-	github.com/git-pkgs/spdx v0.2.0
+	github.com/git-pkgs/spdx v0.3.0
 	github.com/git-pkgs/vers v0.3.0
 	github.com/sigstore/sigstore-go v1.3.0
 	github.com/spf13/cobra v1.10.2
diff --git a/go.sum b/go.sum
index 4a757dd..2135f45 100644
--- a/go.sum
+++ b/go.sum
@@ -242,8 +242,8 @@ github.com/git-pkgs/sbom v0.1.3 h1:HNZabAgUSu4qel9tVtAedZTjMmml2JRaFYNuipBCGjs=
 github.com/git-pkgs/sbom v0.1.3/go.mod h1:42YiJ+W9jBsPZnYJQs6tUlOtWlC0vDBOtND8TMwE8ek=
 github.com/git-pkgs/sigstore v0.1.2 h1:NEBYjDMQyUplloSGJHBwy2c0AFVlrl/0JolRHE55Gvo=
 github.com/git-pkgs/sigstore v0.1.2/go.mod h1:t4e7ovHPP2Ml1lCxAu87Lr0/zQaJsuXnF0c2Cpty+lc=
-github.com/git-pkgs/spdx v0.2.0 h1:kUz0ZV/AYTwCrCNH8Vtodr79Dy9vU8/G+b8grpyPR+g=
-github.com/git-pkgs/spdx v0.2.0/go.mod h1:cqRoZcvl530s/W+oGNvwjt4ODN8T1W6D/20MUZEFdto=
+github.com/git-pkgs/spdx v0.3.0 h1:AN0guJE7vN5gbOMi9We4j1ziS4cwgFVhTvjVDGfaC7Q=
+github.com/git-pkgs/spdx v0.3.0/go.mod h1:cqRoZcvl530s/W+oGNvwjt4ODN8T1W6D/20MUZEFdto=
 github.com/git-pkgs/vers v0.3.0 h1:xM4LLUCRmqzdDfe+/pVQUx4SRyFXRVth6tOsJ14wMKU=
 github.com/git-pkgs/vers v0.3.0/go.mod h1:biTbSQK1qdbrsxDEKnqe3Jzclxz8vW6uDcwKjfUGcOo=
 github.com/github/go-spdx/v2 v2.7.0 h1:GzfXx4wFdlilARxmFRXW/mgUy3A4vSqZocCMFV6XFdQ=